3319 matches found
linux/x86 setuid(0) & execve(/bin/sh,0,0) shellcode 28 bytes
No description provided by source. -------------------ASM---------------------- global start section .text start: ;setuid0 xor ebx,ebx lea eax,ebx+17h cdq int 80h ;execve/bin/sh,0,0 xor ecx,ecx push ecx push 0x68732f6e push 0x69622f2f lea eax,ecx+0Bh mov ebx,esp int 80h...
Oracle Database Server 9.0.x Oracle Binary Local Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/8844/info Oracle Database Server 'oracle' binary has been reported prone to a local buffer overflow vulnerability. The issue likely presents itself due to a lack of sufficient boundary checks performed on command line...
CDRTools CDRecord 1.11/2.0 Devname Format String Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/7565/info CDRecord has been reported prone to a format string vulnerability. The issue presents itself due to a programming error that occurs when calling a printf-like function. It has been reported that by harnessing an...
QNX Photon pkg-installer -s Parameter Overflow
No description provided by source. source: http://www.securityfocus.com/bid/11164/info Reportedly QNX Photon MicroGUI is affected by multiple buffer overflow vulnerabilities in MicroGUI utilities. These issues are due to a failure of the affected applications to validate user-supplied string...
Solaris 7/8 kcms_configure Command-Line Buffer Overflow Vulnerability (1)
No description provided by source. source: http://www.securityfocus.com/bid/2558/info The Kodak Color Management System, or KCMS, is a package that ships with workstation installations of Solaris 7 and 8. kcmsconfigure, a part of KCMS, is vulnerable to a buffer overflow if it is passed an overly...
BSDI BSD/OS <= 2.1,FreeBSD <= 2.1,IBM AIX <= 4.2,SGI IRIX <= 6.4,Sun SunOS <= 4.1.3
No description provided by source. source: http://www.securityfocus.com/bid/129/info Rdist is a program to maintain identical copies of files over multiple hosts. It preserves the owner, group, mode, and mtime of files if possible and can update programs that are executing. Rdist reads commands...
Mac OS X <= 10.2.4 DirectoryService (PATH) Local Root Exploit
No description provided by source. / OS X = 10.2.4 DirectoryService local root PATH exploit DirectoryService must be crashed prior to execution, per @stake advisory. If you discover how to crash DirectoryService e-mail me at [email protected] Neeko Oni -- Assuming DirectoryService has been...
ChiTeX 6.1.2 - Local Privilege Escalation Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/7263/info A vulnerability in ChiTex has been reported that may allow local users to obtain root privileges on vulnerable systems. The vulnerability exists due to the existence of two setuid root binaries that execute the...
Knox Software Arkeia 4.0 Backup Local Overflow
No description provided by source. / source: http://www.securityfocus.com/bid/661/info Knox Software Arkeia 4.0 Backup rnavc & nlserverd HOME Environment Variable Buffer Overflow A local buffer overflow in the handling of the HOME environment variable by the rlserver and rnavc binaries that are...
AFD 1.2.x Working Directory Local Buffer Overflow Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/5626/info AFD Automatic File Distributor is prone to a number of locally exploitable stack and heap based buffer overflow conditions. These issues are all related to insufficient bounds checking of externally supplied...
Solaris 10 (libnspr) - Arbitrary File Creation Local Root Exploit
No description provided by source. !/bin/sh $Id: raptorlibnspr,v 1.1 2006/10/13 19:12:12 raptor Exp $ raptorlibnspr - Solaris 10 libnspr oldschool local root Copyright c 2006 Marco Ivaldi [email protected] Local exploitation of a design error vulnerability in version 4.6.1 of NSPR, as includ...
CDRDAO 1.1.x Home Directory Configuration File Symbolic Link Vulnerability (3)
No description provided by source. source: http://www.securityfocus.com/bid/3865/info CDRDAO is a freely available, open source CD recording software package available for the Unix and Linux Operating Systems. It is maintained by Andreas Mueller. When CDRDAO saves it's configuration to the .cdrda...
Adobe Version Cue 1.0/1.0.1 - (-lib) Local Root Exploit (OSX)
No description provided by source. / Adobe Version Cue VCNativeOSX: local root exploit. dyld by: vade79/v9 [email protected] fakehalo/realhalo Adobe Version Cue's VCNative program allows un-privileged local users to load arbitrary librariesbundles while running setuid root. this is done via the -lib...
SCO Open Server 5.0.5 X Library Buffer Overflow Vulnerability (1)
No description provided by source. source: http://www.securityfocus.com/bid/638/info A buffer overflow vulnerability in the shared X library may allows local users to obtain higher privileges. Any setuid applications linked against the library are possibly vulnerable. The vulnerability is in the...
kernel 2.2.x/2.4 .0-test1,SGI ProPack 1.2/1.3 Capabilities Vulnerability (2)
No description provided by source. source: http://www.securityfocus.com/bid/1322/info POSIX Capabilities have recently been implemented in the Linux kernel. These Capabilities are an additional form of privilege control to enable more specific control over what priviliged processes can do...
QNX 6.x 'ptrace()' Arbitrary Process Modification Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/4919/info The QNX implementation of 'ptrace' is reportedly insecure. An unprivileged process may attach to a setuid program without restriction. Since the attaching process may view or edit memory, an attacker may exploit...
HP-UX 10/11 NLSPATH Environment Variable Format String Vulnerability (2)
No description provided by source. source: http://www.securityfocus.com/bid/8985/info HP-UX allows the NLSPATH to be set for setuid root programs, which use catopen3C and may be executed by other local users. This could result in privilege escalation as an attacker could specify an arbitrary path...
solaris/x86 setuid(0), execve(//bin/sh); exit(0) NULL Free 39 bytes
No description provided by source. / ; sm4x 2008 ; setuid0, execve'/bin/sh', '/bin/sh', 0, ; 39 bytes NizzULL free you know... ; SunOS sol01 5.11 snv86 i86pc i386 i86pc Solaris ; quick port to drop root sh - ; - SunOS is pwnij global start start: xor eax, eax ; --- setuid0 push eax push eax mov a...
David Bagley xlock 4.16 User Supplied Format String Vulnerability (2)
No description provided by source. source: http://www.securityfocus.com/bid/1585/info A vulnerability exists in versions of the xlockmore program, originally written by David Bagley. It is believed to affect all versions of xlock derived from xlockmore. This includes the xlock shipped with a numb...
Linux/SuperH - sh4 - setuid(0) ; execve("/bin/sh", NULL, NULL) - 27 bytes
No description provided by source. / Linux/SuperH - sh4 - setuid0 ; execve/bin/sh, NULL, NULL - 27 bytes Tested on debian-sh4 2.6.32-5-sh7751r by Jonathan Salwan - twitter: @jonathansalwan 400054: 17 e3 mov 23,r3 400056: 4a 24 xor r4,r4 400058: 0b c3 trapa 11 40005a: 3a 23 xor r3,r3 40005c: 0b e3...