CVE-1999-1182

Buffer overflow in run-time linkers 1 ld.so or 2 ld-linux.so for Linux systems allows local users to gain privileges by calling a setuid program with a long program name argv0 and forcing ld.so/ld-linux.so to report an error...

CVE-1999-1182

This CVE (CVE-1999-1182) affects Linux runtime linkers ld.so and ld-linux.so. A buffer overflow occurs when a long argv[0] triggers an error report by ld.so/ld-linux.so, allowing local users to gain privileges when invoking a setuid program. The attack is local with low complexity; impact is to c...

CVE-1999-1123

CVE-1999-1123 affects Sun Source tapes (sunsrc). Local users can gain root privileges through setuid root programs (makeinstall, winstall). The root cause is not explicitly detailed in the provided documents, but the vulnerability enables local privilege escalation with complete confidentiality, ...

IBM AIX lsfs utility invokes grep and lslv with relative pathnames

Overview The IBM AIX operating system contains a vulnerability in the lsfs utility that allows a local user to execute arbitrary code as root. Description The IBM AIX lsfs utility displays filesystem information such as mount points, permissions and volume sizes. To list this information, it...

[ Hackerslab bug_paper ] Informix-SQL application vulnerability

============================================================================== Hackerslab bugpaper Informix-SQL application vulnerability ============================================================================== File : Informix-SQL application SYSTEM : Systems running Informix INFO : There i...

Red Hat linux restore uses insecure environment variables allowing root compromise

Overview Some implementations of the Linux restoration utility, restore, call external programs on remote machines via the RSH environment variable. This may permit an attacker to compromise root if restore is setuid root. Description Some implementations of the Linux restoration utility, restore...

FreeBSD-SA-01:55.procfs

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:55 Security Advisory FreeBSD, Inc. Topic: procfs vulnerability leaks setugid process memory Category: core Module: procfs Announced: 2001-08-21 Credits: Joost Pol Affects...

Linux dump uses environment variables insecurely, allowing for root compromise

Overview Some implementations of the Linux backup utility, dump, call external programs on remote machines via the RSH environment variable. This may permit an attacker to compromise root if dump is setuid root. Description Some implementations of the Linux backup utility, dump, permit use of...

Solaris 2.678 (SPARC) - xlock Heap Overflow

Solaris 2.678 SPARC - xlock Heap Overflow // source: https://www.securityfocus.com/bid/3160/info Xlock is a utility for locking X-windows displays. It is installed setuid root because it uses the user's password to authorize access to the display when it is locked. The version of xlock that ships...

Solaris 8 - x86 xlock Heap Overflow

Solaris 8 - x86 xlock Heap Overflow // source: https://www.securityfocus.com/bid/3160/info Xlock is a utility for locking X-windows displays. It is installed setuid root because it uses the user's password to authorize access to the display when it is locked. The version of xlock that ships with...

FreeBSD-SA-01:41.hanterm

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:41 Security Advisory FreeBSD, Inc. Topic: hanterm ports allow local root compromise Category: ports Module: ko-hanterm, ko-hanterm-xf Announced: 2001-07-09 Credits:...

Lmail 2.7 - Temporary File Race Condition

// source: https://www.securityfocus.com/bid/2984/info Jon Zeeff's lmail is a local mail delivery agent LDA designed to provide mail-to-pipe and mail-to-file aliasing for smail. A race condition vulnerability exists in lmail. The lmail program makes insecure use of temporary files, making it...

Lmail 2.7 - Temporary File Race Condition

Lmail 2.7 - Temporary File Race Condition // source: https://www.securityfocus.com/bid/2984/info Jon Zeeff's lmail is a local mail delivery agent LDA designed to provide mail-to-pipe and mail-to-file aliasing for smail. A race condition vulnerability exists in lmail. The lmail program makes...

Xvt 2.1 - Local Buffer Overflow

Xvt 2.1 - Local Buffer Overflow // source: https://www.securityfocus.com/bid/2955/info Xvt is a terminal emulator for systems using X11R6. It is often installed setuid/setgid so that it runs with the enhanced privileges required to log user sessions. Xvt contains a buffer overflow in it's handlin...

Xvt 2.1 - Local Buffer Overflow

// source: https://www.securityfocus.com/bid/2955/info Xvt is a terminal emulator for systems using X11R6. It is often installed setuid/setgid so that it runs with the enhanced privileges required to log user sessions. Xvt contains a buffer overflow in it's handling of the '-name' argument. An...

reading from execve()ed setuid memory

Posted to bugzilla.redhat.com: Tue, 15 May 2001 06:43:27 -0400 This was then made unaccessable, and I've seen nothing that looks like a fix yet. A month and a half seems like long enough to work it out. Contents of https://bugzilla.redhat.com/bugzilla/showbug.cgi?id=40658 as posted before the pag...

CVE-2001-0459

Buffer overflows in ascdc Afterstep while running setuid allows local users to gain root privileges via a long 1 -d option, 2 -m option, or 3 -f option...

Linux Kernel 2.22.4 - procfs Stream redirection to Process Memory Privilege Escalation

Linux Kernel 2.22.4 - procfs Stream redirection to Process Memory Privilege Escalation / source: https://www.securityfocus.com/bid/2937/info The Linux /proc filesystem is a virtual filesystem provided by the Linux Kernel as an interface to some process and system information and parameters. Under...

Solaris 8 libsldap - Local Buffer Overflow (2)

Solaris 8 libsldap - Local Buffer Overflow 2 // source: https://www.securityfocus.com/bid/2931/info Solaris 8 ships with a shared library that implements LDAP functionality called 'libsldap'. This library is linked to by a number of system utilities, many of them installed setuid or setgid...

Solaris 8 libsldap buffer overflow

DESCRIPTION The library implementing LDAP naming services on Solaris 8, libsldap, contains a buffer overflow in the initialization code. While parsing the environment variable LDAPOPTIONS, a fixed size buffer is used to store its contents which can be of any length. This is a straightforward buff...