Переполнение буфера в wmcube-gdk (buffer overflow)

Переполнение буфера при разборе объектного файла в sgid kmem приложении...

oracle8.exploit.txt

---------- Forwarded message ---------- Date: Sat, 13 Nov 1999 15:01:08 -0600 From: [email protected] To: [email protected] Subject: BOUNCE [email protected]: Approval required: From [email protected] Sat Nov 13 15:01:06 1999 Received: from sword.damocles.com...

Переполнение буфера в CDE dt-утилитах - libdtsvc (buffer overflow)

Переполнения буфера в suid/sgid приложениях...

Переполнение буфера в xman (buffer overflow)

Переполнение буфера при разборе переменной MANPATH sgid man...

Символьные линки в man-db (symbolic link)

Проблема символьных линков в sgid man программе...

CVE-2001-0169

When using the LDPRELOAD environmental variable in SUID or SGID applications, glibc does not verify that preloaded libraries in /etc/ld.so.cache are also SUID/SGID, which could allow a local user to overwrite arbitrary files by loading a library from /lib or /usr/lib...

CVE-2001-0169

CVE-2001-0169 : The GNU C Library (glibc) fails to verify that libraries loaded via LD_PRELOAD into SUID/SGID processes are also non-SUID/non-SGID when they come from /etc/ld.so.cache, enabling a local user to pre-load a library from /lib or /usr/lib and overwrite privileged files. Documented in ...

Solaris 7.08 - IPCS Timezone Buffer Overflow

Solaris 7.08 - IPCS Timezone Buffer Overflow source: https://www.securityfocus.com/bid/2581/info Solaris is the variant of the UNIX Operating System distributed by Sun Microsystems. Solaris is designed as a scalable operating system for the Intel x86 and Sun Sparc platforms, and operates on...

CVE-2001-0169

When using the LDPRELOAD environmental variable in SUID or SGID applications, glibc does not verify that preloaded libraries in /etc/ld.so.cache are also SUID/SGID, which could allow a local user to overwrite arbitrary files by loading a library from /lib or /usr/lib...

GnomeHack Local Buffer Overflow Exploit (gid=games)

Exploit for linux platform in category local exploits =================================================== GnomeHack Local Buffer Overflow Exploit gid=games =================================================== / gnomehack local buffer overflow. gid=games60 Author: Cody Tubbs loophole of hhp...

GnomeHack - Local Buffer Overflow

/ gnomehack local buffer overflow. gid=games60 Author: Cody Tubbs loophole of hhp. www.hhp-programming.net / [email protected] 12/17/2000 Tested on Debian 2.2, kernel 2.2.17 - x86. sgid "games"60 by default. bash-2.03$ id uid=1000loophole gid=501noc bash-2.03$ ./h 0 0 Ret-addr 0x7fffe81c, offset...

Пофиксены многочисленные локальные дырки в AIX

Многочисленный suid/sgid утилиты содержали переполнение буфера...

Проблема с ld.so из glibc

Переменная окружения LDPRELOAD используется для поиска динамических библиотек. При вызове suid/sgid программы эта переменная сбрасывается, но не сбрасывается, когда suid/sgid вызывает другое приложение, что позволяет подсунуть пользовательскую библиотеку...

Дырка в brouted

Переполнения буфера в sgid kmem утилите...

Stanley T. Shebs Xconq 7.2.2 - xconq Buffer Overflow

Stanley T. Shebs Xconq 7.2.2 - xconq Buffer Overflow / source: https://www.securityfocus.com/bid/1495/info Xconq is a multiple player strategy game available for many unix platforms. It contains a number of buffer overflow vulnerabilities including the ability to overflow stack buffers with eithe...

Переполнение буфера в mailx

Переполнение буфера в обработке параметра -c дает возможность получить привилегии группы mail в системах, где mail установлен с sgid...

Windowmaker wmmon 1.0 b2 - Command Execution

source: https://www.securityfocus.com/bid/885/info WMMon is a multiple platform Window Maker docking application. It monitors useful system information such as CPU load and disk activity. The application also allows the user to define commands that can be launched by mouse clicks in the WMMon...

SCO Unixware 7.0/7.0.1/7.1/7.1.1 - 'coredump' Symlink

source: https://www.securityfocus.com/bid/851/info Under certain versions of SCO UnixWare if a user can force a program with SGID Set Group ID to dump core they may launch a symlink attack by guessing the PID Process ID of the SGID process which they are calling. This is required because the...

SCO Unixware 7.07.0.17.17.1.1 - coredump Symlink

SCO Unixware 7.07.0.17.17.1.1 - coredump Symlink source: https://www.securityfocus.com/bid/851/info Under certain versions of SCO UnixWare if a user can force a program with SGID Set Group ID to dump core they may launch a symlink attack by guessing the PID Process ID of the SGID process which th...

unixware7.uidadmin.txt

Greetings, OVERVIEW SCO UnixWare 7.1's sgid-sys /usr/bin/uidadmin will allow any user to gain root privileges as a result of it's ability to write ANY file, not just those traditionally writable by gid-sys. BACKGROUND All of my testing was done on UnixWare 7.1, no other versions have been tested...