Дырки в pkg-утилитах SCO

Можно получить доступ к содержимому /etc/shadow...

CVE-2001-0195

The CVE-2001-0195 issue affects sash

CVE-2001-0120

useradd program in shadow-utils program may allow local users to overwrite arbitrary files via a symlink attack...

CVE-2001-0120

CVE-2001-0120 relates to the shadow-utils package, specifically the useradd component. The vulnerability arises from insecure temporary file handling: useradd creates temporary files in /etc/default with predictable names. If /etc/default is world-writable, an attacker could perform a symbolic-li...

Solaris snmpXdmid Long Indication Event Overflow (ELVISCICADA)

The remote RPC service 100249 snmpXdmid is vulnerable to a heap overflow which allows any user to obtain a root shell on this host. ELVISCICADA is one of multiple Equation Group vulnerabilities and exploits disclosed on 2017/04/08 by a group known as the Shadow Brokers. This script is released...

Solaris 2.6 - FTP Core Dump Shadow Password Recovery

Solaris 2.6 - FTP Core Dump Shadow Password Recovery source: https://www.securityfocus.com/bid/2601/info Solaris is the variant of the UNIX Operating System distributed by Sun Microsystems. Solaris is designed as a scalable operating system for the Intel x86 and Sun Sparc platforms, and operates ...

Solaris 2.6 - FTP Core Dump Shadow Password Recovery

source: https://www.securityfocus.com/bid/2601/info Solaris is the variant of the UNIX Operating System distributed by Sun Microsystems. Solaris is designed as a scalable operating system for the Intel x86 and Sun Sparc platforms, and operates on machines varying from desktop to enterprise server...

PT-2001-1424 · Sash · Sash

Name of the Vulnerable Software and Affected Versions: sash versions prior to 3.4-4 Description: The issue is related to the improper cloning of /etc/shadow, making it world-readable. This could allow local users to gain privileges via password cracking. Recommendations: For versions prior to...

glibc-resolve-tr.sh

Charles Stevenson glibc-2.2 and openssh-2.3.0p1 Debian 2.3 , Redhat 7.0 This exploits is for glibc = 2.1.9x. [email protected] Edit this if you have a problem with path ssh=/usr/bin/ssh traceroute=/usr/sbin/traceroute FILE=/etc/shadow File to read echo "$ssh" echo " Checking permisions..." if...

glibc-2.2 / openssh-2.3.0p1 / glibc 2.1.9x - File Read

Charles Stevenson glibc-2.2 and openssh-2.3.0p1 Debian 2.3 , Redhat 7.0 This exploits is for glibc = 2.1.9x. [email protected] Edit this if you have a problem with path ssh=/usr/bin/ssh traceroute=/usr/sbin/traceroute FILE=/etc/shadow File to read echo "$ssh" echo " Checking permisions..." if...

Дырка в sash в Debian

При копировании /etc/shadow создаются файлы открытые на чтение...

[SECURITY] [DSA-015-1] New version of sash released

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ---------------------------------------------------------------------------- Debian Security Advisory DSA-015-1 [email protected] http://www.debian.org/security/ Martin Schulze January 23, 2001 -...

CVE-2000-0513

CUPS Common Unix Printing System 1.04 and earlier allows remote attackers to cause a denial of service by authenticating with a user name that does not exist or does not have a shadow password...

[SECURITY] New version of xlockmore/xlockmore-gl released

Package: xlockmore, xlockmore-gl Vulnerability type: local exploit Debian-specific: no There is a format string bug in all versions of xlockmore/xlockmore-gl. Debian 2.1 slink installs xlock setgid by default, and this exploit can be used to gain read access to the shadow file. We recommend...

[SECURITY] New version of xlockmore/xlockmore-gl released

------------------------------------------------------------------------ Debian Security Advisory [email protected] http://www.debian.org/security/ Michael Stone August 16, 2000 - ------------------------------------------------------------------------ Package: xlockmore, xlockmore-gl...

Shadow Op Software Dragon Server 1.0/2.0 - Multiple Denial of Service Vulnerabilities

source: https://www.securityfocus.com/bid/1352/info Two denial of service vulnerabilities exist in the Dragon Server package, versions 1.00 and 2.00, from Shadow Ops Software. By supplying large arguments to two different network services, it is possible to cause these services to be innaccessibl...

Security Advisory 2000-003

-----BEGIN PGP SIGNED MESSAGE----- NetBSD Security Advisory 2000-003 ================================= Topic: Exploitable Vulnerability in Xlockmore Version: NetBSD pkgsrc prior to 11th May 2000. Severity: xlock can be manipulated to print the shadow password information Abstract ======== The...

[COVERT-2000-06] Initialized Data Overflow in Xlock

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Network Associates, Inc. COVERT Labs Security Advisory May 29, 2000 Initialized Data Overflow in Xlock COVERT-2000-06 o Synopsis An implementation vulnerability in xlock allows global variables in the initialized data section of memory to be...

fingerd

I am new on the list so i dont know if you knew that. On Irix 6.4 with all patches installed the fingerd seems to like to display the shadow file to all users. ln -s /etc/shadow /path/user/.plan finger [email protected] This feature was found by a student -Zanikolas Serafim- while he was...

CVE-1999-0712

CVE-1999-0712 affects Caldera Open Administration System (COAS). The vulnerability allows the /etc/shadow password file to be made world-readable, indicating a confidentiality impact. Exploitation details are not provided in the connected documents; sources (Red Hat, CVE entries, and PT Security)...