Slackware Linux /usr/bin/ppp-off Insecure /tmp Call Exploit

Exploit for linux platform in category dos / poc =========================================================== Slackware Linux /usr/bin/ppp-off Insecure /tmp Call Exploit =========================================================== !/bin/sh In SlackWare Linux the script /usr/bin/ppp-off writes the...

Slackware Linux - usrbinppp-off Insecure tmp Call

Slackware Linux - usrbinppp-off Insecure tmp Call !/bin/sh In SlackWare Linux the script /usr/bin/ppp-off writes the output of 'ps x' to /tmp/grep.tmp. Since root is the user that runs ppp-off, a non-privileged user could create a link from /tmp/grep.tmp to any fileie: /etc/issue, thus when root...

Slackware Linux - '/usr/bin/ppp-off' Insecure /tmp Call

!/bin/sh In SlackWare Linux the script /usr/bin/ppp-off writes the output of 'ps x' to /tmp/grep.tmp. Since root is the user that runs ppp-off, a non-privileged user could create a link from /tmp/grep.tmp to any fileie: /etc/issue, thus when root runs the ppp-off script, the output of 'ps x' woul...

buffer overflow vulnerability in Pine

Pine versions 4.21 and before contain a buffer overflow vulnerability which allows a remote user to execute arbitrary code on the local client by the sending of a special-crafted email message. The overflow occurs during the periodic "new mail" checking of an open folder. By upgrading to Pine 4.3...

ppp-off.txt

Hi, In SlackWare Linux the script /usr/bin/ppp-off writes the output of 'ps x' to /tmp/grep.tmp Since root is the user that runs ppp-off, a non-privileged user could create a link from /tmp/grep.tmp to any file ie: /etc/issue, thus when root runs the ppp-off script, the output of 'ps x' would be...

: xchat input validation bug fixed

An input validation bug was found to affect Slackware Linux 7.0, 7.1, and -current. The problem is described in detail at this site: http://www.securityfocus.com/bid/1601 Users of Slackware 7.0, 7.1, and -current are urged to upgraded to the xchat.tgz package available in the Slackware -current...

BSD 'mailx' 8.1.1-10 - Local Buffer Overflow (1)

// source: https://www.securityfocus.com/bid/1305/info Some Linux distributions ship with BSD mailx 8.1.1-10 On Slackware 7.x it can be found as /usr/bin/Mail. A vulnerability exists in the 'mail' program, part of the Berkeley mailx package. The 'mail' program contains a buffer overflow condition...

BSD mailx 8.1.1-10 - Local Buffer Overflow (1)

BSD mailx 8.1.1-10 - Local Buffer Overflow 1 // source: https://www.securityfocus.com/bid/1305/info Some Linux distributions ship with BSD mailx 8.1.1-10 On Slackware 7.x it can be found as /usr/bin/Mail. A vulnerability exists in the 'mail' program, part of the Berkeley mailx package. The 'mail'...

slackdb.txt

Date: Thu, 16 Jul 1998 09:22:40 +0200 From: Martin Bene Subject: Berkley DB problem in slackware distribution Hi! I recently ran into a potential problem with berkley db 1.85 as distributed with all versions of slackware linux: fixed in slackware 3.5 as of 07.14.98 libdb.so.1.85.4 defines snprint...

SuSE Linux 6.2 Slackware Linux 3.23.6 - identd Denial of Service

SuSE Linux 6.2 Slackware Linux 3.23.6 - identd Denial of Service // source: https://www.securityfocus.com/bid/587/info In the inetd.conf under certain distributions of SuSE Linux the in.identd daemon is started with the -w -t120 option. This means that one identd process waits 120 seconds after...

SuSE Linux 6.2 / Slackware Linux 3.2/3.6 - 'identd' Denial of Service

// source: https://www.securityfocus.com/bid/587/info In the inetd.conf under certain distributions of SuSE Linux the in.identd daemon is started with the -w -t120 option. This means that one identd process waits 120 seconds after answering the first request to answer the next request. If a...

RedHat Linux 5.05.15.2 Slackware Linux 3.5 - klogd Local Buffer Overflow (2)

RedHat Linux 5.05.15.2 Slackware Linux 3.5 - klogd Local Buffer Overflow 2 // source: https://www.securityfocus.com/bid/398/info It is possible to cause a denial of service remote and local through generating old, obscure kernel messages not terminated with \n in klogd. The problem exists because...

RedHat Linux 5.0/5.1/5.2 / Slackware Linux 3.5 - 'klogd' Local Buffer Overflow (1)

// source: https://www.securityfocus.com/bid/398/info It is possible to cause a denial of service remote and local through generating old, obscure kernel messages not terminated with \n in klogd. The problem exists because of a buffer overflow in the klogd handling of kernel messages. It is...

RedHat Linux 5.0/5.1/5.2 / Slackware Linux 3.5 - 'klogd' Local Buffer Overflow (2)

// source: https://www.securityfocus.com/bid/398/info It is possible to cause a denial of service remote and local through generating old, obscure kernel messages not terminated with \n in klogd. The problem exists because of a buffer overflow in the klogd handling of kernel messages. It is...

RedHat Linux 5.05.15.2 Slackware Linux 3.5 - klogd Local Buffer Overflow (1)

RedHat Linux 5.05.15.2 Slackware Linux 3.5 - klogd Local Buffer Overflow 1 // source: https://www.securityfocus.com/bid/398/info It is possible to cause a denial of service remote and local through generating old, obscure kernel messages not terminated with \n in klogd. The problem exists because...

CVE-1999-1434

login in Slackware Linux 3.2 through 3.5 does not properly check for an error when the /etc/group file is missing, which prevents it from dropping privileges, causing it to assign root privileges to any local user who logs on to the server...

Slackware Linux 3.5 - etcgroup Local Privilege Escalation

Slackware Linux 3.5 - etcgroup Local Privilege Escalation source: https://www.securityfocus.com/bid/155/info Due to the way /bin/login behaves when a /etc/group file is not present under Slackware's version of the password shadowing suite, users who log in while this file is not present will be...

Slackware Linux 3.5 - '/etc/group' Local Privilege Escalation

source: https://www.securityfocus.com/bid/155/info Due to the way /bin/login behaves when a /etc/group file is not present under Slackware's version of the password shadowing suite, users who log in while this file is not present will be given uid and gid 0. This will allow them unrestricted acce...

CVE-1999-1498

Slackware Linux 3.4 pkgtool allows local attacker to read and write to arbitrary files via a symlink attack on the reply file...

Slackware Linux 3.4 - 'makebootdisk' Temporary File

source: https://www.securityfocus.com/bid/78/info makebootdisk creates the file /tmp/return insecurely and follows symbolic links. An attacker can create a symbolic link from /tmp/return to any file and wait for root to run the program. This will clober the target file. The file created has...