UseLogin.txt

-- OpenSSH UseLogin bug proof of concept exploit -- by WaR / http://www.genhex.org -- Intro -- I was very curious in finding out how to exploit this problem. Although I don't think anyone uses this feature, I looked into the matter anyway. Here it goes. It was tested on the following platforms: -...

New bugs discovered!

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++GOBBLES+SECURITY+RESEARCH+TEAM+INCORPORATED++++++++++++++ ALERT! ALERT! MUCH NEW BUFFEROVERFLOW FOUND IN /BIN/GZIP! ALERT! ALERT! +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Researche...

CVE-1999-1498

Slackware Linux 3.4 pkgtool is affected by a local vulnerability where a symlink attack on the reply file allows reading and writing to arbitrary files. Root cause: symlink manipulation enabling unintended access. Impact per the description: partial confidentiality and partial integrity; availabi...

CVE-1999-1445

Vulnerability details available for CVE-1999-1445: affected software includes imapd and ipop3d running on Slackware 3.4 and 3.3 with shadowing enabled (and possibly other OSes). The issue allows remote attackers to trigger a core dump by sending a short sequence of USER and PASS commands that do ...

CVE-1999-1445

Vulnerability in imapd and ipop3d in Slackware 3.4 and 3.3 with shadowing enabled, and possibly other operating systems, allows remote attackers to cause a core dump via a short sequence of USER and PASS commands that do not provide valid usernames or passwords...

CVE-1999-1434

login in Slackware Linux 3.2 through 3.5 does not properly check for an error when the /etc/group file is missing, which prevents it from dropping privileges, causing it to assign root privileges to any local user who logs on to the server...

CVE-1999-1422

The CVE-1999-1422 entry concerns Slackware 3.4 (and possibly other versions) where the PATH environment variable may include the current directory (.) by default. This enables local users to create Trojan horse programs that could be inadvertently executed by other users, due to execution precede...

CVE-1999-1489

Vulnerability summary: CVE-1999-1489 describes a buffer overflow in the TestChip function of XFree86 SuperProbe used on Slackware Linux 3.1 . The overflow enables local users to obtain root privileges by supplying a long -nopr argument. Nature and impact (as documented): Local privilege escalatio...

CVE-1999-1422

The default configuration of Slackware 3.4, and possibly other versions, includes . dot, the current directory in the PATH environmental variable, which could allow local users to create Trojan horse programs that are inadvertently executed by other users...

CVE-1999-1498

Slackware Linux 3.4 pkgtool allows local attacker to read and write to arbitrary files via a symlink attack on the reply file...

CVE-1999-1434

Slackware Linux 3.2–3.5 is affected by CVE-1999-1434: the login process does not properly handle the error when /etc/group is missing, failing to drop privileges and potentially assigning root privileges to any local user who logs in. The connected documents confirm the affected OS versions and t...

CVE-1999-1489

Buffer overflow in TestChip function in XFree86 SuperProbe in Slackware Linux 3.1 allows local users to gain root privileges via a long -nopr argument...

CVE-1999-1186

CVE-1999-1186 concerns rxvt (terminal emulator) when compiled with the PRINT_PIPE option on certain Linux distros (e.g., Slackware 3.0, RedHat 2.1). The vulnerability arises from the -print-pipe parameter, which allows a local user to specify a malicious program, potentially gaining root privileg...

Slackware /usr/bin/man vulnerability

The following advisory was sent to slackware July 11th, 2001, they failed to respond so I hope the temporary patch will make do: Submitted by : Josh [email protected], lockdown [email protected] zen-parse [email protected] Vulnerability : /usr/bin/man Tested On : Slackware 8.0 and before...

slackware.init.txt

I posted this to the linux kernel mailing last Friday, July 13th 2001: Submitted by : Josh [email protected], lockdown [email protected] on July 16th, 2001 Vulnerability : /lib/modules/2.4.5/modules.dep Tested On : Slackware 8.0. 2.4.5 Local : Yes Remote : No Temporary Fix : umask 022 at...

Проблемы с man в Slackware (weak permissions)

Директории /var/man/cat открыты на запись, что позволяет создать файлы с именами содержащими sh-символы, которые будут выполнены при вызове команды man...

Slackware 7.0/7.1/8.0 - Manual Page Cache File Creation

// source: https://www.securityfocus.com/bid/3054/info Slackware Linux contains a configuration error that enables local users to create files in the directory used by the system manual pager 'man' for cache files. Due to the behaviour of the 'man' program, it may be possible for an attacker to...

Slackware 7.07.18.0 - Manual Page Cache File Creation

Slackware 7.07.18.0 - Manual Page Cache File Creation // source: https://www.securityfocus.com/bid/3054/info Slackware Linux contains a configuration error that enables local users to create files in the directory used by the system manual pager 'man' for cache files. Due to the behaviour of the...

2.4.x/Slackware Init script vulnerability

I posted this to the linux kernel mailing last Friday, July 13th 2001: Submitted by : Josh [email protected], lockdown [email protected] on July 16th, 2001 Vulnerability : /lib/modules/2.4.5/modules.dep Tested On : Slackware 8.0. 2.4.5 Local : Yes Remote : No Temporary Fix : umask 022 at...

[PkC] Advisory #005: Default Slackware 7.1 installation /etc/shells perms bug

/ pkc005.txt / -= SECURITY ADVISORY 005 =- | www.pkcrew.org / | / | | | | | / | | | | | / | | | | / | | / / | | | / | | | | | PkC | | | / | | | | | | || || || / Packet Knights Crew -= SECURITY ADVISORY 005 =- - Vulnerable program: Linux Slackware 7.1 default installation - Tested on: i386 from...