Слабые разрешения в Slackware (shells weak permissions)

/etc/shells открыт на запись...

buffer overflow fix for NTP

The version of xntp3 that shipped with Slackware 7.1 as well as the version that was in Slackware -current contains a buffer overflow bug that could lead to a root compromise. Slackware 7.1 and Slackware -current users are urged to upgrade to the new packages available for their release. The...

Slackware 7.1 /usr/bin/mail Local Exploit

Exploit for linux platform in category local exploits ========================================= Slackware 7.1 /usr/bin/mail Local Exploit ========================================= / Slackware 7.1 /usr/bin/Mail Exploit give gid=1 bin if /usr/bin/Mail is setgid but it is not setgid, setuid for...

Slackware 7.1 - '/usr/bin/mail' Local Privilege Escalation

/ Slackware 7.1 /usr/bin/Mail Exploit give gid=1 bin if /usr/bin/Mail is setgid but it is not setgid, setuid for default. tested on my box sl 7.1 crazy exploited by kengz. GID.... \x01 = 1 bin \x02 = 2 , \x03 = 3 , ... \x0a = 10 \x0b = 11 .... / include include define GID "\x03" int mainint argc,...

Slackware 7.1 - usrbinmail Local Privilege Escalation

Slackware 7.1 - usrbinmail Local Privilege Escalation / Slackware 7.1 /usr/bin/Mail Exploit give gid=1 bin if /usr/bin/Mail is setgid but it is not setgid, setuid for default. tested on my box sl 7.1 crazy exploited by kengz. GID.... \x01 = 1 bin \x02 = 2 , \x03 = 3 , ... \x0a = 10 \x0b = 11 .......

buffer overflow in sudo fixed

Sudo 1.6.3p6 is now available for Slackware 7.1 and Slackware -current. This release fixes a known buffer overflow, which could be used by malicious users to compromise parts of the system. If you rely on Sudo and use one of the above versions of Slackware, it is recommended that you upgrade to t...

multiple vulnerabilities in bind 8.x

Multiple vulnerabilities exist in the versions of BIND found in Slackware 7.1 and -current. Users of BIND 8.x are urged to upgrade to 8.2.3 to fix these problems. More information can be found on the BIND website: http://www.isc.org/products/BIND/ ... and in the CERT Advisory CA-2001-02 - Multipl...

mICQ 0.4.6 - Remote Buffer Overflow

mICQ 0.4.6 - Remote Buffer Overflow // source: https://www.securityfocus.com/bid/2254/info micq is a chat program for Linux systems. micq-0.4.6 running on Linux/ix86 Slackware 7.1 - RedHat 6.1 is vulnerable to a remote buffer overflow attack. Other versions on other platforms may also be...

Buffer Overflow still exists in Netscape <= 4.76

Hello. I have noticed that the buffer overflow discovered by Michal Zalewski and covered extensively by the different unix distributions is still present in netscape 4.76 even though they claim it is not. Refer to these links for background information:...

glibc 2.2 local vulnerability on setuid binaries

glibc-2.2 contains a local vulnerability that affects all setuid root binaries. Any user on affected systems will be able to read any file on the system through a simple process: The user sets the RESOLVHOSTCONF environment variable to the name of the file that they wish to read, then runs any...

hhp-expect_adv0017.txt

------------------------------------------------------------------------------- hhp adv-17 Sec-Advisory/Exploit/Patch www.hhp-programming.net ------------------------------------------------------------------------------- Topic: Expect. Versions: 5.31.8 and 5.28.1, maybe others. Date: 12/12/2000...

expect (usrbinexpect) - Local Buffer Overflow

expect usrbinexpect - Local Buffer Overflow / hhp-expectsmash.c 12/11/00 expect /usr/bin/expect buffer overflow. Tested 5.31.8 and 5.28.1, slackware 7.x Maybe others. By: isox Site: www.hhp-programming.net Advisory: www.hhp-programming.net/ouradvisories/hhp-expectadv%2317.txt / include include...

expect (/usr/bin/expect) - Local Buffer Overflow

/ hhp-expectsmash.c 12/11/00 expect /usr/bin/expect buffer overflow. Tested 5.31.8 and 5.28.1, slackware 7.x Maybe others. By: isox Site: www.hhp-programming.net Advisory: www.hhp-programming.net/ouradvisories/hhp-expectadv%2317.txt / include include define NOP 0x90 define OFFSET 0 define BUFLEN...

expect (/usr/bin/expect) buffer overflow

Exploit for linux platform in category local exploits ======================================== expect /usr/bin/expect buffer overflow ======================================== / hhp-expectsmash.c 12/11/00 expect /usr/bin/expect buffer overflow. Tested 5.31.8 and 5.28.1, slackware 7.x Maybe others...

GLIBC locale - bug mount

/ mount exploit for glibc locale bug tested on redhat 6.2 and slackware 7.0 and debian 2.2 Debian 2.2 mount-2.10f : ./mnt -n 136 -a 0x080589a0 -i 192 Redhat 6.2 mount-2.10f : ./mnt -n 114 -a 0x080565dc -i 112 compiled on rh 6.2 mount-2.10m: ./mnt -n 114 -a 0x08059218 -i 112 "objdump /bin/mount |...

GLIBC locale - bug mount

GLIBC locale - bug mount / mount exploit for glibc locale bug tested on redhat 6.2 and slackware 7.0 and debian 2.2 Debian 2.2 mount-2.10f : ./mnt -n 136 -a 0x080589a0 -i 192 Redhat 6.2 mount-2.10f : ./mnt -n 114 -a 0x080565dc -i 112 compiled on rh 6.2 mount-2.10m: ./mnt -n 114 -a 0x08059218 -i 1...

mount exploit for glibc locale bug

Exploit for linux platform in category local exploits ================================== mount exploit for glibc locale bug ================================== / mount exploit for glibc locale bug tested on redhat 6.2 and slackware 7.0 and debian 2.2 Debian 2.2 mount-2.10f : ./mnt -n 136 -a...

Slackware Linux /usr/bin/ppp-off Insecure /tmp Call Exploit

Exploit for linux platform in category dos / poc =========================================================== Slackware Linux /usr/bin/ppp-off Insecure /tmp Call Exploit =========================================================== !/bin/sh In SlackWare Linux the script /usr/bin/ppp-off writes the...

Slackware Linux - usrbinppp-off Insecure tmp Call

Slackware Linux - usrbinppp-off Insecure tmp Call !/bin/sh In SlackWare Linux the script /usr/bin/ppp-off writes the output of 'ps x' to /tmp/grep.tmp. Since root is the user that runs ppp-off, a non-privileged user could create a link from /tmp/grep.tmp to any fileie: /etc/issue, thus when root...

Slackware Linux - '/usr/bin/ppp-off' Insecure /tmp Call

!/bin/sh In SlackWare Linux the script /usr/bin/ppp-off writes the output of 'ps x' to /tmp/grep.tmp. Since root is the user that runs ppp-off, a non-privileged user could create a link from /tmp/grep.tmp to any fileie: /etc/issue, thus when root runs the ppp-off script, the output of 'ps x' woul...