CVE-1999-1142

SunOS 4.1.2 and earlier allows local users to gain privileges via LD_* environment variables affecting dynamically linked setuid/setgid programs (e.g., login, su, sendmail) by causing real and effective UIDs to the same user. This yields a local escalation with complete confidentiality and integr...

CVE-1999-1318

CVE-1999-1318 affects SunOS 4.1.3 and earlier. The vulnerable component is /usr/5bin/su , which uses a search path that includes the current working directory (.). This allows local users to gain privileges via Trojan horse programs. The description clearly states a local privilege escalation and...

CVE-1999-1318: Undefined Security Weakness

/usr/5bin/su in SunOS 4.1.3 and earlier uses a search path that includes the current working directory ., which allows local users to gain privileges via Trojan horse programs...

CVE-1999-1193: Undefined Security Weakness

The "me" user in NeXT NeXTstep 2.1 and earlier has wheel group privileges, which could allow the me user to use the su command to become root...

CVE-2001-0762

Buffer overflow in su-wrapper 1.1.1 allows local users to execute arbitrary code via a long first argument...

CVE-2001-0762

CVE-2001-0762 describes a buffer overflow in su-wrapper 1.1.1 that allows local users to execute arbitrary code by providing a long first argument. The vulnerability is consistent with a local-exploit scenario and a potential impact on confidentiality, integrity, and availability as per the CVSS ...

CVE-2001-0762

Buffer overflow in su-wrapper 1.1.1 allows local users to execute arbitrary code via a long first argument...

CVE-2001-0762: Undefined Security Weakness

Buffer overflow in su-wrapper 1.1.1 allows local users to execute arbitrary code via a long first argument...

Caldera OpenUnix8 Overflows (reject, lpsystem, su)

I contacted Caldera SCO about some local overflows in a few binaries that came default with my install of OpenUnix8... Here is a snippet of the email dialog between us. Due to the lack of access to the machine and lack of a good debugger on the system, I have not had time to put any further...

Переполнение буфера в su-wrapper (buffer overflow)

Переполнение буфера в агрументе командной строки...

su-wrapper 1.1.1 Local root exploit.

/ - su-wrapper.c - / // / /usr/sbin/su-wrappersu-wrapper 1.1.1 local root exploit. / / / / Package Description: / / su-wrapper is an little util which lets special users execute / / processes under another uid/gid. / / / / Vulnerability Description: / / If a long line on the first argument is...

CVE-2000-0996

Format string vulnerability in OpenBSD su program and possibly other BSD-based operating systems allows local attackers to gain root privileges via a malformed shell...

CVE-2000-0996: Undefined Security Weakness

Format string vulnerability in OpenBSD su program and possibly other BSD-based operating systems allows local attackers to gain root privileges via a malformed shell...

GLIBC - '/bin/su' Local Privilege Escalation

/ Working exploit for glibc executing /bin/su To exploit this i have used a technique that overwrites the .dtors section of /bin/su program with the address of the shellcode, so, the program executes it when main returns or exit is called Thanks a lot to rwxrwxrwx for explaining me this technique...

Re: OpenBSD Security Advisory

Hi, Here is another exploit for an application fstat that OpenBSD's format string audit has seemingly forgotten about. What I would like to know is why this and a number of other privileged applications have security vulnerabilities in them. They WERE fixed, but NO ADVISORY nor ANY MENTION IN THE...

CVE-2000-0118

The CVE-2000-0118 entry concerns the Red Hat Linux su program: when the su process is killed before its timeout, failed password guesses aren’t logged, enabling local brute-force password guessing. The affected component is the su utility; the root cause is failure to log failed attempts due to p...

CVE-2000-0118

The Red Hat Linux su program does not log failed password guesses if the su process is killed before it times out, which allows local attackers to conduct brute force password guessing...

CVE-2000-0118: Undefined Security Weakness

The Red Hat Linux su program does not log failed password guesses if the su process is killed before it times out, which allows local attackers to conduct brute force password guessing...

CVE-1999-0845

Buffer overflow in SCO su program allows local users to gain root access via a long username...

CVE-1999-0845

The CVE-1999-0845 entry describes a buffer overflow in the SCO ‘su’ program that allows a local user to gain root privileges by supplying a long username. The vulnerable component is the su utility on SCO Unix-like systems; impact is local privilege escalation to root . Connected documents corrob...