New Solaris root exploit for /usr/lib/lp/bin/netpr

Word on the street is that others have noticed this hole, so here goes. Have you noticed how many holes have been discovered in the printing system on Solaris? The netpr program is no exception. Included with this message are two exploits I wrote in 1999, one for SPARC versions of Solaris and the...

getpop3.txt

what?: =-getpop3 exploit-= who?: - by r3p3nt of the DHC - where?: - http://dhc1.cjb.net - contact?: - [email protected] greets: all of DHC, duke, f0rpaxe, artech, and eli up for some raceball? thanks: jwb [email protected] You are wondering "hmm..what is getpop3, mister r3p3nt". Well,...

Turbolinux 3.5 b2 - canuum Local Buffer Overflow

Turbolinux 3.5 b2 - canuum Local Buffer Overflow // source: https://www.securityfocus.com/bid/758/info Canna is a Japanese input system available as free software. Canna provides a unified user interface for inputting Japanese. Canna supports NemacsMule, kinput2 and canuum. All of these tools can...

IRIX 6.5 Solaris 7.0 Turbolinux 4.2 - uum Local Buffer Overflow

IRIX 6.5 Solaris 7.0 Turbolinux 4.2 - uum Local Buffer Overflow // source: https://www.securityfocus.com/bid/757/info Canna is a Japanese input system available as free software. Canna provides a unified user interface for inputting Japanese. Canna supports NemacsMule, kinput2 and canuum. All of...

IRIX 6.5 / Solaris 7.0 / Turbolinux 4.2 - 'uum' Local Buffer Overflow

// source: https://www.securityfocus.com/bid/757/info Canna is a Japanese input system available as free software. Canna provides a unified user interface for inputting Japanese. Canna supports NemacsMule, kinput2 and canuum. All of these tools can be used by a single customization file,...

SCO Unixware 2.17.07.0.17.17.1.1 - su(1) Buffer Overflow

SCO Unixware 2.17.07.0.17.17.1.1 - su1 Buffer Overflow // source: https://www.securityfocus.com/bid/826/info Certain versions of Unixware ship with a version of su1 which is vulnerable to a buffer overflow attack. This attack is possible because su1 fails to sanity check user supplied data, in th...

libtermcap_exploit.txt

Subject: local libtermcap exploit To: [email protected] Well, I wrote this a little while back. This is a serious bug, so people should be able to test their systems properly. All admins should definitely upgrade to the newest libtermcap. - sk8 of LS / Local exploit for suid root programs...

LPRng.txt

Subject: Security problem with LPRng To: [email protected] Hi all, During some recent work I've been doing with LPRng, I found that is is possible on a default LPRng installation to control the print queues on the LPRng server. Most default installations allow the root user at the localhost to...

rxvt.sh

There is a major security hole in rxvt, a terminal emulator for X, when it is run on systems suid root, as is required on many configurations in order to write to the utmp file. It is obvious from the code that this program was not written to be run suid root, its a pity that sysadmins that insta...

poc.mail.local.txt

Proof of Concept - Security Advisory 02/15/99 http://poc.csoft.net Released by [email protected] [email protected] --- Affected Program mail.local Berkeley Sendmail Description Local mailer forward mail to mailboxes Severity Mailbox compromise Synopsis: mail.local is a small program distributed wit...

ClearCase.txt

L0pht Security Advisory Advisory released Jan 8 1999 Application: Rational Software's Clear Case v3.2 Severity: any local user can become root Author: [email protected] http://www.L0pht.com/advisories.html --- Overview : --- ClearCase is a configuration management program from Rational Software...

IBM AIX 4.2.1 / Sun Solaris 7.0 - LC_MESSAGES libc Buffer Overflow (1)

source: https://www.securityfocus.com/bid/268/info A buffer overflow in libc's handling of the LCMESSAGES environment variable allows a malicious user to exploit any suid root program linked agains libc to obtain root privileges. This problem is found in both IBM's AIX and Sun Microsystem's...

IBM AIX 4.2.1 / Sun Solaris 7.0 - LC_MESSAGES libc Buffer Overflow (4)

// source: https://www.securityfocus.com/bid/268/info A buffer overflow in libc's handling of the LCMESSAGES environment variable allows a malicious user to exploit any suid root program linked agains libc to obtain root privileges. This problem is found in both IBM's AIX and Sun Microsystem's...

Oracle 8 - oratclsh Suid

Oracle 8 - oratclsh Suid source: https://www.securityfocus.com/bid/159/info Oracle8 is an enterprise level database. As part of the Internet Agent option installation process it installs the file $ORACLEHOME/bin/oratclsh as suid root. oratclsh is a TCL application that provides full access to TCL...

Oracle 8 - oratclsh Suid

source: https://www.securityfocus.com/bid/159/info Oracle8 is an enterprise level database. As part of the Internet Agent option installation process it installs the file $ORACLEHOME/bin/oratclsh as suid root. oratclsh is a TCL application that provides full access to TCL. oratclsh gives anyone t...

Solaris 7.0 - cancel Local Privilege Escalation

Solaris 7.0 - cancel Local Privilege Escalation / source: https://www.securityfocus.com/bid/293/info A buffer overrun condition was discovered in Solaris 2.6 X86 in /usr/bin/cancel. This buffer overflow is apparently present in the SPARC version as well although it is thought to be unexploitable...

Solaris 7.0 - 'cancel' Local Privilege Escalation

/ source: https://www.securityfocus.com/bid/293/info A buffer overrun condition was discovered in Solaris 2.6 X86 in /usr/bin/cancel. This buffer overflow is apparently present in the SPARC version as well although it is thought to be unexploitable. Previous versions of Solaris did not ship with...

S.u.S.E Linux 5.2 - 'gnuplot' Local Overflow / Local Privilege Escalation

/ source: https://www.securityfocus.com/bid/319/info Linux gnuplot 3.5 is shipped with S.u.S.E. Linux 5.2 and installed suid root by default. There is a buffer overflow vulnerability present in gnuplot which allows for users to obtain root access locally. / / gnuplot Linux x86 exploit from xnec...

Debian suidmanager 0.18 - Command Execution

Debian suidmanager 0.18 - Command Execution source: https://www.securityfocus.com/bid/94/info /usr/bin/suidexec will execute arbitrary commands as root, as soon as just one suid root shell script can be found on the system: Just invoke /usr/bin/suidexec /path/to/script - it will happily execute...

Linux libc 5.3.125.4 (RedHat Linux 4.0) - vsyslog() Local Buffer Overflow

Linux libc 5.3.125.4 RedHat Linux 4.0 - vsyslog Local Buffer Overflow // source: https://www.securityfocus.com/bid/475/info A buffer overflow is present in linux libc 5.4.32 and below that allows a user to obtain local root access under some conditions. The overflow is in the function vsyslog and...