Локальная дырка в xitetris

Недостаточная проверка ввода пользователя при вызове внешнего приложения в suid root приложении...

Переполнение буфера в DoubleVision

Классическое переполнение буфера при указании типа терминала в dvtermtype suid root...

Screen 3.9.5 vulnerability again.

Hi all as mentioned in previous postings, screen versions = 3.9.5 which are installed suid root are vulnerable to a malformed user supplied vbellmsg string attack. I looked at the source of screen-3.9.5 and found that the vulnerable call to Msg moved to another place and that there is no longer a...

LPPlus 3.2.23.3 - dccscan Unprivileged read

LPPlus 3.2.23.3 - dccscan Unprivileged read source: https://www.securityfocus.com/bid/1644/info $LPHOME/bin/dccscan is suid-root and can be executed by any user. It is possible for an unprivileged user to print files to which he does not have read access. In testing, this works even for printers ...

fdmount buffer overflow

I searched the archives and did not find this one. Program : fdmount Version : 0.8 OS : linux Slackware 7.0 maybe others This program is normally only executable by members of group 'floppy' and installed suid-root by default. Bug Details: void msgchar text,... char buff80; valist p; vastartp,tex...

Очередной локальный root в Solaris

Переполнение буфера в suid root /usr/lib/lp/bin/netpr...

New Solaris root exploit for /usr/lib/lp/bin/netpr

Word on the street is that others have noticed this hole, so here goes. Have you noticed how many holes have been discovered in the printing system on Solaris? The netpr program is no exception. Included with this message are two exploits I wrote in 1999, one for SPARC versions of Solaris and the...

getpop3.txt

what?: =-getpop3 exploit-= who?: - by r3p3nt of the DHC - where?: - http://dhc1.cjb.net - contact?: - [email protected] greets: all of DHC, duke, f0rpaxe, artech, and eli up for some raceball? thanks: jwb [email protected] You are wondering "hmm..what is getpop3, mister r3p3nt". Well,...

Turbolinux 3.5 b2 - canuum Local Buffer Overflow

Turbolinux 3.5 b2 - canuum Local Buffer Overflow // source: https://www.securityfocus.com/bid/758/info Canna is a Japanese input system available as free software. Canna provides a unified user interface for inputting Japanese. Canna supports NemacsMule, kinput2 and canuum. All of these tools can...

IRIX 6.5 Solaris 7.0 Turbolinux 4.2 - uum Local Buffer Overflow

IRIX 6.5 Solaris 7.0 Turbolinux 4.2 - uum Local Buffer Overflow // source: https://www.securityfocus.com/bid/757/info Canna is a Japanese input system available as free software. Canna provides a unified user interface for inputting Japanese. Canna supports NemacsMule, kinput2 and canuum. All of...

IRIX 6.5 / Solaris 7.0 / Turbolinux 4.2 - 'uum' Local Buffer Overflow

// source: https://www.securityfocus.com/bid/757/info Canna is a Japanese input system available as free software. Canna provides a unified user interface for inputting Japanese. Canna supports NemacsMule, kinput2 and canuum. All of these tools can be used by a single customization file,...

SCO Unixware 2.17.07.0.17.17.1.1 - su(1) Buffer Overflow

SCO Unixware 2.17.07.0.17.17.1.1 - su1 Buffer Overflow // source: https://www.securityfocus.com/bid/826/info Certain versions of Unixware ship with a version of su1 which is vulnerable to a buffer overflow attack. This attack is possible because su1 fails to sanity check user supplied data, in th...

libtermcap_exploit.txt

Subject: local libtermcap exploit To: [email protected] Well, I wrote this a little while back. This is a serious bug, so people should be able to test their systems properly. All admins should definitely upgrade to the newest libtermcap. - sk8 of LS / Local exploit for suid root programs...

LPRng.txt

Subject: Security problem with LPRng To: [email protected] Hi all, During some recent work I've been doing with LPRng, I found that is is possible on a default LPRng installation to control the print queues on the LPRng server. Most default installations allow the root user at the localhost to...

ClearCase.txt

L0pht Security Advisory Advisory released Jan 8 1999 Application: Rational Software's Clear Case v3.2 Severity: any local user can become root Author: [email protected] http://www.L0pht.com/advisories.html --- Overview : --- ClearCase is a configuration management program from Rational Software...

poc.mail.local.txt

Proof of Concept - Security Advisory 02/15/99 http://poc.csoft.net Released by [email protected] [email protected] --- Affected Program mail.local Berkeley Sendmail Description Local mailer forward mail to mailboxes Severity Mailbox compromise Synopsis: mail.local is a small program distributed wit...

rxvt.sh

There is a major security hole in rxvt, a terminal emulator for X, when it is run on systems suid root, as is required on many configurations in order to write to the utmp file. It is obvious from the code that this program was not written to be run suid root, its a pity that sysadmins that insta...

IBM AIX 4.2.1 / Sun Solaris 7.0 - LC_MESSAGES libc Buffer Overflow (4)

// source: https://www.securityfocus.com/bid/268/info A buffer overflow in libc's handling of the LCMESSAGES environment variable allows a malicious user to exploit any suid root program linked agains libc to obtain root privileges. This problem is found in both IBM's AIX and Sun Microsystem's...

IBM AIX 4.2.1 / Sun Solaris 7.0 - LC_MESSAGES libc Buffer Overflow (1)

source: https://www.securityfocus.com/bid/268/info A buffer overflow in libc's handling of the LCMESSAGES environment variable allows a malicious user to exploit any suid root program linked agains libc to obtain root privileges. This problem is found in both IBM's AIX and Sun Microsystem's...

Oracle 8 - oratclsh Suid

Oracle 8 - oratclsh Suid source: https://www.securityfocus.com/bid/159/info Oracle8 is an enterprise level database. As part of the Internet Agent option installation process it installs the file $ORACLEHOME/bin/oratclsh as suid root. oratclsh is a TCL application that provides full access to TCL...