OS X Install.framework suid root Runner Binary Privilege Escalation Vulnerability

Exploit for macOS platform in category local exploits Source: https://code.google.com/p/google-security-research/issues/detail?id=478 The Install.framework runner suid root binary does not correctly account for the fact that Distributed Objects can be connected to by multiple clients at the same...

Apple Mac OSX Install.Framework - SUID Root Runner Binary Privilege Escalation

Apple Mac OSX Install.Framework - SUID Root Runner Binary Privilege Escalation Source: https://code.google.com/p/google-security-research/issues/detail?id=478 The Install.framework runner suid root binary does not correctly account for the fact that Distributed Objects can be connected to by...

Apple Mac OSX Install.Framework - Arbitrary mkdir unlink and chown to Admin Group

Apple Mac OSX Install.Framework - Arbitrary mkdir unlink and chown to Admin Group Source: https://code.google.com/p/google-security-research/issues/detail?id=477 Install.framework has a suid root binary here: /System/Library/PrivateFrameworks/Install.framework/Resources/runner This binary vends t...

Apple Mac OSX Install.Framework - SUID Root Runner Binary Privilege Escalation

Source: https://code.google.com/p/google-security-research/issues/detail?id=478 The Install.framework runner suid root binary does not correctly account for the fact that Distributed Objects can be connected to by multiple clients at the same time. By connecting two proxy objects to an...

Apple Mac OSX Install.Framework - Arbitrary mkdir / unlink and chown to Admin Group

Source: https://code.google.com/p/google-security-research/issues/detail?id=477 Install.framework has a suid root binary here: /System/Library/PrivateFrameworks/Install.framework/Resources/runner This binary vends the IFInstallRunner Distributed Object, which has the following method:...

Apple Mac OSX - Install.framework suid Helper Privilege Escalation

Source: https://code.google.com/p/google-security-research/issues/detail?id=314 The private Install.framework has a few helper executables in /System/Library/PrivateFrameworks/Install.framework/Resources, one of which is suid root: -rwsr-sr-x 1 root wheel 113K Oct 1 2014 runner Taking a look at i...

Cisco Prime Infrastructure contains SUID root binaries

Overview The Cisco Prime Infrastructure version 2.2 contains two binaries with SUID root world-executable privileges, allowing any local user to execute arbitrary commands as root. Description CWE-276: Incorrect Default Permissions Two binaries are included in Cisco Prime version 2.2 that run as...

Apple OSX 10.10.4 DYLD_PRINT_TO_FILE Privilege Escalation Exploit

In Apple OS X 10.10.4 and prior, the DYLDPRINTTOFILE environment variable is used for redirecting logging data to a file instead of stderr. Due to a design error, this feature can be abused by a local attacker to write arbitrary files as root via restricted, SUID-root binaries. This module requir...

Apple OS X DYLD_PRINT_TO_FILE Privilege Escalation

In Apple OS X 10.10.4 and prior, the DYLDPRINTTOFILE environment variable is used for redirecting logging data to a file instead of stderr. Due to a design error, this feature can be abused by a local attacker to write arbitrary files as root via restricted, SUID-root binaries. This module requir...

Apple OS X DYLD_PRINT_TO_FILE Privilege Escalation

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 'Apple OS X DYLDPRINTTOFILE Privilege Escalation', 'Description' = %q In Apple OS X 10.10.4 and prior, the DYLDPRINTTOFILE environmen...

SCO Unixware 2.1/7.0/7.0.1/7.1/7.1.1 su(1) Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/826/info Certain versions of Unixware ship with a version of su1 which is vulnerable to a buffer overflow attack. This attack is possible because su1 fails to sanity check user supplied data, in this instance a username...

RedHat Linux <= 6.0, Slackware Linux <= 4.0 Termcap tgetent() Buffer Overflow (2)

No description provided by source. source: http://www.securityfocus.com/bid/588/info A buffer overflow existed in libtermcap's tgetent function, which could cause the user to execute arbitrary code if they were able to supply their own termcap file. Versions of libtermcap 2.0.8 and earliear are...

Debian 2.2,S.u.S.E 6.3/6.4/7.0 man -l Format String Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2327/info man is the manual page viewing program, available with the Linux Operating System in this implementation. It is freely distributed and openly maintained. A problem with the man command may allow for the elevatio...

FreeBSD 3.3,Linux Mandrake 7.0 'xsoldier' Buffer Overflow Vulnerability (1)

No description provided by source. source: http://www.securityfocus.com/bid/871/info Certain versions of FreeBSD 3.3 Confirmed and Linux Mandrake confirmed ship with a vulnerable binary in their X11 games package. The binary/game in question, xsoldier, is a setuid root binary meant to be run via ...

ISC INN 2.x Command-Line Buffer Overflow Vulnerability (1)

No description provided by source. source: http://www.securityfocus.com/bid/2620/info The innfeed utility, part of ISC InterNetNews, has an exploitable buffer overflow in its command-line parser. Specifically, innfeed will overflow if an overly long -c option is passed to it. A local attacker in...

LPPlus 3.2.2/3.3 dccscan unprivileged read vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1644/info $LPHOME/bin/dccscan is suid-root and can be executed by any user. It is possible for an unprivileged user to print files to which he does not have read access. In testing, this works even for printers to which t...

smcFanControl 2.1.2 - Multiple Buffer Overflow Vulnerabilities PoC (OSX)

No description provided by source. vnsecurity.net ADVISORY 2008-11 =============================== :Title: Buffer overflows in smcFanControl 2.1.2 for OSX :Severity: Critical :Reporter: KaiJern, Lau kjlau at vnsecurity.net :Products: smcFanControl 2.1.2 :OS: OSX :Fixed in: to be release...

Digital Unix 4.0 MSGCHK Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/3311/info The msgchk utility under certain versions of Digital Unix contains a buffer overflow vulnerability which could yield root privilege. If a local user invokes the msgchk utility at the command line, argumented wit...

cPanel 5.0 Guestbook.cgi Remote Command Execution Vulnerability (4)

No description provided by source. source: http://www.securityfocus.com/bid/6882/info A remote command execution vulnerability has been discovered in the cPanel CGI Application. This issue occurs due to insufficient sanitization of externally supplied data to the 'guestbook.cgi' script. An attack...

KDE KTVision 0.1 File Overwrite Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2913/info KTVision works with frame-grabber cards and KDE Unix K Desktop Environment to support TV video display on the PC screen. KTVision is vulnerable to symbolic link attacks. It is possible for an attacker to...