AIX 5.3 TL 12 : cmdque (IV51388)

Printer commands mkque and mkquedev are susceptible to buffer overflow by users belonging to the 'printq' group. These commands are owned by 'root' and SUID bit set. The group is set to 'printq'. By default, no users are belong to the 'printq'. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

[LinEnum v0.2] Automating local information gathering tasks on Linux hosts

LinEnum is a shell script that automates local information gathering tasks on Linux hosts.Over 65 checks are performed, obtaining anything from kernel information to locating possible escalation points such as potentially useful SUID/GUID files and Sudo/rhost mis-configurations etc. Additionally,...

AIX 7.1 TL 2 : cmdque (IV47430)

Printer commands mkque and mkquedev are susceptible to buffer overflow by users belonging to the 'printq' group. These commands are owned by 'root' and SUID bit set. The group is set to 'printq'. By default, no users are belong to the 'printq'. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

AIX 6.1 TL 7 : cmdque (IV47427)

Printer commands mkque and mkquedev are susceptible to buffer overflow by users belonging to the 'printq' group. These commands are owned by 'root' and SUID bit set. The group is set to 'printq'. By default, no users are belong to the 'printq'. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

AIX printer commands vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 IBM SECURITY ADVISORY First Issued: Wed Sept 25 15:55:39 CDT 2013 | Updated: Wed Feb 26 12:48:22 CDT 2014 | Update: Modified APAR availability dates and corrected | some APAR SP levels. | Update: 1. Replaced ifixes to resolve a prerequisite issue. | 2...

ibstat $PATH Privilege Escalation

This module exploits the trusted $PATH environment variable of the SUID binary "ibstat". Module Options msf use exploit/aix/local/ibstat/path msf undefinedpath show actions ...actions... msf undefinedpath set ACTION msf undefinedpath show options ...show and set options... msf undefinedpath run...

[LinEnum] Scripted Local Linux Enumeration & Privilege Escalation Checks

High-level summary of the checks/tasks performed by LinEnum: Kernel and distribution release details System Information: Hostname Networking details: Current IP Default route details DNS server information User Information: Current user details Last logged on users List all users including uid/gi...

Oracle Linux 5 : Important: / autofs (ELSA-2007-1128)

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2007-1128 advisory. 5.0.1-0.rc2.55.el5.1 - Bug 410041: CVE-2007-5964 autofs defaults don't restrict suid in /net - use mount option nosuid for -hosts map unless suid is explicily...

Oracle Linux 5 : Important:kernel (ELSA-2007-0940)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-0940 advisory. 2.6.18-8.1.15.0.1.el5 - Fix bonding primary=ethX Bert Barbe IT 101532 ORA 5136660 - Add entropy module option to e1000/bnx2 John Sobecki ORA 6045759...

Fedora 19 : pmount-0.9.23-4.fc19 (2013-8906)

Fix cflags to meet packaging guidelines for packages that contain suid binaries. Fixes BZ 965459. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as...

Fedora 19 : spnavcfg-0.2.1-5.fc19 (2013-8844)

Fix cflags to meet packaging guidelines for packages that contain suid binaries. Fixes BZ 965522. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as...

FreeBSD 本地权限提升漏洞(CVE-2013-2171)

BUGTRAQ ID: 60615 CVECAN ID: CVE-2013-2171 FreeBSD是一种UNIX操作系统，是由经过BSD、386BSD和4.4BSD发展而来的Unix的一个重要分支 FreeBSD 9.0及其他版本的虚拟内存系统对权限检查不充分，注入debugger之类的跟踪进程可在未授权情况下修改被跟踪进程的地址空间，覆盖内核内存，造成权限提升或系统崩溃 0 FreeBSD = 9.0 厂商补丁： FreeBSD ------- FreeBSD已经为此发布了一个安全公告（FreeBSD-SA-13:06.mmap.asc）以及相应补丁:...

FreeBSD mmap Privilege Escalation Exploit

This exploits performs privilege escalation leveraging the mmap vulnerability in FreeBSD 9.1 as described in FreeBSD-SA-13:06. / FreeBSD privilege escalation CVE-2013-2171 credits Konstantin Belousov & Alan Cox tested on FreeBSD 9.1 ref:...

Fedora 18 : pmount-0.9.23-4.fc18 (2013-8801)

Fix cflags to meet packaging guidelines for packages that contain suid binaries. Fixes BZ 965459. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as...

Fedora 17 : pmount-0.9.23-4.fc17 (2013-8789)

Fix cflags to meet packaging guidelines for packages that contain suid binaries. Fixes BZ 965459. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as...

Fedora 17 : spnavcfg-0.2.1-5.fc17 (2013-8786)

Fix cflags to meet packaging guidelines for packages that contain suid binaries. Fixes BZ 965522. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as...

Fedora 18 : spnavcfg-0.2.1-5.fc18 (2013-8794)

Fix cflags to meet packaging guidelines for packages that contain suid binaries. Fixes BZ 965522. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as...

Mandriva Linux Security Advisory : nss-pam-ldapd (MDVSA-2013:106)

Updated nss-pam-ldapd packages fixes the following security vulnerability : Garth Mollett discovered that a file descriptor overflow issue in the use of FDSET in nss-pam-ldapd can lead to a stack-based buffer overflow. An attacker could, under some circumstances, use this flaw to cause a process...

Oracle Gridengine sgepasswd Buffer Overflow

======= Summary ======= Name: Oracle Gridengine sgepasswd Buffer Overflow Release Date: 30 November 2012 Reference: NGS00107 Discoverer: Edward Torkington Vendor: Oracle Vendor Reference: Systems Affected: Multiple packages - version 62u7 Risk: High Status: Published ======== TimeLine ========...

HT Editor 2.0.20 - Local Buffer Overflow (ROP)

HT Editor 2.0.20 - Local Buffer Overflow ROP !/usr/bin/perl =head1 TITLE HT Editor 2.0.20 Buffer Overflow ROP PoC =head2 DESCRIPTION Since version 2.0.18, the stack overflow vulnerability has not been corrected, which I assume would make it 0day? I consequently recoded an exploit, as memory...