Дырка в Solaris (ximp40)

Переполнение буфера в динамической библиотеке ximp40 используемой многими suid приложениями...

Переполнение буфера в Splitvt

Классическое переполнение буфера в suid-утилите...

Debian 2.2 - splitvt Format String

Debian 2.2 - splitvt Format String // source: https://www.securityfocus.com/bid/2210/info splitvt is a VT100 window splitter, designed to allow the user two command line interfaces in one terminal window, originally written by Sam Lantinga. It is freely available, open source, and included with...

Серьезная дырка в glibc

В suid-приложениях не сбрасывается переменная RESOLVHOSTCONF, что позволяет пользователю указать в качестве конфигурации резолвера любой файл, получить доступ на чтение к любому файлу. Кроме того, в отдельных случаях пользователь может подключать свои библиотеки...

[RHSA-2001:001-05] glibc file read or write access local vulnerability

--------------------------------------------------------------------- Red Hat, Inc. Red Hat Security Advisory Synopsis: glibc file read or write access local vulnerability Advisory ID: RHSA-2001:001-05 Issue date: 2001-01-11 Updated on: 2001-01-11 Product: Red Hat Linux Keywords: glibc...

Локальная дырка в xitetris

Недостаточная проверка ввода пользователя при вызове внешнего приложения в suid root приложении...

ezmlm-cgi/ezmlm-idx-0.40 security advisory

Summary: ezmlm-cgi is part of the ezmlm-idx-0.40.tar.gz package and allows web access to mailing list archives. When ezmlm-cgi is installed SUID user other than root, it can be used to execute arbitrary commands with the effective uid of the SUID user. Scope: Default installations of ezmlm-idx-0....

Пофиксены многочисленные локальные дырки в AIX

Многочисленный suid/sgid утилиты содержали переполнение буфера...

RedHat 6.2 usrbinrcp - SUID Local Privilege Escalation

RedHat 6.2 usrbinrcp - SUID Local Privilege Escalation !/usr/bin/perl -w exploits suid privledges on rcp Not really tested this but hey works on redhat6.2 not werk on freebsd4.1 stable bug discovered by Andrew Griffiths Exploit written by tlabs greetz to those that know me innit Please set your...

RedHat 6.2 /usr/bin/rcp - 'SUID' Local Privilege Escalation

!/usr/bin/perl -w exploits suid privledges on rcp Not really tested this but hey works on redhat6.2 not werk on freebsd4.1 stable bug discovered by Andrew Griffiths Exploit written by tlabs greetz to those that know me innit Please set your rcpfile this can be found by doing ls -alF which rcp hav...

dump 0.4b15 (RedHat 6.2) - Local Privilege Escalation

/ dump-0.4b15x.c dump-0.4b15 exploit: Redhat 6.2 dump command executes external program with suid priviledge. affected: /sbin/dump /sbin/dump.static /sbin/restore /sbin/restore.static Bug found by [email protected] This example was coded by [email protected] It was written for EDUCATION...

dump 0.4b15 exploit (Redhat 6.2)

Exploit for linux platform in category local exploits ================================ dump 0.4b15 exploit Redhat 6.2 ================================ / dump-0.4b15x.c dump-0.4b15 exploit: Redhat 6.2 dump command executes external program with suid priviledge. affected: /sbin/dump /sbin/dump.stat...

rpc Suid Privledge Exploit

Exploit for linux platform in category local exploits ========================== rpc Suid Privledge Exploit ========================== !/usr/bin/perl -w exploits suid privledges on rcp Not really tested this but hey works on redhat6.2 not werk on freebsd4.1 stable bug discovered by Andrew Griffit...

dump 0.4b15 - Local Privilege Escalation

dump 0.4b15 - Local Privilege Escalation !/bin/sh Redhat 6.2 dump command executes external program with suid priviledge. Discovered by Mat Written for and by a scriptkid Tasc ;P Remember, there's no cure for BSE echo "dump-0.4b15 root exploit" echo "Discovered by Mat " echo...

dump 0.4b15 - Local Privilege Escalation

!/bin/sh Redhat 6.2 dump command executes external program with suid priviledge. Discovered by Mat Written for and by a scriptkid Tasc ;P Remember, there's no cure for BSE echo "dump-0.4b15 root exploit" echo "Discovered by Mat " echo "-------------------------------------" echo DUMP=/sbin/dump i...

Problems with cons.saver

Hi, Many systems have a suid on cons.saver which is part of midnight commander package. Standard location of this binary is /usr/lib/mc/bin/cons.saver. There is a bug, which allows luser to write '0' char to any symlinkable file in system. So it can be very destructive, I wrote simple example of...

Solaris 2.6/7.0 /locale - Subsystem Format String

/ source: https://www.securityfocus.com/bid/1634/info nectiva 4.x/5.x,Debian 2.x,IBM AIX 3.x/4.x,Mandrake 7,RedHat 5.x/6.x,IRIX 6.x, Solaris 2.x/7/8,Turbolinux 6.x,Wirex Immunix OS 6.2 Locale Subsystem Format String Many UNIX operating systems provide internationalization support according to the...

Redhat 6.2 dump command executes external program with suid priviledge.

Problem: Linux dump command executes external program with suid priviledge. 2. Tested Version dump-0.4b15 3. Example mat@localhost mat$ export TAPE=garbage:garbage mat@localhost mat$ export RSH=/home/mat/executethis mat@localhost mat$ cat /home/mat/executethis !/bin/sh cp /bin/sh /home/mat/sh...

Серьезная уязвимость многих Unix через locale в glibc

Функции работы с locale позволяют пользователям создавать пользовательские отображения строк, при этом не проверяется наличие форматных символов. Функции locale используются многими suid-приложениями. В некоторых случаях проблема становится удаленной из-за некорректной обработки переменных...

Проблема с ld.so из glibc

Переменная окружения LDPRELOAD используется для поиска динамических библиотек. При вызове suid/sgid программы эта переменная сбрасывается, но не сбрасывается, когда suid/sgid вызывает другое приложение, что позволяет подсунуть пользовательскую библиотеку...