Oracle 8 - File Access

Oracle 8 - File Access source: https://www.securityfocus.com/bid/170/info A number of security file access security vulnerabilities in suid programs that are part of Oracle may be exploited to obtain the privileges of the 'oracle' user and full access to the database system. Only the Unix version...

Oracle 8 - File Access

source: https://www.securityfocus.com/bid/170/info A number of security file access security vulnerabilities in suid programs that are part of Oracle may be exploited to obtain the privileges of the 'oracle' user and full access to the database system. Only the Unix version of Oracle is vulnerabl...

Rational Software ClearCase for Unix 3.2 - ClearCase SUID

Rational Software ClearCase for Unix 3.2 - ClearCase SUID source: https://www.securityfocus.com/bid/538/info Rational Software's ClearCase product includes a vulnerability whereby an unprivileged user can have any readable executable set to SUID root.. A 1.5 meg file is copied and then chmod'ed t...

Rational Software ClearCase for Unix 3.2 - ClearCase SUID

source: https://www.securityfocus.com/bid/538/info Rational Software's ClearCase product includes a vulnerability whereby an unprivileged user can have any readable executable set to SUID root.. A 1.5 meg file is copied and then chmod'ed to SUID, and during the time this file is being copied it c...

Oracle 8 - oratclsh Suid

Oracle 8 - oratclsh Suid source: https://www.securityfocus.com/bid/159/info Oracle8 is an enterprise level database. As part of the Internet Agent option installation process it installs the file $ORACLEHOME/bin/oratclsh as suid root. oratclsh is a TCL application that provides full access to TCL...

Oracle 8 - oratclsh Suid

source: https://www.securityfocus.com/bid/159/info Oracle8 is an enterprise level database. As part of the Internet Agent option installation process it installs the file $ORACLEHOME/bin/oratclsh as suid root. oratclsh is a TCL application that provides full access to TCL. oratclsh gives anyone t...

Solaris 7.0 - cancel Local Privilege Escalation

Solaris 7.0 - cancel Local Privilege Escalation / source: https://www.securityfocus.com/bid/293/info A buffer overrun condition was discovered in Solaris 2.6 X86 in /usr/bin/cancel. This buffer overflow is apparently present in the SPARC version as well although it is thought to be unexploitable...

Solaris 7.0 - 'cancel' Local Privilege Escalation

/ source: https://www.securityfocus.com/bid/293/info A buffer overrun condition was discovered in Solaris 2.6 X86 in /usr/bin/cancel. This buffer overflow is apparently present in the SPARC version as well although it is thought to be unexploitable. Previous versions of Solaris did not ship with...

S.u.S.E Linux 5.2 - 'gnuplot' Local Overflow / Local Privilege Escalation

/ source: https://www.securityfocus.com/bid/319/info Linux gnuplot 3.5 is shipped with S.u.S.E. Linux 5.2 and installed suid root by default. There is a buffer overflow vulnerability present in gnuplot which allows for users to obtain root access locally. / / gnuplot Linux x86 exploit from xnec...

CVE-1999-0350

Race condition in the dbloader program in ClearCase gives local users root access by setting SUID bits...

PT-1999-1039 · Ibm · Clearcase

Name of the Vulnerable Software and Affected Versions: ClearCase affected versions not specified Description: A race condition exists in the db loader program of ClearCase, allowing local users to gain root access by setting SUID bits. Recommendations: At the moment, there is no information about...

Debian suidmanager 0.18 - Command Execution

Debian suidmanager 0.18 - Command Execution source: https://www.securityfocus.com/bid/94/info /usr/bin/suidexec will execute arbitrary commands as root, as soon as just one suid root shell script can be found on the system: Just invoke /usr/bin/suidexec /path/to/script - it will happily execute...

Digital UNIX 4.0/4.0 B/4.0 D - SUID/SGID Core File

source: https://www.securityfocus.com/bid/74/info Digital UNIX 4.0 will follow symlinks while writting core files if two setuid programs dump core in sucession. The core file is owned by root but with the user's groud id. The core file permissions are 0600. This can be used to create root owned...

Linux libc 5.3.12/5.4 (RedHat Linux 4.0) - 'vsyslog()' Local Buffer Overflow

// source: https://www.securityfocus.com/bid/475/info A buffer overflow is present in linux libc 5.4.32 and below that allows a user to obtain local root access under some conditions. The overflow is in the function vsyslog and exploitable through the suid root program su, which passes the arg th...

Linux libc 5.3.125.4 (RedHat Linux 4.0) - vsyslog() Local Buffer Overflow

Linux libc 5.3.125.4 RedHat Linux 4.0 - vsyslog Local Buffer Overflow // source: https://www.securityfocus.com/bid/475/info A buffer overflow is present in linux libc 5.4.32 and below that allows a user to obtain local root access under some conditions. The overflow is in the function vsyslog and...

IBM AIX 4.2 - 'ping' Local Buffer Overflow

// source: https://www.securityfocus.com/bid/387/info A buffer overflow condition exists in some versions of /usr/sbin/ping under AIX. Given that ping is SUID root, this overflow allows malicious users to gain root from it. / /usr/sbin/ping exploit kinda' coded by BeastMaster V CREDITS: this is...

Solaris 7.0 - chkperm Local Privilege Escalation

Solaris 7.0 - chkperm Local Privilege Escalation source: https://www.securityfocus.com/bid/295/info Solaris 2.4, 2.5, and 2.5.1 possibly other versions have a package called FACE Framed Access Command Environment installed. Included in the package is a program called chkperm which checks a file t...

BSD/OS 2.1 / DG/UX 4.0 / Debian 0.93 / Digital UNIX 4.0 B / FreeBSD 2.1.5 / HP-UX 10.34 / IBM AIX 4.1.5 / NetBSD 1.0/1.1 / NeXTstep 4.0 / SGI IRIX 6.3 / SunOS 4.1.4 - 'rlogin' Local Privilege Escalation

/ source: https://www.securityfocus.com/bid/242/info The SUID rlogin program is used to establish remote sessions. A buffer overflow condition has been found in the rlogin program that may allow an unauthorized user to gain root access. The overflow in particular is in the rlogin code that handle...

suid_perl 5.001 - Command Execution

!/usr/bin/suidperl -U $ENVPATH="/bin:/usr/bin"; $=0;$=0; exec"/bin/bash"; milw0rm.com 1996-06-01...

IRIX 5.26.0 - Permissions File Manipulation

IRIX 5.26.0 - Permissions File Manipulation source: https://www.securityfocus.com/bid/1751/info The IRIX's /usr/lib/desktop/permissions tool is a suid and sgid root applications normally used by users to modify permissions of their files and files they are privileged for. A vulnerability in the...