CVE-1999-0350

The vulnerability CVE-1999-0350 affects ClearCase’s db_loader, where a race condition can allow local users to obtain root privileges by setting SUID bits. The Red Hat and CVE records confirm the issue and describe the root cause as a race in the db_loader program; exploitation details or specifi...

linux_GNOME_exploit.txt

Greetings, Virtually any program using the GNOME libraries is vulnerable to a buffer overflow attack. The attack comes in the form: /path/to/gnome/prog --enable-sound --espeaker=$80bytebuffer The following exploit should work against any GNOME program, though I tried it on the irony...

suse6.2pbpg.txt

Brock Tellier [email protected] Sent: Thursday, September 16, 1999 5:06 PM Subject: Two SuSE 6.2 local root exploits Greetings, /usr/bin/pb and /usr/bin/pg, suid root by default on SuSE 6.2, allow any user to read any file on the system as shown: susebox:/root ls -la /usr/bin/pb uname -rwsr-xr-...

libtermcap_exploit.txt

Subject: local libtermcap exploit To: [email protected] Well, I wrote this a little while back. This is a serious bug, so people should be able to test their systems properly. All admins should definitely upgrade to the newest libtermcap. - sk8 of LS / Local exploit for suid root programs...

LPRng.txt

Subject: Security problem with LPRng To: [email protected] Hi all, During some recent work I've been doing with LPRng, I found that is is possible on a default LPRng installation to control the print queues on the LPRng server. Most default installations allow the root user at the localhost to...

suguard.txt

L0pht Security Advisory Advisory released Jan 3 1999 Application: suGuard rev 1.0 from DataLynx Severity: any user configured under suGuard can execute any command as root Author: [email protected] http://www.l0pht.com/advisories.html Overview : During a cursory examination of DataLynx's suGuard...

cvnmount.exploit

Covin Security Releases: mount bufferoverflow exploit v1.0 Tested operated systems: All current distributions of Linux Affect: Local users on systems affected can gain overflow mounts syntax buffer and execute a shell by overwriting the stack. Affected binaries: /bin/mount and /bin/umount...

ClearCase.txt

L0pht Security Advisory Advisory released Jan 8 1999 Application: Rational Software's Clear Case v3.2 Severity: any local user can become root Author: [email protected] http://www.L0pht.com/advisories.html --- Overview : --- ClearCase is a configuration management program from Rational Software...

midnight-commander-tty.txt

Date: Sun, 6 Sep 1998 00:53:24 +0200 From: Michal Zalewski To: [email protected] Subject: Sendmail, lynx, Netscape, sshd, Linux kernel twice More kernel 'things' - tty allocation ------------------------------------- Hmm, I've posted it months ago, and I have no idea why it hasn't been approve...

poc.mail.local.txt

Proof of Concept - Security Advisory 02/15/99 http://poc.csoft.net Released by [email protected] [email protected] --- Affected Program mail.local Berkeley Sendmail Description Local mailer forward mail to mailboxes Severity Mailbox compromise Synopsis: mail.local is a small program distributed wit...

oracle.8.0.5.intelligent.agent.txt

Date: Fri, 30 Apr 1999 14:11:39 +0100 From: Anthony Clarke To: [email protected] Subject: Huge security hole in Oracle 8.0.5 with Intellegent agent installed oracle-digested ------------- Begin Forwarded Message ------------- Subject: Huge security hole in Oracle 8.0.5 with Intellegent agent...

rxvt.sh

There is a major security hole in rxvt, a terminal emulator for X, when it is run on systems suid root, as is required on many configurations in order to write to the utmp file. It is obvious from the code that this program was not written to be run suid root, its a pity that sysadmins that insta...

tcsh.6.07.bof.txt

Date: Mon, 17 May 1999 09:53:19 +0200 From: arkth To: [email protected] Subject: tcsh overflow While few days ago there was discussion about bash overflow on bugtraq i found another overflow in tcsh-6.07.09-1 rh 5.2 . The problem is in too long $HOME evironment variable very old thing - zgv...

IBM AIX 4.2.1 / Sun Solaris 7.0 - LC_MESSAGES libc Buffer Overflow (1)

source: https://www.securityfocus.com/bid/268/info A buffer overflow in libc's handling of the LCMESSAGES environment variable allows a malicious user to exploit any suid root program linked agains libc to obtain root privileges. This problem is found in both IBM's AIX and Sun Microsystem's...

IBM AIX 4.2.1 / Sun Solaris 7.0 - LC_MESSAGES libc Buffer Overflow (4)

// source: https://www.securityfocus.com/bid/268/info A buffer overflow in libc's handling of the LCMESSAGES environment variable allows a malicious user to exploit any suid root program linked agains libc to obtain root privileges. This problem is found in both IBM's AIX and Sun Microsystem's...

Oracle 8 - File Access

Oracle 8 - File Access source: https://www.securityfocus.com/bid/170/info A number of security file access security vulnerabilities in suid programs that are part of Oracle may be exploited to obtain the privileges of the 'oracle' user and full access to the database system. Only the Unix version...

Oracle 8 - File Access

source: https://www.securityfocus.com/bid/170/info A number of security file access security vulnerabilities in suid programs that are part of Oracle may be exploited to obtain the privileges of the 'oracle' user and full access to the database system. Only the Unix version of Oracle is vulnerabl...

Rational Software ClearCase for Unix 3.2 - ClearCase SUID

Rational Software ClearCase for Unix 3.2 - ClearCase SUID source: https://www.securityfocus.com/bid/538/info Rational Software's ClearCase product includes a vulnerability whereby an unprivileged user can have any readable executable set to SUID root.. A 1.5 meg file is copied and then chmod'ed t...

Rational Software ClearCase for Unix 3.2 - ClearCase SUID

source: https://www.securityfocus.com/bid/538/info Rational Software's ClearCase product includes a vulnerability whereby an unprivileged user can have any readable executable set to SUID root.. A 1.5 meg file is copied and then chmod'ed to SUID, and during the time this file is being copied it c...

Oracle 8 - oratclsh Suid

Oracle 8 - oratclsh Suid source: https://www.securityfocus.com/bid/159/info Oracle8 is an enterprise level database. As part of the Internet Agent option installation process it installs the file $ORACLEHOME/bin/oratclsh as suid root. oratclsh is a TCL application that provides full access to TCL...