Cisco VPN 5000 Client - Buffer Overrun (1)

// source: https://www.securityfocus.com/bid/5734/info Buffer overrun vulnerabilities have been reported in the Cisco VPN 5000 UNIX clients available for Linux and Solaris systems. The condition affects the binaries 'closetunnel' and 'opentunnel', both installed setuid root by default. Malicious...

Cisco VPN 5000 Client - Buffer Overrun (2)

Cisco VPN 5000 Client - Buffer Overrun 2 // source: https://www.securityfocus.com/bid/5734/info Buffer overrun vulnerabilities have been reported in the Cisco VPN 5000 UNIX clients available for Linux and Solaris systems. The condition affects the binaries 'closetunnel' and 'opentunnel', both...

CVE-2002-0755

Kerberos 5 su k5su in FreeBSD 4.5 and earlier does not verify that a user is a member of the wheel group before granting superuser privileges, which could allow unauthorized users to execute commands as root...

FreeBSD-SA-02:31.openssh

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-02:31 Security Advisory The FreeBSD Project Topic: openssh contains remote vulnerability Category: core Module: OpenSSH Announced: 2002-07-15 Credits: ISS X-Force Theo...

ISS Advisory: OpenSSH Remote Challenge Vulnerability

Internet Security Systems Security Advisory June 26, 2002 OpenSSH Remote Challenge Vulnerability Synopsis: ISS X-Force has discovered a serious vulnerability in the default installation of OpenSSH on the OpenBSD operating system. OpenSSH is a free version of the SSH Secure Shell communications...

CVE-2001-1172

OmniSecure HTTProtect 1.1.1 is affected by a local privilege escalation: a superuser without omnish privileges can modify a protected file by creating a symbolic link to that file. Root cause is improper protection against symbolic link exploitation in HTTProtect, allowing bypass of protection me...

Richard Gooch SimpleInit 2.0.2 - Open File Descriptor

// source: https://www.securityfocus.com/bid/5001/info A vulnerability has been reported for simpleinit that may allow users to execute arbitrary commands as the superuser. The vulnerability occurs because simpleinit may allow some child processes to inherit a file descriptor with read-write...

Richard Gooch SimpleInit 2.0.2 - Open File Descriptor

Richard Gooch SimpleInit 2.0.2 - Open File Descriptor // source: https://www.securityfocus.com/bid/5001/info A vulnerability has been reported for simpleinit that may allow users to execute arbitrary commands as the superuser. The vulnerability occurs because simpleinit may allow some child...

Security Advisory FreeBSD-SA-02:24.k5su

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-02:24.k5su Security Advisory The FreeBSD Project Topic: k5su utility does not honor wheel' group Category: kerberos5 Module: kerberos5/usr.bin/k5su Announced: 2002-05-20...

FreeBSD-SA-02:24.k5su

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-02:24.k5su Security Advisory The FreeBSD Project Topic: k5su utility does not honor wheel' group Category: kerberos5 Module: kerberos5/usr.bin/k5su Announced: 2002-05-20...

FreeBSD-SA-02:17.mod_frontpage

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-02:17 Security Advisory FreeBSD, Inc. Topic: modfrontpage port contains exploitable buffer overflow Category: ports Module: modfrontpage Announced: 2002-03-12 Credits: Marti...

FreeBSD-SA-02:13.openssh

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-02:13 Security Advisory FreeBSD, Inc. Topic: OpenSSH contains exploitable off-by-one bug Category: core, ports Module: openssh, portsopenssh, openssh-portable Announced:...

Hewlett Packard AdvanceStack Switch Managment Authentication Bypass Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hewlett Packard AdvanceStack Switch Managment Authentication Bypass Vulnerability Type: Access Validation Error Release Date: February 8, 2002 Product / Vendor: HP AdvanceStack 10Base-T Switching Hubs combine economical 10Base-T functionality with the...

Символьные линки в wmtv (symbolic link)

При записи файла конфигурации не сбрасываются права суперпользователя и не проверяются символьные линки...

Inproper input validation in Bugzilla <=2.14 - exploit

Since advisory and patched version is already released, here goes description of vulnerabilities I discovered in Bugzilla almost year ago. 1. Creating files on remote server. ----------------------------------- Nothing spectacular, but this vulnerability may allow us easily at least when using...

Buffer overflow vulnerability in pwck command line utility

Overview The CERT/CC has received a public report of a local buffer overflow vulnerability in the pwck utility. Description The pwck utility performs syntax checking of /etc/password and /etc/shadow password information files. This utility contains a buffer overflow vulnerability in the section o...

Buffer overflow vulnerability in grpck command line utility

Overview The CERT/CC has received a public report of a local buffer overflow vulnerability in the grpck utility. Description The grpck utility performs syntax checking of /etc/group and /etc/gshadow group information files. This utility contains a buffer overflow vulnerability in the section of...

FreeBSD-SA-01:60.procmail

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:60 Security Advisory FreeBSD, Inc. Topic: Multiple vulnerabilities in procmail signal handling Category: ports Module: procmail Announced: 2001-09-24 Credits: Philip A...

Local vulnerability in libutil derived with FreeBSD 4.4-RC (and earlier)

Hello, OpenSSH derived with FreeBSD 4.4 and earlier doesn't drop privileges before messing with login class capability database. The most problematic is: if newcommand == NULL && !quietlogin && !options.uselogin fname = logingetcapstrlc, "copyright", NULL, NULL; if fname != NULL && f = fopenfname...

Проблемы в libutlis/OpenSSH/login (unauthorized access)

При входе клиента не сбрасываются права суперюзера при просмотре параметров задаваемых в пользовательском .loginconf, что позволяет прочитать любой системный файл...