2912 matches found
CentOS 3 : kernel (CESA-2005:293)
Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 3 kernel are now available. This security advisory has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating syste...
kernel hacking simple to get started-vulnerability warning-the black bar safety net
User space and kernel space --------------------------- linux is a protected mode ofoperating system. It has been working on the i386 cpu protected mode. Memory is divided into two elements: a kernel area and a user area. （Translator's note: I think it is so called relatively smooth） The kernel...
SA-03.txt
I'm proud to introduce an example of return into libc exploit which works though grsecurity patch protection. Please read source carefully and change some lines cause default version probably wont work on your machine. - This is example, remember it. ; / Grsecurity bypass tryout - system"/bin/sh"...
Code injection
NetBSD 1.6, 2.0, 2.1 and 3.0 allows local users to cause a denial of service memory exhaustion by using the sysctl system call to lock a large buffer into physical memory...
CVE-2006-1814
NetBSD 1.6, 2.0, 2.1 and 3.0 allows local users to cause a denial of service memory exhaustion by using the sysctl system call to lock a large buffer into physical memory...
phpMyChat <= 0.14.5 (SYS enter) Remote Code Execution Exploit
No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo "PHPMyChat = 0.14.5 "SYS enter" remote cmmnds xctn 0day\r\n"; echo "by rgod [email protected]\r\n"; echo "site: http://retrogod.altervista.org\r\n\r\n"; echo "dork: intext:"2000-2001 The phpHeaven Team"...
linux/x86 setuid(0) setgid(0) execve(/bin/sh [/bin/sh NULL]) 37 bytes
No description provided by source. / Linux/x86 setuid0 + setgid0 + execve"/bin/sh", "/bin/sh", NULL - 37 bytes - [email protected] / char shellcode = "\x6a\x17" // push $0x17 "\x58" // pop %eax "\x31\xdb" // xor %ebx, %ebx "\xcd\x80" // int $0x80 "\x6a\x2e" // push $0x2e "\x58" // pop %eax "\x53" ...
linux/x86 setreuid(0,0) execve("/bin/sh", ["/bin/sh", NULL]) 33 bytes
Exploit for linux/x86 platform in category shellcode ===================================================================== linux/x86 setreuid0,0 execve"/bin/sh", "/bin/sh", NULL 33 bytes ===================================================================== / Linux/x86 setreuid0,0 + execve"/bin/sh...
GLSA-200602-11 : OpenSSH, Dropbear: Insecure use of system() call
The remote host is affected by the vulnerability described in GLSA-200602-11 OpenSSH, Dropbear: Insecure use of system call To copy from a local filesystem to another local filesystem, scp constructs a command line using 'cp' which is then executed via system. Josh Bressers discovered that specia...
OpenSSH, Dropbear: Insecure use of system() call
Background OpenSSH is a free application suite consisting of server and clients that replace tools like telnet, rlogin, rcp and ftp with more secure versions offering additional functionality. Dropbear is an SSH server and client designed with a small memory footprint that includes OpenSSH scp...
Mandrake Linux Security Advisory : kernel (MDKSA-2006:040)
A number of vulnerabilities were discovered and corrected in the Linux 2.6 kernel : The udpv6getport function in udp.c, when running IPv6, allows local users to cause a Denial of Service infinite loop and crash CVE-2005-2973. The mqopen system call in certain situations can decrement a counter...
Mac OS X 10.4.x < 10.4.5 Kernel Undocumented System Call Local DoS
The remote host is running a version of Mac OS X 10.4.x that is prior to 10.4.5. Mac OS X 10.4.5 contains a security fix for a local denial of service vulnerability. A malicious local user may trigger the vulnerability by invoking an undocumented system call. C Tenable Network Security, Inc. if !...
Information disclosure
Apple Mac OS X 10.4.5 and allows local users to cause a denial of service crash via an undocumented system call...
CVE-2006-0382
Apple Mac OS X 10.4.5 and allows local users to cause a denial of service crash via an undocumented system call...
SHOUTcast <= 1.9.4 File Request Format String Exploit (Leaked)
No description provided by source. / Shoutcast = 1.9.4 exploit by crash-x Trys to upload the shellcode to a fixed address and execute it. This exploit was not written bei Simon 'Zodiac' Moser segfault.ch. / include stdio.h include stdlib.h include stdarg.h include string.h include sys/types.h...
OpenSSH scp client unfiltered shell characters
Unsafe argument filename usage in system call...
RHEL 4 : kernel (RHSA-2006:0101)
Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 4 kernel are now available. This security advisory has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating syste...
Ubuntu 4.10 / 5.04 : linux-source-2.6.10, linux-source-2.6.8.1 vulnerabilities (USN-199-1)
A Denial of Service vulnerability was discovered in the syssetmempolicy function. By calling the function with a negative first argument, a local attacker could cause a kernel crash. CAN-2005-3053 A race condition was discovered in the handling of shared memory mappings with CLONEVM. A local...
CVE-2006-0145
The kernfsxread function in kernfs in NetBSD 1.6 through 2.1, and OpenBSD 3.8, does not properly validate file offsets against negative 32-bit values that occur as a result of truncation, which allows local users to read arbitrary kernel memory and gain privileges via the lseek system call...
Design/Logic Flaw
The kernfsxread function in kernfs in NetBSD 1.6 through 2.1, and OpenBSD 3.8, does not properly validate file offsets against negative 32-bit values that occur as a result of truncation, which allows local users to read arbitrary kernel memory and gain privileges via the lseek system call...