screenie symbolic links vulnerabilities

Temporary file /tmp/.screenie. is created in insecure way...

rgmanager: multiple insecure temporary file use issues

Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager aka rgmanager before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on...

openSUSE Security Update : sblim-sfcb (sblim-sfcb-505)

A tmp file race condition in the genSslCerts.sh helper script could be used by local attackers to gain root privileges. CVE-2009-0416 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

openSUSE Security Update : valgrind (valgrind-321)

valgrind reads a file .valgrindrc in the current directory. Therefore local users could place such a file a world-writable directory such as /tmp and influence other users' valgrind when it's executed there CVE-2008-4865. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text a...

PulseAudio (setuid) Priv. Escalation Exploit (ubu/9.04)(slack/12.2.0)

No description provided by source. PulseAudio setuid Local Privilege Escalation Vulnerability http://www.securityfocus.com/bid/35721 Credit for discovery of bug: Tavis Ormandy, Julien Tinnes and Yorick Koster -- Put files in /tmp/pulseaudio-exp or change config.h. Must be on same fs as the...

Solaris Update for bsmunconv overwrites root cron tab if cu created /tmp/root 111069-01

Check for the Version of bsmunconv overwrites root cron tab if cu created /tmp/root OpenVAS Vulnerability Test Solaris Update for bsmunconv overwrites root cron tab if cu created /tmp/root 111069-01 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH,...

Linux Kernel 2.6 UDEV < 141 Local Privilege Escalation Exploit

No description provided by source. / cve-2009-1185.c udev 141 Local Privilege Escalation Exploit Jon Oberheide [email protected] http://jon.oberheide.org Information: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1185 udev before 1.4.1 does not verify whether a NETLINK message originates...

CVE-2009-1214

GNU screen 4.0.3 creates the /tmp/screen-exchange temporary file with world-readable permissions, which might allow local users to obtain sensitive session information...

Linux/x86 - /bin/cp /bin/sh /tmp/katy & chmod 4555

No description provided by source. / Linux/x86 /bin/cp /bin/sh /tmp/katy ; chmod 4555 /tmp/sh using fork / include "stdio.h" char shellcode = "\xeb\x5e\x5f\x31\xc0\x88\x47\x07\x88\x47\x0f\x88\x47\x19\x89\x7f" "\x1a\x8d\x77\x08\x89\x77\x1e\x31\xf6\x8d\x77\x10\x89\x77\x22\x89"...

Linux/x86 - setuid(0) & chmod("/tmp",111) & exit(0)

No description provided by source. / Linux/x86 - setuid0 & chmod"/tmp",111 & exit0 Info reg ------------------ %eax = 23 %ebx = 0 %eax = 15 %ebx = /tmp %ecx = 111 %eax = 1 %ebx = 0 Shellcode 25 bytes Author: Jonathan Salwan submit AT shell-storm.org Web: http://www.shell-storm.org Disassembly of...

Design/Logic Flaw

Argument injection vulnerability in Enomaly Elastic Computing Platform ECP, formerly Enomalism, before 2.1.1 allows local users to send signals to arbitrary processes by populating the /tmp/enomalism2.pid file with command-line arguments for the kill program...

CVE-2009-0390

Argument injection vulnerability in Enomaly Elastic Computing Platform ECP, formerly Enomalism, before 2.1.1 allows local users to send signals to arbitrary processes by populating the /tmp/enomalism2.pid file with command-line arguments for the kill program...

CVE-2009-0390

Argument injection vulnerability in Enomaly Elastic Computing Platform ECP, formerly Enomalism, before 2.1.1 allows local users to send signals to arbitrary processes by populating the /tmp/enomalism2.pid file with command-line arguments for the kill program...

Mandrake Security Advisory MDVSA-2009:016 (xen)

The remote host is missing an update to xen announced via advisory MDVSA-2009:016. OpenVAS Vulnerability Test $Id: mdksa2009016.nasl 6587 2017-07-07 06:35:35Z cfischer $ Description: Auto-generated from advisory MDVSA-2009:016 xen Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc...

CVE-2008-5843

Multiple untrusted search path vulnerabilities in pdfjam allow local users to gain privileges via a Trojan horse program in 1 the current working directory or 2 /var/tmp, related to the a pdf90, b pdfjoin, and c pdfnup scripts...

OpenBSD/x86 - Load Kernel Module (/tmp/o.o) Shellcode (66 bytes)

OpenBSD/x86 - Load Kernel Module /tmp/o.o Shellcode 66 bytes. Shellcode exploit for OpenBSDx86 platform / The modload shellcode loads /tmp/o.o module very usefull if you have rootkit as kernel module in the /tmp dir and you can easily change the path directly in the code Size 66 bytes OS OpenBSD...

Linux/x86 - execve(/bin/sh /tmp/p00p) Shellcode (70 bytes)

Linux/x86 - execve/bin/sh /tmp/p00p Shellcode 70 bytes. Shellcode exploit for Linuxx86 platform Author: zillion EMail: [email protected] Home: http://www.safemode.org Linux x86 shellcode that does an execve of /bin/sh /tmp/p00p. File name: execve-tmp-p00p.c / This shellcode will do /bin/sh...

Linux/x86 - fork() + setreuid(0, 0) + execve(cp /bin/sh /tmp/sh; chmod 4755 /tmp/sh) Shellcode (126 bytes)

Linux/x86 - fork + setreuid0, 0 + execvecp /bin/sh /tmp/sh; chmod 4755 /tmp/sh Shellcode 126 bytes. Shellcode exploit for Linuxx86 platform / linux/x86 shamelessly ripped from one of my unpublished exploits / / fork's, does setreuid0, 0; then execve's: /bin/sh -c "cp /bin/sh /tmp/sh; chmod 4755...

OpenBSD/x86 - setuid(0) + Load Kernel Module (/tmp/o.o) Shellcode (74 bytes)

OpenBSD/x86 - setuid0 + Load Kernel Module /tmp/o.o Shellcode 74 bytes. Shellcode exploit for OpenBSDx86 platform / The modload shellcode setuid0 loads /tmp/o.o module very usefull if you have rootkit as kernel module in the /tmp dir Size 74 bytes OS OpenBSD /rootteam/dev0id rootteam.void.ru...

Linux/x86 - Copy /etc/passwd to /tmp/outfile Shellcode (97 bytes)

Linux/x86 - Copy /etc/passwd to /tmp/outfile Shellcode 97 bytes. Shellcode exploit for Linuxx86 platform ;Description: Copy /etc/passwd to /tmp/outfile 97 bytes ;Shellcode:...