BSDi 3.0 inc - Local Buffer Overflow / Local Privilege Escalation

/ BSDiincmh buffer overflow, by [email protected]. this is will give you euid=0root on BSDi/3.0 systems. / define PATH "/usr/contrib/mh/bin/inc" / path to inc on BSDi/3.0 / define BUFFER 2048 / no need to change this. / define DEFAULTOFFSET -7000 / generalized offset. / static char exec=...

CVE-2000-1009

CVE-2000-1009 concerns Red Hat Linux 6.2 where the backup tool dump relies on the RSH environment variable to decide which program to run remotely. The pathname specified by RSH is trusted, enabling local users to substitute a Trojan horse program and gain root privileges. The root cause is impro...

CVE-2000-1012

FreeBSD 5.0 and earlier are affected by CVE-2000-1012 due to the catopen function reading files via the LANG environment variable. Local users can read arbitrary files, yielding complete confidentiality and integrity impacts as described in the NVD entry (AV:L/AC:L/Au:N/C:C/I:C/A:C). The vulnerab...

CVE-2000-0918

The CVE-2000-0918 entry describes a format string vulnerability in KDE's kvt component (version 1.1.2) that may allow local users to execute arbitrary commands via a DISPLAY environment variable containing formatting characters. The affected software is KDE 1.1.2; root cause is unsafe format-stri...

CVE-2000-1013

The CVE-2000-1013 entry describes a local file read vulnerability in setlocale affecting FreeBSD/5.0 and earlier (and possibly other OSes), where an attacker can read arbitrary files via the LANG environment variable. The NVD entry lists a base CVSS v2 score of 7.2 (HIGH) with local access, low a...

CVE-2000-1013

The setlocale function in FreeBSD 5.0 and earlier, and possibly other OSes, allows local users to read arbitrary files via the LANG environmental variable...

CVE-2000-0986

Buffer overflow in Oracle 8.1.5 applications such as names, namesctl, onrsd, osslogin, tnslsnr, tnsping, trcasst, and trcroute possibly allow local users to gain privileges via a long ORACLEHOME environmental variable...

CVE-2000-0918

Format string vulnerability in kvt in KDE 1.1.2 may allow local users to execute arbitrary commands via a DISPLAY environmental variable that contains formatting characters...

PHP Phorum quick fix

The major problem in Phorum, if all else is secured with the admin area off limits to anyone, seems to be the reading of local server files. In that last email on this in the correspondance part you can see the following... snip Hi jason, The fix that is provided in Phorum's site doesn't...

RedHat 0.4 b15 restore - Insecure Environment Variables

RedHat 0.4 b15 restore - Insecure Environment Variables source: https://www.securityfocus.com/bid/1914/info restore is a program for backup and recovery procedures, distributed with the RedHat Linux Operating System. A vulnerability exists that could allow a user elevated permissions. The problem...

RedHat 0.4 b15 restore - Insecure Environment Variables

source: https://www.securityfocus.com/bid/1914/info restore is a program for backup and recovery procedures, distributed with the RedHat Linux Operating System. A vulnerability exists that could allow a user elevated permissions. The problem occurs in the RSH environment variable. restore is...

Дырка в Oracle 8 (ORACLE_HOME)

Переполнение буфера во многих приложениях при разборе переменной ORACLEHOME...

CVE-2000-0794

Buffer overflow in IRIX libgl.so library allows local users to gain root privileges via a long HOME variable to programs such as 1 gmemusage and 2 grosview...

CVE-2000-0340

Affected software: Gnomelib on SuSE Linux 6.3. Vulnerability: buffer overflow in Gnomelib that allows local users to execute arbitrary commands via the DISPLAY environment variable. Root cause: buffer overflow; Impact: local arbitrary command execution. Remediation: no patch/version details provi...

CVE-2000-0009

The CVE-2000-0009 entry concerns the bna_pass program in Optivity NETarchitect, which relies on the PATH environment variable to locate the rm program. This behavior allows local users to execute arbitrary commands due to how PATH is used, as described in the observed description. The available d...

CVE-2000-0340

Buffer overflow in Gnomelib in SuSE Linux 6.3 allows local users to execute arbitrary commands via the DISPLAY environmental variable...

CVE-1999-0946

CVE-1999-0946 documents a buffer overflow in the Yamaha MidiPlug triggered via a Text variable in an EMBED tag. The available sources confirm the vulnerable component is the MidiPlug and identify the root cause as improper handling of a Text variable within an EMBED tag, leading to a potential ov...

CVE-2000-0537

BRU backup software allows local users to append data to arbitrary files by specifying an alternate configuration file with the BRUEXECLOG environmental variable...

anaconda Foundation 1.4 < 1.9 - Directory Traversal

source: https://www.securityfocus.com/bid/2338/info A vulnerability exists in Anaconda Foundation Directory which allows a remote user to traverse the filesystem of a target computer. This may lead to the disclosure of file and directory contents. Arbitrary files can be accessed through the use o...

Mail File POST Vulnerability

MailFile v 1.10 by Oatmeal-Studios http://www.oatmeal-studios.com This Perl script enables a site's visitor to have a given file dispatched to a specified email address. The visitor is required to select the file from a given list and to enter his or her email address. The data will then be...