It is possible for users with GRANT access to change passwords for every user in the database (including the mysql superuser). MySQL also ships with a default "test" account which has GRANT privileges and is unpassworded, meaning anyone can connect to the db. These two problems combined can result in a total, remote (and probably anonymous) database compromise. The database can be compromised even if the test account is disabled (given a local user account with GRANT privs). An attacker can connect to mysql as any user with grant privileges for any table, and then alter the MySQL superuser 'root' password with a GRANT.
Winamp, a program for playing mp3 and other audio files, uses playlist files (*.pls) to store lists of files for playback. The code that reads these files has an unchecked buffer which can be overflowed to cause arbitrary code to be executed. If an entry longer than 580 bytes is specified in the file, EIP gets overwritten. This vulnerability can only be exploited remotely by convincing someone to download the hostile playlist and load it into Winamp. IE5 will download .pls files without user confirmation if winamp is installed.
When a new document is loaded into an IE window, IE will not update the Security Zone settings for that window until the new document is completely loaded. This means that if a local document is loaded, and then a large remote document is loaded that has JavaScript at the very beginning, the JavaScript may load and execute before the Security Zone settings are updated. This could lead to remote and untrusted JavaScript running as local trusted code, with full access to local files, cookies, etc.
Home Free is a suite of Perl cgi scripts that allow a website to support user contributions of various types. One of the scripts, search.cgi, accepts a parameter called letter which can be any text string. The supplied argument can contain the '../' string, which the script will process. This can be used to obtain directory listings and the first line of files outside of the intended web filesystem.
IMail includes a service called IMail Monitor which is used for local and remote performance measuring and diagnostics. It includes a small webserver operating on port 8181 to support web-based monitoring. One of the cgi scripts, status.cgi, is used to determine which services are currently running and create a web page to report this information. Multiple simultaneous requests for status.cgi will cause the software to crash, with a Dr. Watson error of 'Invalid Memory Address'.
Because of double path vulnerabilities in the binary userhelper and PAM, it is possible to get root locally on RedHat 6.0 and 6.1 systems. Both userhelper and PAM follow '..' paths and userhelper allows you to specifiy a program to execute as an argument to the -w parameter (which is expected to have an entry in /etc/security/console.apps). Because of this, it's possible to specifiy a program such as '../../../tmp/myprog', which would (to userhelper) be '/etc/security/console.apps/../../../tmp/myprog'. If 'myprog' exists, PAM will then try to execute it (with the same filename). PAM first does a check to see if the configuration file for '../../../tmp/myprog' is in /etc/pam.d/ but also follows '..' directories -- to an attacker's custom pam configuration file. Specified inside the malicious configuration file (/tmp/myprog) would be arbitrary shared libraries to be opened with setuid privileges. The arbitrary libraries can be created by an attacker specifically to compromise superuser access, activating upon dlopen() by PAM.
Because of double path vulnerabilities in the binary userhelper and PAM, it is possible to get root locally on RedHat 6.0 and 6.1 systems. Both userhelper and PAM follow '..' paths and userhelper allows you to specifiy a program to execute as an argument to the -w parameter (which is expected to have an entry in /etc/security/console.apps). Because of this, it's possible to specifiy a program such as '../../../tmp/myprog', which would (to userhelper) be '/etc/security/console.apps/../../../tmp/myprog'. If 'myprog' exists, PAM will then try to execute it (with the same filename). PAM first does a check to see if the configuration file for '../../../tmp/myprog' is in /etc/pam.d/ but also follows '..' directories -- to an attacker's custom pam configuration file. Specified inside the malicious configuration file (/tmp/myprog) would be arbitrary shared libraries to be opened with setuid privileges. The arbitrary libraries can be created by an attacker specifically to compromise superuser access, activating upon dlopen() by PAM.
Under certain versions of PHP, the popen() command fails to be applied to the EscapeShellCmd() command and as such users can possibly exploit PHP applications running in 'safe_mode' which make of use of the 'popen' system call.
The tftpd bundled with CascadeView for Ascend's B-STDX 8000/9000 network devices creates a log in /tmp called tftpd_xfer_status.log. If /tmp/tftpd_xfer_status.log already exists as a symbolic link, tftpd will follow it and overwrite any data it points to (it runs as root). It is possible for an attacker to link the log file to a file like /.rhosts to compromise elevated privileges on the device.
SGI's Irix operating system ships with an X11 application called 'soundplayer' which is used to play .WAV files. It is not setuid root by itself, but can inherit root privileges if called by midikeys (which is setuid on some old IRIX systems). Soundplayer is vulnerable to an input validation problem. When saving a file to disk with soundplayer, if a semicolon is appended to the end of the "proper" or "real" filename input followed by a command to be executed (no spaces), the command will run with the privileges soundplayer has (elevated or not). It is possible to compromise root access locally through exploitation of this vulnerability if soundplayer is executed (then exploited..) through setuid midikeys.
Services By CQR