The DHTML Edit Control Safe for Scripting ActiveX control allows web authors and application developers to add WYSIWYG DHTML editing capabilities to thier web sites and applications. The control allows the web site to upload any data entered into the control. A vulnerability in the control allows malicious web site operators to instruct the control to upload a specific file if they known its pathname. Another vulnerability in this controls also allows local files to be stolen by using redirection. When a malicious web server sends a redirect to an HTTP request made by the control, its location property will still contain the requested url but will instead display the redirected url, including local URLs such as 'file://c:/config.sys'. The contents of the control can then be acessed (using dh.DOM.body.innerText) and be uploaded to the web server. Another vulnerability in this control allows an HTML document to acess the contents (read and write) of other framers regardless of their domain of origin against the cross-frame security rules. It also allows the page to perform spoofed transactions allowing it to submit forms without user intervention.
There is a vulnerability in ProFTPD versions 1.2.0pre1 and earlier and in wu-ftpd 2.4.2 (beta 18) VR9 and earlier. This vulnerability is a buffer overflow triggered by unusually long path names (directory structures). For example, if a user has write privilages he or she may create an unusually long pathname which due to insuficient bounds checking in ProFTPD will overwrite the stack. This will allow the attacker to insert their own instruction set on the stack to be excuted thereby elavating their access. The problem is in a bad implementation of the "realpath" function.
ProFTPD versions 1.2.0pre1 and earlier and wu-ftpd 2.4.2 (beta 18) VR9 and earlier are vulnerable to a buffer overflow triggered by unusually long path names (directory structures). An attacker with write privileges can create an unusually long pathname which due to insuficient bounds checking in ProFTPD will overwrite the stack, allowing the attacker to insert their own instruction set on the stack to be excuted thereby elavating their access. The problem is in a bad implementation of the 'realpath' function.
A vulnerability in the Linux kernel allows any user to send a SIGIO signal to any process. If the process does not catch or ignore the signal is will exit. On non-glibc systems, the user must add #define O_ASYNC FASYNC to the code. The code then takes a pid as an argument and sends a SIGIO signal to the process.
The /usr/bin/suidexec program will execute arbitrary commands as root, as soon as just one suid root shell script can be found on the system. Invoking /usr/bin/suidexec with a program and the path to the script will execute the program with euid = 0, which is sufficient for doing arbitrary damage on the system.
The Quake server has a feature where it allows administrators to remotely send commands to the Quake console with a password. However, it is possible to remotely bypass authentication. In order for this to be exploited, the attacker would have to create a handcrafted udp packet with a header containing the rcon command and the password "tms" with a source IP coming from ID Software's Subnet. (192.246.40). The Quake server does not require an open connection for sending the rcon packet. When this is exploited, no logs are reported of the rcon command being used.
A buffer overflow exists in 'dip-3.3.7o' and derived programs. This is a problem only on systems where 'dip' is installed setuid. The vulnerable code is an 'sprintf()' in line 192 in 'main.c'. An exploit is provided which uses a NOP sled and shellcode to gain root access.
A buffer overflow vulnerability exists in Apple's Personal Web Sharing 1.1. If an attacker sends a string of over 3000 bytes followed by two return characters to the web server's TCP port 80, the web server will stop servicing requests.
A request packet can be crafted and sent to the UDP port such that the upsd server will crash. This has been tested in the Solaris i386 version of the product. It has also been reported the software will crash in some instances when port scanned. It seems you can also manage any APC UPS remotely without providing any credential if you have the APC client software. Both the client and server software also create files insecurely in /tmp. The pager script (dialpager.sh) also contains unsafe users of temporary files. The mailer script (mailer.sh) passes the files provided in the command line to rm without checking them.
pkgtool creates the file /tmp/reply insecurely and follows symbolic links. An attacker can create a symbolic link from /tmp/reply to any file and wait for root to run the program. This will clober the target file. The file created has permissions -rw-rw-rw-.
Services By CQR