IBM

Buffer overflows in Sun libnsl allow root access.

Denial of Service vulnerability in BIND 8 Releases via maliciously formatted DNS messages.

inetd in AIX 4.1.5 dynamically assigns a port N when starting ttdbserver (ToolTalk server), but also inadvertently listens on port N-1 without passing control to ttdbserver, which allows remote attackers to cause a denial of service via a large number of connections to port N-1,…

sadc in IBM AIX 4.1 through 4.3, when called from programs such as timex that are setgid adm, allows local users to overwrite arbitrary files via a symlink attack.

Denial of service in AIX telnet can freeze a system and prevent users from accessing the server.

Vulnerability in digest in AIX 4.3 allows printq users to gain root privileges by creating and/or modifing any file on the system.

AIX routed allows remote users to modify sensitive files.

FTP servers can allow an attacker to connect to arbitrary ports on machines other than the FTP client, aka FTP bounce.

AIX piodmgrsu command allows local users to gain additional group privileges.

AIX nslookup command allows local users to obtain root access by not dropping privileges correctly.

The AIX FTP client can be forced to execute commands from a malicious server through shell metacharacters (e.g. a pipe character).

Buffer overflow in AIX libDtSvc library can allow local users to gain root access.

Buffer overflow in AIX writesrv command allows local users to obtain root access.

Buffer overflow in AIX xdat gives root access to local users.

Buffer overflow in AIX rcp command allows local users to obtain root access.

Lotus cc:Mail release 8 stores the postoffice password in plaintext in a hidden file which has insecure permissions, which allows local users to gain privileges.

DNS cache poisoning via BIND, by predictable query IDs.

An attacker can write to syslog files from any location, causing a denial of service by filling up the logs, and hiding activities.

The rwho/rwhod service is running, which exposes machine status and user information.

RIP v1 is susceptible to spoofing.

Command execution in Sun systems via buffer overflow in the at program.

Buffer overflow in xmcd 2.0p12 allows local users to gain access through an environmental variable.

Talkd, when given corrupt DNS information, can be used to execute arbitrary commands with root privileges.

Jolt ICMP attack causes a denial of service in Windows 95 and Windows NT systems.

Sendmail allows local users to write to a file and gain group permissions via a .forward or :include: file.

Buffer overflow and denial of service in Sendmail 8.7.5 and earlier through GECOS field gives root access to local users.

Buffer overflow in rwhod on AIX and other operating systems allows remote attackers to execute arbitrary code via a UDP packet with a long hostname.

The suidperl and sperl program do not give up root privileges when changing UIDs back to the original users, allowing root access.

Delete or create a file via rpc.statd, due to invalid information.

pcnfsd (aka rpc.pcnfsd) allows local users to change file permissions, or execute arbitrary commands through arguments in the RPC call.

Buffer overflow in syslog utility allows local or remote attackers to gain root privileges.

dpsexec (DPS Server) when running under XDM in IBM AIX 3.2.5 and earlier does not properly check privileges, which allows local users to overwrite arbitrary files and gain privileges.

AIX batch queue (bsh) allows local and remote users to gain additional privileges when network printing is enabled.

AIX Licensed Program Product performance tools allow local users to gain root access.

FTP installation script anon.ftp in AIX insecurely configures anonymous FTP, which allows remote attackers to execute arbitrary commands.

AIX passwd allows local users to gain root access.

The default configuration for UUCP in AIX before 3.2 allows local users to gain root privileges.