CVE-2000-1121
published 2001-01-09CVE-2000-1121: Buffer overflow in enq command in IBM AIX 4.3.x and earlier may allow local users to execute arbitrary commands via a long -M argument.
PriorityP422high7.2CVSS 2.0
AVLACLAuNCCICAC
EXPLOIT
EPSS
0.99%
58.9th percentile
Buffer overflow in enq command in IBM AIX 4.3.x and earlier may allow local users to execute arbitrary commands via a long -M argument.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Microsoft DirectWrite / AFDKO - Heap-Based Out-of-Bounds Read/Write in OpenType Font Handling Due to Unbounded iFD
exploitdb·2019-07-10
CVE-2019-1121 Microsoft DirectWrite / AFDKO - Heap-Based Out-of-Bounds Read/Write in OpenType Font Handling Due to Unbounded iFD
Microsoft DirectWrite / AFDKO - Heap-Based Out-of-Bounds Read/Write in OpenType Font Handling Due to Unbounded iFD
---
-----=====[ Background ]=====-----
AFDKO (Adobe Font Development Kit for OpenType) is a set of tools for examining, modifying and building fonts. The core part of this toolset is a font handling library written in C, which provides interfaces for reading and writing Type 1, OpenType, TrueType (to some extent) and several other font formats. While the library existed as early as 2000, it was open-sourced by Adobe in 2014 on GitHub [1, 2], and is still actively developed. The font parsing code can be generally found under afdko/c/public/lib/source/*read/*.c in the project directory tree.
At the time of this writing, based on the available source code, we conclude that AF
Exploit-DB
IBM AIX 4.x - 'enq' Local Buffer Overflow
exploitdb·2003-04-24
CVE-2000-1121 IBM AIX 4.x - 'enq' Local Buffer Overflow
IBM AIX 4.x - 'enq' Local Buffer Overflow
---
source: https://www.securityfocus.com/bid/2034/info
AIX is a variant of the UNIX Operating System, distributed by IBM. A problem exists that may allow elevation of user priviledges.
The problem occurs in the enq program. It is reported that an overflow exists in the command line argument parsing, which could lead to the overwriting of variables on the stack. This creates the potential for a malicious user to execute arbitrary code, and possibly gain administrative access.
#!/bin/sh
# FileName: ex_enq_aix4x.sh
# Exploit "enq & qstatus" of Aix4.x to get egid=9 shell.
# Usage : chmod ex_enq_aix4x.sh ; ./ex_enq_aix4x.sh
# Tested : on Aix4.3.3
# Author : [email protected]
# Site : www.xfocus.org www.xfocus.net
# Date : 2003-4-24
# Announce:
No writeups or analysis indexed.
http://marc.info/?l=bugtraq&m=97569466809056&w=2http://www-1.ibm.com/support/search.wss?rs=0&q=IY08143&apar=onlyhttp://www-1.ibm.com/support/search.wss?rs=0&q=IY08287&apar=onlyhttp://www.securityfocus.com/bid/2034https://exchange.xforce.ibmcloud.com/vulnerabilities/5619http://marc.info/?l=bugtraq&m=97569466809056&w=2http://www-1.ibm.com/support/search.wss?rs=0&q=IY08143&apar=onlyhttp://www-1.ibm.com/support/search.wss?rs=0&q=IY08287&apar=onlyhttp://www.securityfocus.com/bid/2034https://exchange.xforce.ibmcloud.com/vulnerabilities/5619
2001-01-09
Published