CVE-2016-6079
published 2017-02-15CVE-2016-6079: IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privileges. IBM APARs…
PriorityP345high7.8CVSS 3.0
AVLACLPRLUINSUCHIHAH
EXPLOIT
EPSS
2.48%
82.7th percentile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privileges. IBM APARs: IV88658, IV87981, IV88419, IV87640, IV88053.
Affected
47 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | vios | — | — |
| ibm | vios | — | — |
| ibm | vios | — | — |
| ibm | vios | — | — |
| ibm | vios | — | — |
| ibm | vios | — | — |
| ibm | vios | — | — |
| ibm | vios | — | — |
| ibm | vios | — | — |
| ibm | vios | — | — |
| ibm | vios | — | — |
| ibm | vios | — | — |
| ibm | vios | — | — |
| ibm | vios | — | — |
| ibm | vios | — | — |
| ibm | vios | — | — |
| ibm | vios | — | — |
| ibm | vios | — | — |
| ibm | vios | — | — |
| ibm | vios | — | — |
| ibm | vios | — | — |
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
IBM AIX 5.3/6.1/7.1/7.2 - 'lquerylv' Local Privilege Escalation
exploitdb·2016-11-04·CVSS 6.9
CVE-2016-6079 [MEDIUM] IBM AIX 5.3/6.1/7.1/7.2 - 'lquerylv' Local Privilege Escalation
IBM AIX 5.3/6.1/7.1/7.2 - 'lquerylv' Local Privilege Escalation
---
#!/usr/bin/sh
#
# AIX lquerylv 5.3, 6.1, 7.1, 7.2 local root exploit. Tested against latest patchset (7100-04)
#
# This exploit takes advantage of known issues with debugging functions
# within the AIX linker library. We are taking advantage of known
# functionality, and focusing on badly coded SUID binaries which do not
# adhere to proper security checks prior to seteuid/open/writes.
#
# The CVEs we will be taking advantage of:
# - CVE-2009-1786: The malloc subsystem in libc in IBM AIX 5.3 and 6.1 allows
# local users to create or overwrite arbitrary files via a symlink attack on
# the log file associated with the MALLOCDEBUG environment variable.
#
# - CVE-2009-2669: A certain debugging component in IBM AIX 5.3 and 6.1
Exploit-DB
Brickcom Corporation Network Cameras - Multiple Vulnerabilities
exploitdb·2016-04-14
Brickcom Corporation Network Cameras - Multiple Vulnerabilities
Brickcom Corporation Network Cameras - Multiple Vulnerabilities
---
_ _ _ _
| | | | | |
___ _ ____ _____| | | | __ _| |__ ___
/ _ \| '__\ \ /\ / / _ \ | | |/ _` | '_ \/ __|
| (_) | | \ V V / __/ | | | (_| | |_) \__ \
\___/|_| \_/\_/ \___|_|_|_|\__,_|_.__/|___/
Security Adivisory
2016-04-12
www.orwelllabs.com
twt:@orwelllabs
sm1thw@0rw3lll4bs:~/bb# ./Bruce.S
[+] surveillance is the business model
of the internet - OK!
sm1thw@0rw3lll4bs:~/bb# echo $?
6079
Adivisory Information
Vendor: Brickcom Corporation
CVE-Number:N/A
Adivisory-URL:
http://www.orwelllabs.com/2016/04/Brickcom-Multiple-Vulnerabilities.html
OLSA-ID: OLSA-2015-12-12
Impact: High (especially because some of these products are used in
critical environments.)
Remote: Yes
p4n0pt1c0n
I. Insecure Direct Object Reference/A
Exploit-DB
Axis Network Cameras - Multiple Vulnerabilities
exploitdb·2016-04-11·CVSS 6.1
CVE-2015-8256 [MEDIUM] Axis Network Cameras - Multiple Vulnerabilities
Axis Network Cameras - Multiple Vulnerabilities
---
_ _ _ _
| | | | | |
___ _ ____ _____| | | | __ _| |__ ___
/ _ \| '__\ \ /\ / / _ \ | | |/ _` | '_ \/ __| 6079 Smith W
| (_) | | \ V V / __/ | | | (_| | |_) \__ \ doubleplusungood
\___/|_| \_/\_/ \___|_|_|_|\__,_|_.__/|___/ owning some telescreens...
Security Adivisory
2016-04-09
www.orwelllabs.com
twt:@orwelllabs
I. ADVISORY INFORMATION
Title: Axis Network Cameras Multiple Cross-site scripting
Vendor: Axis Communications
Class: Improper Input Validation [CWE-20]
CVE Name: CVE-2015-8256
Remotely Exploitable: Yes
Locally Exploitable: No
OLSA-ID: OLSA-2015-8256
Adivisory URL:
http://www.orwelllabs.com/2016/01/axis-network-cameras-multiple-cross.html
II. Background
Axis is the market leader in network video, invented the world’s first
No writeups or analysis indexed.
http://aix.software.ibm.com/aix/efixes/security/lquerylv_advisory.aschttp://www.securityfocus.com/bid/94090http://www.securitytracker.com/id/1037256https://www.exploit-db.com/exploits/40710/http://aix.software.ibm.com/aix/efixes/security/lquerylv_advisory.aschttp://www.securityfocus.com/bid/94090http://www.securitytracker.com/id/1037256https://www.exploit-db.com/exploits/40710/
2017-02-15
Published