Buffer overflow in lpr, as used in BSD-based systems including Linux, allows local users to execute arbitrary code as root via a long -C (classification) command line option.
CVSS 2.0
Severity: HIGH
Problem Type: NVD-CWE-Other,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| sgi | irix | 6.0.1 |
| sgi | irix | 6.0 |
| sgi | irix | 5.3 |
| sgi | irix | 6.4 |
| sgi | irix | 6.2 |
| freebsd | freebsd | 2.0 |
| sun | sunos | 4.1.3u1 |
| freebsd | freebsd | 2.0.5 |
| sun | sunos | 4.1.4 |
| sgi | irix | 5.2 |
| sgi | irix | 6.1 |
| bsdi | bsd_os | 2.1 |
| freebsd | freebsd | 2.1.0 |
| next | nextstep | 4.1 |
| sgi | irix | 5.0 |
| sgi | irix | 6.3 |
| freebsd | freebsd | 2.1.5 |
| sgi | irix | 5.1 |
| sgi | irix | 5.1.1 |
| next | nextstep | 4.0 |
| sgi | irix | 5.0.1 |
Buffer overflow of rlogin program using TERM environmental variable.
CVSS 2.0
Severity: HIGH
Problem Type: CWE-120,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| digital | unix | 3.2g |
| digital | ultrix | 3.0 |
| sun | solaris | 2.5.1 |
| hp | hp-ux | 10.00 |
| next | nextstep | - |
| hp | hp-ux | 10.08 |
| sun | sunos | 4.1.3u1 |
| digital | ultrix | 4.0 |
| ibm | aix | 4.1.2 |
| sun | sunos | 5.3 |
| ibm | aix | 4.1.5 |
| hp | hp-ux | 10.09 |
| data_general | dg_ux | 1.0 |
| digital | ultrix | 2.2 |
| digital | ultrix | 4.4 |
| next | nextstep | 2.1 |
| bsdi | bsd_os | 2.0.1 |
| next | nextstep | 3.0 |
| data_general | dg_ux | 2.0 |
| netbsd | netbsd | 1.1 |
| hp | hp-ux | 10.30 |
| data_general | dg_ux | 4.0 |
| digital | ultrix | 4.1 |
| freebsd | freebsd | 2.0 |
| digital | unix | 4.0a |
| sun | solaris | 2.5 |
| bsdi | bsd_os | 2.1 |
| next | nextstep | 3.2 |
| oracle | solaris | 8 |
| freebsd | freebsd | 2.1.0 |
| oracle | solaris | 2.6 |
| next | nextstep | 1.0 |
| next | nextstep | 1.0a |
| ibm | aix | 4.1 |
| digital | ultrix | 4.3 |
| sun | sunos | 5.5.1 |
| oracle | solaris | - |
| next | nextstep | 3.1 |
| oracle | solaris | 7.0 |
| ibm | aix | 4.1.3 |
| data_general | dg_ux | 3.0 |
| hp | hp-ux | 10.34 |
| hp | hp-ux | 10.24 |
| digital | unix | 4.0b |
| netbsd | netbsd | 1.0 |
| next | nextstep | 2.0 |
| digital | ultrix | 4.2 |
| hp | hp-ux | 10.16 |
| freebsd | freebsd | 1.1.5.1 |
| next | nextstep | 3.3 |
| sun | sunos | 5.5 |
| bsdi | bsd_os | 2.0 |
| debian | debian_linux | 0.93 |
| freebsd | freebsd | 2.0.5 |
| digital | ultrix | - |
| hp | hp-ux | 10.10 |
| sun | sunos | 4.1.4 |
| ibm | aix | 4.1.1 |
| ibm | aix | 3.2 |
| ibm | aix | 4.1.4 |
| digital | ultrix | 4.5 |
| hp | hp-ux | 10.01 |
| hp | hp-ux | 10.20 |
| digital | unix | 4.0 |
| sun | solaris | 2.4 |
| freebsd | freebsd | 2.1.5 |
| sun | sunos | 5.4 |
| digital | ultrix | 4.3a |
| bsdi | bsd_os | 1.1 |
| next | nextstep | 4.0 |
pcnfsd (aka rpc.pcnfsd) allows local users to change file permissions, or execute arbitrary commands through arguments in the RPC call.
CVSS 2.0
Severity: LOW
Problem Type: NVD-CWE-Other,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| sco | openserver | 5 |
| ibm | aix | 4.1 |
| sun | sunos | 5.5 |
| sun | sunos | 4.1 |
| sgi | irix | 5.3 |
| ncr | mp-ras | 2.03 |
| ibm | aix | 4.2 |
| freebsd | freebsd | 6.2 |
| ncr | mp-ras | 3.01 |
| nec | up-ux_v | * |
| ibm | aix | 3.2 |
| ncr | mp-ras | 3.0 |
| sco | unixware | 2.1 |
| hp | hp-ux | * |
| sun | sunos | 5.4 |
| next | nextstep | * |
| bsdi | bsd_os | * |
The NeXT NetInfo _writers property allows local users to gain root privileges or conduct a denial of service.
CVSS 2.0
Severity: HIGH
Problem Type: NVD-CWE-Other,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| next | nextstep | 2.1 |
| next | nextstep | 3.0 |
| next | nextstep | 2.0 |
| next | nextstep | 1.0 |
| next | nextstep | 1.0a |
The "me" user in NeXT NeXTstep 2.1 and earlier has wheel group privileges, which could allow the me user to use the su command to become root.
CVSS 2.0
Severity: HIGH
Problem Type: NVD-CWE-Other,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| next | next | * |
BuildDisk program on NeXT systems before 2.0 does not prompt users for the root password, which allows local users to gain root privileges.
CVSS 2.0
Severity: HIGH
Problem Type: NVD-CWE-Other,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| next | next | * |
Vulnerability in NeXT 1.0a and 1.0 with publicly accessible printers allows local users to gain privileges via a combination of the npd program and weak directory permissions.
CVSS 2.0
Severity: HIGH
Problem Type: NVD-CWE-Other,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| next | next | 1.0 |
| next | next | 1.0a |
Vulnerability in restore0.9 installation script in NeXT 1.0a and 1.0 allows local users to gain root privileges.
CVSS 2.0
Severity: HIGH
Problem Type: NVD-CWE-Other,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| next | next | 1.0 |
| next | nex | 1.0a |
rdist in various UNIX systems uses popen to execute sendmail, which allows local users to gain root privileges by modifying the IFS (Internal Field Separator) variable.
CVSS 2.0
Severity: MEDIUM
Problem Type: NVD-CWE-Other,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| sun | sunos | 4.1 |
| sun | sunos | 4.0.3 |
| sun | sunos | 4.1psr_a |
| next | next | 2.0 |
| sgi | irix | 3.3.3 |
| sgi | irix | 4.0 |
| sgi | irix | 3.3.1 |
| next | next | 2.1 |
| cray | unicos | 6.0 |
| cray | unicos | 6.1 |
| sun | sunos | 4.0.3c |
| sgi | irix | 3.3 |
| cray | unicos | 6.0e |
| sun | sunos | 4.1.1 |
| sgi | irix | 3.3.2 |