Hacker News Reader

dawid_golunskion GNU Wget

GNU Wget before 1.18 when supplied with a malicious URL (to a malicious or compromised web server) can be tricked into saving an arbitrary remote file supplied by an attacker, with arbitrary contents and filename under the current directory and possibly other directories by writing to .wgetrc. Depending on the context in which wget is used, this can lead to remote code execution and even root privilege escalation if wget is run via a root cronjob as is often the case in many web application deployments.

Full advisory and exploit at:

http://legalhackers.com/advisories/Wget-Arbitrary-File-Uploa...

Regards, Dawid Golunski

dawid_golunskion Exim before 4.86.2 vulnerable to Local Root Privilege Escalation

Exim < 4.86.2 Local Root Privilege Escalation Exploit

Local attackers can gain root privileges if exim binaries are installed in the system and perl_startup is used within the Exim config. Full advisory/poc exploit can be found at:

http://legalhackers.com/advisories/Exim-Local-Root-Privilege...