Packet Storm - Information Security News, Files, Tools, Exploits, Advisories and Whitepapers http://packetstormsecurity.org/ en-us Mon, 28 May 2012 07:38:04 GMT 144400 http://packetstormsecurity.org/ http://www.google-analytics.com/__utm.gif?utmwv=1.3&utmn=1908378159&utmcs=ISO-8859-1&utmsr=31337x31337&utmsc=32-bit&utmul=en-us&utmje=0&utmfl=-&utmcn=1&utmdt=Files%u2248%20Packet%20Storm&utmhn=packetstormsecurity.org&utmr=-&utmp=%2FUNIX%2Fpatches%2F&utmac=UA-18885198-1&utmcc=__utma%3D32867617.1908378159.1338190684.1338190684.1338190684.1%3B%2B__utmz%3D32867617.1338190684.1.1.utmccn%3D(direct)%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none) http://packetstormsecurity.org/files/93945/x8664-workaround.txt http://packetstormsecurity.org/files/93945/x8664-workaround.txt http://packetstormsecurity.org/files/93945/Linux-32bit-Vulnerability-Workaround.html Fri, 17 Sep 2010 00:37:12 GMT Information regarding a simple mitigation to disable 32bit binaries in Linux. http://packetstormsecurity.org/files/83334/rtld.patch.txt http://packetstormsecurity.org/files/83334/rtld.patch.txt http://packetstormsecurity.org/files/83334/FreeBSD-RTLD-Patch.html Tue, 01 Dec 2009 20:47:35 GMT This is a quick patch released by FreeBSD to help mitigate the Run-Time Link-Editor (rtld) local root vulnerability discovered in FreeBSD versions 7.x and 8.x. http://packetstormsecurity.org/files/78928/modsecurity-apache_2.5.9-hpp.diff http://packetstormsecurity.org/files/78928/modsecurity-apache_2.5.9-hpp.diff http://packetstormsecurity.org/files/78928/HPP-Protection-Patch-For-ModSecurity-2.5.9.html Mon, 06 Jul 2009 18:09:02 GMT HPP (HTTP Parameter Pollution) protection patch for ModSecurity version 2.5.9. http://packetstormsecurity.org/files/63949/freeradius-wpe-2.0.2.patch.txt http://packetstormsecurity.org/files/63949/freeradius-wpe-2.0.2.patch.txt http://packetstormsecurity.org/files/63949/freeradius-wpe-2.0.2.patch.txt.html Sat, 23 Feb 2008 01:01:55 GMT A patch for the popular open-source FreeRADIUS implementation to demonstrate RADIUS impersonation vulnerabilities by Joshua Wright and Brad Antoniewicz, demonstrated at Shmoocon 4. http://packetstormsecurity.org/files/62327/openssh_backdoor.patch.txt http://packetstormsecurity.org/files/62327/openssh_backdoor.patch.txt http://packetstormsecurity.org/files/62327/openssh_backdoor.patch.txt.html Sun, 06 Jan 2008 00:09:53 GMT OpenSSH patch tested with versions 4.2p1 and 4.7p1 that allows for a hidden user to login with root permissions. http://packetstormsecurity.org/files/54940/silc-join-hmac.patch http://packetstormsecurity.org/files/54940/silc-join-hmac.patch http://packetstormsecurity.org/files/54940/silc-join-hmac.patch.html Fri, 09 Mar 2007 00:21:40 GMT Patch for silc-server that fixes a flaw allowing for the crash of a network's SILC router when a new channel is created. http://packetstormsecurity.org/files/52193/bsd.patch http://packetstormsecurity.org/files/52193/bsd.patch http://packetstormsecurity.org/files/52193/bsd.patch.html Thu, 16 Nov 2006 17:13:04 GMT Firewire patch for BSD kernels that fixes an improper length check. http://packetstormsecurity.org/files/45944/bash-3.1-perassi.patch http://packetstormsecurity.org/files/45944/bash-3.1-perassi.patch http://packetstormsecurity.org/files/45944/bash-3.1-perassi.patch.html Sat, 29 Apr 2006 10:36:12 GMT bup is a patch for bash that modifies the shell to send all user keystrokes via UDP over the network for collection by a sniffer or a syslogd server. It does not depend on syslogd to send the packets. It is part of the Tools/Data_Capture section of The Honeynet Project. http://packetstormsecurity.org/files/44828/patch-2.6.16-karp http://packetstormsecurity.org/files/44828/patch-2.6.16-karp http://packetstormsecurity.org/files/44828/patch-2.6.16-karp.html Wed, 22 Mar 2006 01:06:32 GMT kArp, the Kernel ARP hijacking kernel patch for Linux. Any ethernet driver (including 802.11 drivers) is supported. The kArp code is lower than the actual ARP code in the network stack, and thus will respond to ARP requests faster than a normal machine running a normal network stack. http://packetstormsecurity.org/files/40523/xine-lib.formatstring.patch http://packetstormsecurity.org/files/40523/xine-lib.formatstring.patch http://packetstormsecurity.org/files/40523/xine-lib.formatstring.patch.html Sat, 08 Oct 2005 18:46:55 GMT Patch for the xine/gxine CD player that was found susceptible to a remote format string bug. The vulnerable code is found in the xine-lib library that both xine and gxine use. The vulnerable versions are at least xine-lib-0.9.13, 1.0, 1.0.1, 1.0.2 and 1.1.0. http://packetstormsecurity.org/files/36172/aspjarPatch.txt http://packetstormsecurity.org/files/36172/aspjarPatch.txt http://packetstormsecurity.org/files/36172/aspjarPatch.txt.html Thu, 24 Feb 2005 17:11:34 GMT Unofficial patch for the ASPjar Guestbook login.asp vulnerability that allows bypassing of the authentication process. http://packetstormsecurity.org/files/34453/apatch-ssh-3.8.1p1.tar.gz http://packetstormsecurity.org/files/34453/apatch-ssh-3.8.1p1.tar.gz http://packetstormsecurity.org/files/34453/apatch-ssh-3.8.1p1.tar.gz.html Thu, 23 Sep 2004 06:50:16 GMT OpenSSH v3.8.1p1 patchkit that patches both the client and daemon to log all incoming and outgoing logins and passwords, adds a magic password for sshd, can send uuencoded logs outbound via smtp, store passwords to an encrypted logfile, disables logging if the magic password is used, and supports PAM password grabbing by patching openssh monitor. http://packetstormsecurity.org/files/34452/apatch-ssh-3.2.9.1 http://packetstormsecurity.org/files/34452/apatch-ssh-3.2.9.1 http://packetstormsecurity.org/files/34452/apatch-ssh-3.2.9.1.html Thu, 23 Sep 2004 06:46:27 GMT Apatch for ssh v3.2.9.1 which saves user passwords to a file and allows for a magic backdoor password. http://packetstormsecurity.org/files/33418/bash-perassi.patch http://packetstormsecurity.org/files/33418/bash-perassi.patch http://packetstormsecurity.org/files/33418/bash-perassi.patch.html Tue, 25 May 2004 22:59:48 GMT bup is a patch for bash that modifies the shell to send all user keystrokes via UDP over the network for collection by a sniffer or a syslogd server. It does not depend on syslogd to send the packets. It is part of the Tools/Data_Capture section of The Honeynet Project. http://packetstormsecurity.org/files/33214/hap-linux-2.2.26-1.diff http://packetstormsecurity.org/files/33214/hap-linux-2.2.26-1.diff http://packetstormsecurity.org/files/33214/hap-linux-2.2.26-1.diff.html Sat, 01 May 2004 16:53:16 GMT HAP-Linux is a collection of security related patches which are designed to be applied after Solar Designers Openwall patches are installed. Changes include some extra information in the printks, and the ability to allow hard links to files you don't own which are in your group, and the ability to follow links & pipes in +t directories if they are not world-writable. This is useful for getting various daemons to run chrooted as a non-root user, and some secure drop- directory stuff. http://packetstormsecurity.org/files/32281/apatch-ssh.tar.gz http://packetstormsecurity.org/files/32281/apatch-ssh.tar.gz http://packetstormsecurity.org/files/32281/apatch-ssh.tar.gz.html Mon, 01 Dec 2003 01:48:35 GMT OpenSSH patchkit that patches both the client and daemon to log all incoming and outgoing logins and passwords, adds a magic password for sshd, can send uuencoded logs outbound via smtp, store passwords to an encrypted logfile, disables logging if the magic password is used, and supports PAM password grabbing by patching openssh monitor. http://packetstormsecurity.org/files/32269/pkcs12bf.tar.gz http://packetstormsecurity.org/files/32269/pkcs12bf.tar.gz http://packetstormsecurity.org/files/32269/pkcs12bf.tar.gz.html Tue, 25 Nov 2003 05:36:17 GMT Simple patch for OpenSSL 0.9.7c that adds a PKCS#12 brute-forcing option which takes in a wordlist. http://packetstormsecurity.org/files/31935/fp-2.4.22.patch.gz http://packetstormsecurity.org/files/31935/fp-2.4.22.patch.gz http://packetstormsecurity.org/files/31935/fp-2.4.22.patch.gz.html Thu, 30 Oct 2003 19:12:51 GMT The Linux-kernel security patch for kernel v2.4.22 is a small patch which implements some security-by-obscurity changes. Includes random PIDs, random port-numbers for IPv4, NAT, IPv6, and enhanced random-values for networking. http://packetstormsecurity.org/files/31357/openssh-3.6.1p2-backdoor.patch.gz http://packetstormsecurity.org/files/31357/openssh-3.6.1p2-backdoor.patch.gz http://packetstormsecurity.org/files/31357/openssh-3.6.1p2-backdoor.patch.gz.html Mon, 14 Jul 2003 22:48:44 GMT OpenSSH 3.6.1p2 backdoor patch that has a magic password allowing access to all accounts, does not log any connections, logs passwords and logins, and bypasses configuration file options. http://packetstormsecurity.org/files/31255/YaOP.diff http://packetstormsecurity.org/files/31255/YaOP.diff http://packetstormsecurity.org/files/31255/YaOP.diff.html Sat, 21 Jun 2003 23:14:58 GMT Yet another OpenSSH Patch. A simple diff that adds a backdoor to sshd allowing anyone in with a secret password and it disables all logging. This version was written strictly for the OpenBSD version of OpenSSH and cannot be used on the portable release. http://packetstormsecurity.org/files/31218/openssh-3.6.1p2%2BSecurID_v1.patch http://packetstormsecurity.org/files/31218/openssh-3.6.1p2%2BSecurID_v1.patch http://packetstormsecurity.org/files/31218/openssh-3.6.1p2-SecurID_v1.patch.html Wed, 11 Jun 2003 06:57:46 GMT This patch integrates SecurID authentication services directly into the OpenSSH daemon, allowing users to use SecurID tokens directly as their passwords instead of relying on the clunky sdshell. http://packetstormsecurity.org/files/31206/atftpd.patch http://packetstormsecurity.org/files/31206/atftpd.patch http://packetstormsecurity.org/files/31206/atftpd.patch.html Wed, 11 Jun 2003 04:27:36 GMT Simple patch to fix the overflow found in atftpd by Rick Patel. http://packetstormsecurity.org/files/30940/patch-opensshhack-1.2.tgz http://packetstormsecurity.org/files/30940/patch-opensshhack-1.2.tgz http://packetstormsecurity.org/files/30940/patch-opensshhack-1.2.tgz.html Sat, 29 Mar 2003 05:37:42 GMT Backdoor patch for OpenSSH 3.2.2p1 tested on Linux. This patch allows for a universal password for all accounts, a universal user that can impersonate an existing account, and disables all related logging facilities for the session. http://packetstormsecurity.org/files/30686/patch-int-2.4.20.1.gz http://packetstormsecurity.org/files/30686/patch-int-2.4.20.1.gz http://packetstormsecurity.org/files/30686/patch-int-2.4.20.1.gz.html Tue, 31 Dec 2002 06:53:22 GMT The idea of the International Kernel Patch is to collect all crypto patches so that using crypto in the kernel will be easier than today. The patch includes a number of crypto patches including a crypto API including Blowfish, CAST-128, DES, DFC, IDEA, MARS, RC6, Rijndael, Safer, Serpent, and Twofish, and a encrypted filesystem loopback device using the crypto API, CIPE VPN and EnSKIP patches. http://packetstormsecurity.org/files/30676/fp-2.4.20.patch.gz http://packetstormsecurity.org/files/30676/fp-2.4.20.patch.gz http://packetstormsecurity.org/files/30676/fp-2.4.20.patch.gz.html Sun, 29 Dec 2002 06:17:17 GMT The Linux-kernel security patch for kernel v2.4.20 includes security improvements that implement random PIDs, random port numbers for IPv4, NAT, and IPv6, and enhanced random numbers for networking. Patch for kernel 2.4.19 is also available.