Solaris 2.72.8 Catman - Local Insecure tmp Symlink

Solaris 2.72.8 Catman - Local Insecure tmp Symlink !/usr/local/bin/perl -w The problem is catman creates files in /tmp insecurly. They are based on the PID of the catman process, catman will happily clobber any files that are symlinked to that file. The idea of this script is to create a block of...

Slackware Linux - usrbinppp-off Insecure tmp Call

Slackware Linux - usrbinppp-off Insecure tmp Call !/bin/sh In SlackWare Linux the script /usr/bin/ppp-off writes the output of 'ps x' to /tmp/grep.tmp. Since root is the user that runs ppp-off, a non-privileged user could create a link from /tmp/grep.tmp to any fileie: /etc/issue, thus when root...

Slackware Linux - '/usr/bin/ppp-off' Insecure /tmp Call

!/bin/sh In SlackWare Linux the script /usr/bin/ppp-off writes the output of 'ps x' to /tmp/grep.tmp. Since root is the user that runs ppp-off, a non-privileged user could create a link from /tmp/grep.tmp to any fileie: /etc/issue, thus when root runs the ppp-off script, the output of 'ps x' woul...

DoS через AnswerBook 2

При некоторых условиях не удаляются временные файлы, что приводит к переполнению /tmp...

CVE-2000-0718

A race condition in MandrakeUpdate allows local users to modify RPM files while they are in the /tmp directory before they are installed...

CVE-2000-0718

A race condition in MandrakeUpdate allows local users to modify RPM files while they are in the /tmp directory before they are installed...

CVE-2000-0723

The CVE-2000-0723 entry concerns Helix GNOME Updater (helix-update) version 0.5 and earlier, where improper handling of /tmp leads to local users creating empty system configuration files (e.g., /etc/config.d/bashrc, /etc/config.d/csh.cshrc, /etc/rc.config). This vulnerability arises from inadequ...

012.txt

From [email protected] Wed Aug 2 11:08:46 2000 Return-Path: Date: Mon, 2 Aug 0100 11:56:57 +0000 Reply-To: [email protected] Sender: Bugtraq List From: [email protected] Subject: Local root compromise in PGX Config Sun Sparc Solaris To: [email protected] hi guys and gals yeah heres...

CVE-2000-0578

SGI MIPSPro compilers (C, C++, F77, F90) populate /tmp with predictable temporary file names. This allows a local attacker to modify contents of those files while a build is performed by another user, as described in CVE-2000-0578. The vulnerability stems from how temporary files are created duri...

CVE-2000-0363

Linux cdwtools 093 and earlier contain a local privilege escalation vulnerability: local users can gain root privileges via the /tmp directory. The issue is described across CVE-2000-0363 records and NVD, with a base score of 6.2 (MEDIUM). Exploitation details are not provided in the supplied doc...

Possible symlink problems with Netscape 4.73

It appears that Netscape 4.73 and earlier versions incorrectly creates a temporary file in '/tmp' when importing certificates: ... open"/tmp/tmp3919AA5000A07DC", OWRONLY|OCREAT|OTRUNC, 0666 = 25 fchmod25, 0600 = 0 fstat25, stmode=0,stsize=0, ... = 0 ... Netscape doesn't try to stat/lstat the file...

Netscape Communicator 4.5/4.51/4.6/4.61/4.7/4.72/4.73 - '/tmp' Symlink

source: https://www.securityfocus.com/bid/1201/info Netscape Communicator version 4.73 and prior may be susceptible to a /tmp file race condition when importing certificates. Netscape creates a /tmp file which is world readable and writable in /tmp, without calling stat or fstat on the file. As...

CVE-2000-0293

aaabase in SuSE Linux 6.3, and cron.daily in earlier versions, allow local users to delete arbitrary files by creating files whose names include spaces, which are then incorrectly interpreted by aaabase when it deletes expired files from the /tmp directory...

CVE-2000-0458

The MSWordView application in IMP creates world-readable files in the /tmp directory, which allows other local users to read potentially sensitive information...

local user can delete arbitrary files on SuSE-Linux

Hello, If MAXDAYSINTMP 0 in /etc/rc.config on a SuSE-Linux system, a local user can delete arbitrary files by doing some commands like these: mkdir -p "/tmp/hhh /somedirectory" touch -t some-early-date "/tmp/hhh /somedirectory/somefile" sleep 1d The bug is in /etc/cron.daily/aaabase for SuSE...

OpenLDAP 1.2.71.2.81.2.91.2.10 - usrtmp Symlink

OpenLDAP 1.2.71.2.81.2.91.2.10 - usrtmp Symlink source: https://www.securityfocus.com/bid/1232/info A vulnerability exists in OpenLDAP as shipped with some versions of Linux, including RedHat 6.1 and 6.2, and TurboLinux 6.0.2 and earlier. OpenLDAP will create files in /usr/tmp, which is actually ...

PT-1999-1699 · Perl · Perl

Name of the Vulnerable Software and Affected Versions: Perl versions 5.004 04 and earlier Description: The issue allows local users to overwrite arbitrary files via a symlink attack on the /tmp/perl-eaXXXXX file when Perl is run with the -e option. This is due to Perl following symbolic links...

CVE-2000-0363

Linux cdwtools 093 and earlier allows local users to gain root privileges via the /tmp directory...

CVE-1999-0371

CVE-1999-0371 impacts Lynx: a local user can overwrite sensitive files via /tmp symlinks. The issue is a local-auth, race/symlink-related flaw in Lynx’s handling of /tmp, with a low base score (CVSSv2 1.2) and partial confidentiality impact. No exploit details are provided in the connected docume...

suse.6.1.tmp.symlinks.txt

Date: Wed, 2 Jun 1999 11:01:32 +0200 From: Thomas Fischbacher To: [email protected] Subject: /tmp symlink problems in SuSE Linux 6.1 I notified SuSE GmbH several weeks ago about this problem, but didn't get any response, therefore this post to Bugtraq. With SuSE Linux 6.1 there are still a few...