Solaris 2.72.8 Catman - Local Insecure tmp Symlink

Solaris 2.72.8 Catman - Local Insecure tmp Symlink !/usr/local/bin/perl -w The problem is catman creates files in /tmp insecurly. They are based on the PID of the catman process, catman will happily clobber any files that are symlinked to that file. The idea of this script is to create a block of...

KTH Kerberos filesystem race condition on tickets stored in /tmp

Overview There may be a race condition during the creation of Kerberos ticket files in the /tmp directory. This race condition may allow intruders with local access to the system to gain root privileges. Description During the creation of ticket files in the /tmp directory, a sequence of calls...

CVE-2000-1156: Undefined Security Weakness

StarOffice 5.2 follows symlinks and sets world-readable permissions for the /tmp/soffice.tmp directory, which allows a local user to read files of the user who is using StarOffice...

Slackware Linux - usrbinppp-off Insecure tmp Call

Slackware Linux - usrbinppp-off Insecure tmp Call !/bin/sh In SlackWare Linux the script /usr/bin/ppp-off writes the output of 'ps x' to /tmp/grep.tmp. Since root is the user that runs ppp-off, a non-privileged user could create a link from /tmp/grep.tmp to any fileie: /etc/issue, thus when root...

Slackware Linux - '/usr/bin/ppp-off' Insecure /tmp Call

!/bin/sh In SlackWare Linux the script /usr/bin/ppp-off writes the output of 'ps x' to /tmp/grep.tmp. Since root is the user that runs ppp-off, a non-privileged user could create a link from /tmp/grep.tmp to any fileie: /etc/issue, thus when root runs the ppp-off script, the output of 'ps x' woul...

DoS через AnswerBook 2

При некоторых условиях не удаляются временные файлы, что приводит к переполнению /tmp...

CVE-2000-0718

A race condition in MandrakeUpdate allows local users to modify RPM files while they are in the /tmp directory before they are installed...

CVE-2000-0718

A race condition in MandrakeUpdate allows local users to modify RPM files while they are in the /tmp directory before they are installed...

CVE-2000-0718: Undefined Security Weakness

A race condition in MandrakeUpdate allows local users to modify RPM files while they are in the /tmp directory before they are installed...

CVE-2000-0458: Undefined Security Weakness

The MSWordView application in IMP creates world-readable files in the /tmp directory, which allows other local users to read potentially sensitive information...

CVE-2000-0723

The CVE-2000-0723 entry concerns Helix GNOME Updater (helix-update) version 0.5 and earlier, where improper handling of /tmp leads to local users creating empty system configuration files (e.g., /etc/config.d/bashrc, /etc/config.d/csh.cshrc, /etc/rc.config). This vulnerability arises from inadequ...

012.txt

From [email protected] Wed Aug 2 11:08:46 2000 Return-Path: Date: Mon, 2 Aug 0100 11:56:57 +0000 Reply-To: [email protected] Sender: Bugtraq List From: [email protected] Subject: Local root compromise in PGX Config Sun Sparc Solaris To: [email protected] hi guys and gals yeah heres...

CVE-2000-0578

SGI MIPSPro compilers (C, C++, F77, F90) populate /tmp with predictable temporary file names. This allows a local attacker to modify contents of those files while a build is performed by another user, as described in CVE-2000-0578. The vulnerability stems from how temporary files are created duri...

CVE-2000-0363

Linux cdwtools 093 and earlier contain a local privilege escalation vulnerability: local users can gain root privileges via the /tmp directory. The issue is described across CVE-2000-0363 records and NVD, with a base score of 6.2 (MEDIUM). Exploitation details are not provided in the supplied doc...

CVE-2000-0363: Undefined Security Weakness

Linux cdwtools 093 and earlier allows local users to gain root privileges via the /tmp directory...

CVE-2000-0433: Undefined Security Weakness

The SuSE aaabase package installs some system accounts with home directories set to /tmp, which allows local users to gain privileges to those accounts by creating standard user startup scripts such as profiles...

Possible symlink problems with Netscape 4.73

It appears that Netscape 4.73 and earlier versions incorrectly creates a temporary file in '/tmp' when importing certificates: ... open"/tmp/tmp3919AA5000A07DC", OWRONLY|OCREAT|OTRUNC, 0666 = 25 fchmod25, 0600 = 0 fstat25, stmode=0,stsize=0, ... = 0 ... Netscape doesn't try to stat/lstat the file...

Netscape Communicator 4.5/4.51/4.6/4.61/4.7/4.72/4.73 - '/tmp' Symlink

source: https://www.securityfocus.com/bid/1201/info Netscape Communicator version 4.73 and prior may be susceptible to a /tmp file race condition when importing certificates. Netscape creates a /tmp file which is world readable and writable in /tmp, without calling stat or fstat on the file. As...

CVE-2000-0293

aaabase in SuSE Linux 6.3, and cron.daily in earlier versions, allow local users to delete arbitrary files by creating files whose names include spaces, which are then incorrectly interpreted by aaabase when it deletes expired files from the /tmp directory...

CVE-2000-0458

The MSWordView application in IMP creates world-readable files in the /tmp directory, which allows other local users to read potentially sensitive information...