CVE-2009-4490: Improper Input Validation

minihttpd 1.19 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator...

CVE-2009-4496: Improper Input Validation

Boa 0.94.14rc21 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator...

CVE-2009-4489: Improper Input Validation

header.c in Cherokee before 0.99.32 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal...

CVE-2009-4491

thttpd 2.25b0 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator...

CVE-2009-4491

thttpd 2.25b0 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator...

PT-2010-1346 · Varnish +1 · Varnish +1

Name of the Vulnerable Software and Affected Versions: Varnish version 2.0.6 Description: The issue arises from Varnish writing data to a log file without sanitizing non-printable characters. This could potentially allow remote attackers to modify a window's title or possibly execute arbitrary...

CVE-2009-4492: Undefined Security Weakness

WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrar...

CVE-2009-4487: Undefined Security Weakness

nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator...

CVE-2009-4491

The thttpd 2.25b0 web server is vulnerable to a command injection flaw because it fails to sanitize non-printable characters in user-supplied input before writing to log files. A remote attacker can exploit this by sending an HTTP request containing terminal escape sequences , which may allow the...

CentOS 5 : acpid (CESA-2009:1642)

An updated acpid package that fixes one security issue is now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. acpid is a daemon that dispatches ACPI Advanced Configuration and Power Interface events to...

acpid weak file permission

Log file is created world readable...

DSA-1960-1 acpid - weak file permissions

Bulletin has no description...

CVE-2009-4334: Undefined Security Weakness

The Self Tuning Memory Manager STMM component in IBM DB2 9.1 before FP8, 9.5 before FP5, and 9.7 before FP1 uses 0666 permissions for the STMM log file, which allows local users to cause a denial of service or have unspecified other impact by writing to this file...

CVE-2009-3554

Twiddle in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 writes the JMX password, and other command-line arguments, to the twiddle.log file, which allows local users to obtain sensitive information by reading this file...

Red Hat acpid '/var/log/acpid'日志文件权限本地特权提升漏洞

Bugraq ID: 37249 CVE ID：CVE-2009-4033 Red Hat是一款流行的linux发行版本。 Red Hat Enterprise Linux 5包含的acpid以不安全权限建立日志文件/var/log/acpid。问题是由于使用OCREAT标记调用时open没有使用第三个参数，结果导致日志文件以全局可写建立，并设置setuid / setgid位，允许特权提升。 RedHat Enterprise Linux Desktop 5 client RedHat Enterprise Linux 5 server 用户可参考如下安全公告获得补丁信息：...

RedHat Security Advisory RHSA-2009:1642

The remote host is missing updates announced in advisory RHSA-2009:1642. acpid is a daemon that dispatches ACPI Advanced Configuration and Power Interface events to user-space programs. It was discovered that acpid could create its log file /var/log/acpid with random permissions on some systems. ...

JBoss EAP Twiddle logs the JMX password

Twiddle in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 writes the JMX password, and other command-line arguments, to the twiddle.log file, which allows local users to obtain sensitive information by reading this file...

CVE-2009-4235

acpid 1.0.4 sets an unrestrictive umask, which might allow local users to leverage weak permissions on /var/log/acpid, and obtain sensitive information by reading this file or cause a denial of service by overwriting this file, a different vulnerability than CVE-2009-4033...

To modify log file properties protect yourself will not be the administrator found-vulnerability warning-the black bar safety net

The log file location is actually stored in the registry,as long as we modify its attributes to mask their intrusion traces, Here only modify the default location,the log size of the property,such as log size 0 0 0 0 0 0 0 1,so that it can not be normal recording, So if you can perfect guarantee...

To modify log file properties protect yourself will not be the administrator found that(idea)-bug warning-the black bar safety net

by ha0k The log file location is actually stored in the registry, as long as we modify its attributes to mask their intrusion traces, here just modify the default location, the log size of the property, such as log size 0 0 0 0 0 0 0 1,so that it can not be normal recording, so it can be perfect ...