Fedora Core 10 FEDORA-2009-6557 (moin)

The remote host is missing an update to moin announced via advisory FEDORA-2009-6557. OpenVAS Vulnerability Test $Id: fcore20096557.nasl 6624 2017-07-10 06:11:55Z cfischer $ Description: Auto-generated from advisory FEDORA-2009-6557 moin Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft...

Uninitialized read of a data value

Description The smbd daemon in Samba 3.0.31 - 3.3.5 contains an uninitialized read of a data value that can potentially affect access control. If a user is trying to modify an access control list ACL and is denied permission, this deny may be overridden if the parameter "dos filemode" is set to...

Fedora 9 : moin-1.6.4-2.fc9 (2009-6559)

This update includes a security fix for a hierarchical ACL vulnerability hierarchical is not the default ACL mode, http://moinmo.in/SecurityFixes has the details of the fix. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory...

Fedora 11 : moin-1.8.4-1.fc11 (2009-6576)

This package updates Moin to 1.8.4, http://moinmo.in/MoinMoinRelease1.8 has a list of changes. This package includes a security fix for a hierarchical ACL vulnerability hierarchical is not the default ACL mode, http://moinmo.in/SecurityFixes has the details of the fix. Note that Tenable Network...

Microsoft IIS 5.0 WebDAV绕过认证漏洞(MS09-020)

BUGTRAQ ID: 35232 CVECAN ID: CVE-2009-1122 Microsoft Internet信息服务（IIS）是Microsoft Windows自带的一个网络信息服务器，其中包含HTTP服务功能。 IIS的WebDAV扩展没有正确解码特制请求的URL，导致WebDAV在处理该请求时应用不正确的配置。如果应用的配置允许匿名访问，则特制的请求可以绕过身份验证。 请注意IIS在配置的匿名用户帐户的安全上下文中仍会处理该请求，因此此漏洞不能用于绕过NTFS ACL，文件系统ACL对匿名用户帐户强加的限制将仍然执行。 Microsoft IIS 5.0 临时解决方法...

Microsoft Windows线程池ACL本地权限提升漏洞（MS09-012）

BUGTRAQ ID: 34444 CVECAN ID: CVE-2009-0080 Microsoft Windows是微软发布的非常流行的操作系统。 Windows对当前ThreadPool中的线程设置了错误的ACL，本地攻击者可以利用令牌劫持的方式获得权限提升。成功利用此漏洞的攻击者可以完全控制受影响的系统，攻击者可随后安装程序；查看、更改或删除数据；或者创建拥有完全用户权限的新帐户。 Microsoft Windows Vista SP1 Microsoft Windows Vista Microsoft Windows Server 2008 临时解决方法： IIS 6.0 -...

Mandriva Linux Security Advisory : dovecot (MDVSA-2008:232)

The ACL plugin in dovecot prior to version 1.1.4 treated negative access rights as though they were positive access rights, which allowed attackers to bypass intended access restrictions CVE-2008-4577. The ACL plugin in dovecot prior to version 1.1.4 allowed attackers to bypass intended access...

FreeBSD : squid ACL bypass due to URL decoding bug (705e003a-7f36-11d8-9645-0020ed76ef5a)

From the Squid advisory : Squid versions 2.5.STABLE4 and earlier contain a bug in the '%xx' URL decoding function. It may insert a NUL character into decoded URLs, which may allow users to bypass urlregex ACLs. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

FreeBSD : moinmoin -- ACL group bypass (1ecf4ca1-f7ad-11d8-96c9-00061bc2ad93)

The moinmoin package contains two bugs with ACLs and anonymous users. Both bugs may permit anonymous users to gain access to administrative functions; for example the delete function. There is no known workaround, the vulnerability exists regardless if a site is using ACLs or not. %NASLMINLEVEL...

FreeBSD : proftpd IP address access control list breakage (cb6c6c29-9c4f-11d8-9366-0020ed76ef5a)

Jindrich Makovicka reports a regression in proftpd's handling of IP address access control lists IP ACLs. Due to this regression, some IP ACLs are treated as allow all''. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted fro...

CVE-2009-0080

The ThreadPool class in Windows Vista Gold and SP1, and Server 2008, does not properly implement isolation among a set of distinct processes that 1 all run under the NetworkService account or 2 all run under the LocalService account, which allows local users to gain privileges by leveraging...

CVE-2009-0080

The ThreadPool class in Windows Vista Gold and SP1, and Server 2008, does not properly implement isolation among a set of distinct processes that 1 all run under the NetworkService account or 2 all run under the LocalService account, which allows local users to gain privileges by leveraging...

Microsoft Windows Vista2008 - Thread Pool ACL Privilege Escalation

Microsoft Windows Vista2008 - Thread Pool ACL Privilege Escalation source: https://www.securityfocus.com/bid/34444/info Microsoft Windows is prone to a privilege-escalation vulnerability. Successful exploits may allow attackers to elevate their privileges to LocalSystem, which would facilitate th...

Microsoft Windows Vista/2008 - Thread Pool ACL Privilege Escalation

source: https://www.securityfocus.com/bid/34444/info Microsoft Windows is prone to a privilege-escalation vulnerability. Successful exploits may allow attackers to elevate their privileges to LocalSystem, which would facilitate the complete compromise of affected computers. The issue affects the...

Cisco PIX/ASA拒绝服务，ACL绕过及验证绕过漏洞

安全公告 月度Top10安全漏洞 每日漏洞播报 Cisco PIX/ASA拒绝服务，ACL绕过及验证绕过漏洞 发布时间：2009-04-09 录入：启明星辰 BUGTRAQ ID: 34429 CVE ID：CVE-2009-1155 CVE-2009-1156 CVE-2009-1157 CVE-2009-1158 CVE-2009-1159 CVE-2009-1160 CNCVE ID：CNCVE-20091155 CNCVE-20091156 CNCVE-20091157 CNCVE-20091158 CNCVE-20091159 CNCVE-20091160 Cisco...

Mandriva Update for bind MDKA-2007:090 (bind)

Check for the Version of bind OpenVAS Vulnerability Test Mandriva Update for bind MDKA-2007:090 bind Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the term...

Mandriva Update for dovecot MDVSA-2008:232 (dovecot)

Check for the Version of dovecot OpenVAS Vulnerability Test Mandriva Update for dovecot MDVSA-2008:232 dovecot Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...

Mandriva Update for dovecot MDVSA-2008:232 (dovecot)

Check for the Version of dovecot OpenVAS Vulnerability Test Mandriva Update for dovecot MDVSA-2008:232 dovecot Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...

Design/Logic Flaw

MoinMoin 1.6.2 and 1.7 does not properly enforce ACL checks when aclhierarchic is set to True, which might allow remote attackers to bypass intended access restrictions, a different vulnerability than CVE-2008-1937...

CVE-2008-6603

MoinMoin 1.6.2 and 1.7 does not properly enforce ACL checks when aclhierarchic is set to True, which might allow remote attackers to bypass intended access restrictions, a different vulnerability than CVE-2008-1937...