CVE-2003-0489

tcptraceroute 1.4 and earlier does not fully drop privileges after obtaining a file descriptor for capturing packets, which may allow local users to gain access to the descriptor via a separate vulnerability in tcptraceroute...

Apache < 1.3.28 Multiple Vulnerabilities (DoS, ID)

The remote host appears to be running a version of Apache which is older than 1.3.28 There are several flaws in this version, including a denial of service in redirect handling, a denial of service with control character handling in the 'rotatelogs' utility and a file descriptor leak in third-par...

CVE-2003-0489

CVE-2003-0489 applies to tcptraceroute 1.4 and earlier, where the program’s privilege-dropping after obtaining a file descriptor for raw packet capture is incomplete. Several connected sources document that a local attacker could potentially access the capture descriptor via a separate vulnerabil...

CVE-2003-0476

CVE-2003-0476 affects the Linux kernel 2.4.x execve system call, where the executable’s file descriptor is recorded in the caller’s file table, enabling local users to read restricted file descriptors. Public advisories (e.g., Debian DSA-423-1, RHSA-2003:408) note this vulnerability and recommend...

CVE-2003-0489

tcptraceroute 1.4 and earlier does not fully drop privileges after obtaining a file descriptor for capturing packets, which may allow local users to gain access to the descriptor via a separate vulnerability in tcptraceroute...

CVE-2003-0489

tcptraceroute 1.4 and earlier does not fully drop privileges after obtaining a file descriptor for capturing packets, which may allow local users to gain access to the descriptor via a separate vulnerability in tcptraceroute...

Linux 2.4.x execve&#40;&#41; file read race vulnerability

Hi people, again it is time to discover a funny bug inside the Linux execve system call. Details: --------- While looking at the execve code I've found the following piece of code from fs/binfmtelf.c: static int loadelfbinarystruct linuxbinprm bprm, struct ptregs regs struct file interpreter =...

Xinetd 2.3.10 Memory Leaks

BACKGROUND ----------- Xinetd is a popular inetd replacement. Shortly after the 2.3.9 release in September 2002, it was realized that xinetd was leaking file descriptors. That problem turned out to be that file descriptors were not always being closed whenever a connection was rejected. 2.3.10 wa...

CVE-2002-0766

CVE-2002-0766 affects OpenBSD 2.9–3.1. Local users can exhaust the kernel’s file descriptor table and gain root by filling fds and closing 0, 1, or 2 before executing a privileged process, in a scenario not correctly handled when an alternate descriptor cannot be opened. The issue is a race in fd...

CVE-2002-1500

Buffer overflow in 1 mrinfo, 2 mtrace, and 3 pppd in NetBSD 1.4.x through 1.6 allows local users to gain privileges by executing the programs after filling the file descriptor tables, which produces file descriptors larger than FDSETSIZE, which are not checked by FDSET...

CVE-2002-0871

xinetd 2.3.4 leaks file descriptors for the signal pipe to services that are launched by xinetd, which could allow those services to cause a denial of service via the pipe...

CVE-2002-0871

xinetd 2.3.4 leaks file descriptors for the signal pipe to services that are launched by xinetd, which could allow those services to cause a denial of service via the pipe...

CVE-2002-0871

CVE-2002-0871 concerns xinetd 2.3.4, which leaks file descriptors for the signal pipe into services started by xinetd, enabling a potential DoS via the pipe. Public incident details across multiple vendors confirm this flaw and provide remediation paths: Debian’s DSA-151-1/woody fix to 2.3.4-1.2 ...

CVE-2002-0638: Undefined Security Weakness

setpwnam.c in the util-linux package, as included in Red Hat Linux 7.3 and earlier, and other operating systems, does not properly lock a temporary file when modifying /etc/passwd, which may allow local users to gain privileges via a complex race condition that uses an open file descriptor in...

CVE-2002-0766: Undefined Security Weakness

OpenBSD 2.9 through 3.1 allows local users to cause a denial of service resource exhaustion and gain root privileges by filling the kernel's file descriptor table and closing file descriptors 0, 1, or 2 before executing a privileged process, which is not properly handled when OpenBSD fails to ope...

CVE-2002-0871: Undefined Security Weakness

xinetd 2.3.4 leaks file descriptors for the signal pipe to services that are launched by xinetd, which could allow those services to cause a denial of service via the pipe...

CVE-2002-1500

Buffer overflow in 1 mrinfo, 2 mtrace, and 3 pppd in NetBSD 1.4.x through 1.6 allows local users to gain privileges by executing the programs after filling the file descriptor tables, which produces file descriptors larger than FDSETSIZE, which are not checked by FDSET...

FreeBSD Security Advisory FreeBSD-SA-02:44.filedesc

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-02:44.filedesc Security Advisory The FreeBSD Project Topic: file descriptor leak in fpathconf Category: core Module: kernel Announced: 2003-01-07 Credits: Joost P...

FreeBSD-SA-02:44.filedesc

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-02:44.filedesc Security Advisory The FreeBSD Project Topic: file descriptor leak in fpathconf Category: core Module: kernel Announced: 2003-01-07 Credits: Joost...

CVE-2002-1866

Simple Web Server SWS 0.0.4 through 0.1.0 does not close file descriptors for 404 error messages, which could allow remote attackers to cause a denial of service file descriptor exhaustion via multiple requests for pages that do not exist...