Important: Red Hat Security Advisory: Updated IA64 kernel packages address security vulnerabilities, bugfixes

Updated kernel packages that address several security vulnerabilites, fix a number of bugs, and update various drivers are now available. The Linux kernel handles the basic functions of the operating system. A flaw in bounds checking in the dobrk function in the Linux kernel versions 2.4.22 and...

stunnel file descriptors leak

Child process has access to critical descriptors...

PT-2003-1958 · Sco · Open Unix +1

Name of the Vulnerable Software and Affected Versions: SCO UnixWare versions 7.1.1, 7.1.3 Open UNIX version 8.0.0 Description: The issue allows local users to bypass protections for the address space file for a process ID by obtaining a procfs file descriptor for the file and calling execve on a...

CVE-2003-0740

Stunnel 4.00, and 3.24 and earlier, leaks a privileged file descriptor returned by listen, which allows local users to hijack the Stunnel server...

CVE-2003-0740

Stunnel 4.00, and 3.24 and earlier, leaks a privileged file descriptor returned by listen, which allows local users to hijack the Stunnel server...

DEBIAN-CVE-2003-0740

Stunnel 4.00, and 3.24 and earlier, leaks a privileged file descriptor returned by listen, which allows local users to hijack the Stunnel server...

FreeBSD Security Advisory FreeBSD-SA-03:16.filedesc

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-03:16.filedesc Security Advisory The FreeBSD Project Topic: file descriptor leak in readv Category: core Module: kernel Announced: 2003-10-02 Credits: Joost Pol...

FreeBSD-SA-03:16.filedesc

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-03:16.filedesc Security Advisory The FreeBSD Project Topic: file descriptor leak in readv Category: core Module: kernel Announced: 2003-10-02 Credits: Joost Pol...

CVE-2003-0740

Stunnel 4.00, and 3.24 and earlier, leaks a privileged file descriptor returned by listen, which allows local users to hijack the Stunnel server...

CVE-2003-0740

Stunnel versions 4.00 and 3.24 and earlier are vulnerable due to leaking a privileged file descriptor returned by listen(), enabling local users to hijack the stunnel server. The issue is described across multiple advisories (Mandrake, Red Hat, SUSE) and CVE-2003-0740, with remediation guidance t...

CVE-2003-0740

Stunnel 4.00, and 3.24 and earlier, leaks a privileged file descriptor returned by listen, which allows local users to hijack the Stunnel server...

Stunnel-3.x Daemon Hijacking

Product: Stunnel Versions: = 3.24, 4.00 URL: http://stunnel.mirt.net Impact: Daemon Hijacking Bug class: Leaked Descriptor Vendor notified: Yes Fix available: Yes Date: 09/03/03 Issue: ====== Stunnel leaks a critical file descriptor that can be used to takeover hijack stunnel's service. Details:...

CVE-2003-0740: Undefined Security Weakness

Stunnel 4.00, and 3.24 and earlier, leaks a privileged file descriptor returned by listen, which allows local users to hijack the Stunnel server...

CVE-2003-0489

tcptraceroute 1.4 and earlier does not fully drop privileges after obtaining a file descriptor for capturing packets, which may allow local users to gain access to the descriptor via a separate vulnerability in tcptraceroute...

Apache < 1.3.28 Multiple Vulnerabilities (DoS, ID)

The remote host appears to be running a version of Apache which is older than 1.3.28 There are several flaws in this version, including a denial of service in redirect handling, a denial of service with control character handling in the 'rotatelogs' utility and a file descriptor leak in third-par...

CVE-2003-0489

CVE-2003-0489 applies to tcptraceroute 1.4 and earlier, where the program’s privilege-dropping after obtaining a file descriptor for raw packet capture is incomplete. Several connected sources document that a local attacker could potentially access the capture descriptor via a separate vulnerabil...

CVE-2003-0476

CVE-2003-0476 affects the Linux kernel 2.4.x execve system call, where the executable’s file descriptor is recorded in the caller’s file table, enabling local users to read restricted file descriptors. Public advisories (e.g., Debian DSA-423-1, RHSA-2003:408) note this vulnerability and recommend...

CVE-2003-0489

tcptraceroute 1.4 and earlier does not fully drop privileges after obtaining a file descriptor for capturing packets, which may allow local users to gain access to the descriptor via a separate vulnerability in tcptraceroute...

CVE-2003-0489

tcptraceroute 1.4 and earlier does not fully drop privileges after obtaining a file descriptor for capturing packets, which may allow local users to gain access to the descriptor via a separate vulnerability in tcptraceroute...

Linux 2.4.x execve&#40;&#41; file read race vulnerability

Hi people, again it is time to discover a funny bug inside the Linux execve system call. Details: --------- While looking at the execve code I've found the following piece of code from fs/binfmtelf.c: static int loadelfbinarystruct linuxbinprm bprm, struct ptregs regs struct file interpreter =...