HP HP-UX 10.2011.0 IBM AIX 4.3 SCO Unixware 7.0 Sun Solaris 2.6 - Change File Permission

HP HP-UX 10.2011.0 IBM AIX 4.3 SCO Unixware 7.0 Sun Solaris 2.6 - Change File Permission source: https://www.securityfocus.com/bid/131/info Due to improper checking of ownership, the dtappgather utility shipped with the Common Desktop Environment allows arbitrary users to overwrite any file prese...

SCOUNIX_shadow_exploit.txt

Greetings, Any user may overwrite any file with group auth i.e. /etc/shadow, /etc/passwd using /etc/sysadm.d/bin/userOsa. Note that this will not change the permissions of the file or allow for the user to input a passwd entry string into these files, it will simply clobber the contents of the fi...

SCO Open Server 5.0.5 - 'userOsa' Symlink

source: https://www.securityfocus.com/bid/701/info Under certain versions of SCO OpenServer there exists a symlink vulnerability which can be exploited to overwrite any file which is group writable by the 'auth' group. The problem in particular is in the the /etc/sysadm.d/bin/userOsa executable...

SCO Open Server 5.0.5 - userOsa Symlink

SCO Open Server 5.0.5 - userOsa Symlink source: https://www.securityfocus.com/bid/701/info Under certain versions of SCO OpenServer there exists a symlink vulnerability which can be exploited to overwrite any file which is group writable by the 'auth' group. The problem in particular is in the th...

CVE-1999-0277

CVE-1999-0277 concerns the WorkMan program, where the vulnerability allows an attacker to overwrite arbitrary files, potentially gaining root access. The connected documents consistently describe the issue as an ability to overwrite files to escalate privileges to root. Specific affected versions...

CVE-1999-0424

talkback in Netscape 4.5 allows a local user to overwrite arbitrary files of another user whose Netscape crashes...

CVE-1999-0320

SunOS rpc.cmsd allows attackers to obtain root access by overwriting arbitrary files...

CVE-1999-0190

The connected documents confirm CVE-1999-0190 affects Solaris rpcbind, where the vulnerable component (rpcbind) can be exploited to overwrite arbitrary files and gain root access. The materials do not provide version details, exploit vectors, or remediation steps. There is no information on explo...

CVE-1999-0164

CVE-1999-0164 involves a race condition in the Solaris ps command that can allow an attacker to overwrite critical files. The available documents identify the affected component as the Solaris ps utility and describe the root cause as a race condition, with the impact stated as potential modifica...

CVE-1999-0320

CVE-1999-0320 affects SunOS where the rpc.cmsd service is able to overwrite arbitrary files, enabling an attacker to obtain root access. The vulnerability is described as a remote, unauthenticated issue with high impact (COMPLETE confidentiality, integrity, and availability impacts) and a CVSS v2...

CVE-1999-0132

CVE-1999-0132 describes a local privilege escalation in Expreserve used by vi and ex, where local users can overwrite arbitrary files and gain root access. The connected documents confirm the affected components (vi/ex and Expreserve) and the outcome, but do not provide the underlying root cause ...

CVE-1999-0049

Csetup under IRIX allows arbitrary file creation or overwriting...

CVE-1999-0191

IIS newdsn.exe CGI script allows remote users to overwrite files...

CVE-1999-0133

fmfls license server for Adobe Framemaker allows local users to overwrite arbitrary files and gain root access...

CVE-1999-0424

The CVE-1999-0424 entry concerns Netscape 4.5’s talkback feature, allowing a local user to overwrite arbitrary files of another user when Netscape crashes. Affected software: Netscape 4.5; Vulnerable component/behavior: talkback causing local file overwrite after crash. Impact: partial confidenti...

CVE-1999-0132

Expreserve, as used in vi and ex, allows local users to overwrite arbitrary files and gain root access...

"mirror" directory traversal

mirror is a Perl script which is widely used for making copy of remote FTP site. It's included in FreeBSD packages. There are security holes, which allows overwrite local files from remote ftp site with permissions of the user who uses mirror. Then retrieving directory listing mirror doesn't chec...

Sendmail decode Alias Arbitrary File Overwrite

The remote SMTP server seems to pipe mail sent to the 'decode' alias to a program. There have been in the past a lot of security problems regarding this, as it would allow an attacker to overwrite arbitrary files on the remote server. We suggest you deactivate this alias. C Tenable Network...

Sendmail RCPT TO Command Arbitrary File Overwrite

The remote SMTP server did not complain when issued the command : MAIL FROM: root@thishost RCPT TO: /tmp/nessustest This probably means that it is possible to send mail directly to files, which is a serious threat, since this allows anyone to overwrite any file on the remote server. This security...

Microsoft Internet Explorer 5 - ActiveX Object For Constructing Type Libraries For Scriptlets File Write

Microsoft Internet Explorer 5 - ActiveX Object For Constructing Type Libraries For Scriptlets File Write Microsoft Internet Explorer 5.0 for Windows 95/Windows 98/Windows NT 4 ActiveX "Object for constructing type libraries for scriptlets" Vulnerability source:...