658 matches found
Debian glibc 2 symlink issue could allow arbitrary file overwriting
Overview Some versions of ld.so, the loader for shared libraries in UNIX/LINUX, do not properly clear risky environment variables, allowing a symlink attack to overwrite arbitrary files. Description LDDEBUGOUTPUT specifies a directory in which ld.so creates a file with a predictable name based on...
CVE-2001-1010
Directory traversal vulnerability in pagecount CGI script in Sambar Server before 5.0 beta 5 allows remote attackers to overwrite arbitrary files via a .. dot dot attack on the page parameter...
CVE-2001-1177
ml85p in Samsung ML-85G GDI printer driver before 0.2.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files...
CVE-2001-1269
Info-ZIP UnZip 5.42 and earlier allows attackers to overwrite arbitrary files during archive extraction via filenames in the archive that begin with the '/' slash character...
CVE-2001-1270
Directory traversal vulnerability in the console version of PKZip pkzipc 4.00 and earlier allows attackers to overwrite arbitrary files during archive extraction with the -rec recursive option via a .. dot dot attack on the archived files...
Lmail 2.7 - Temporary File Race Condition
// source: https://www.securityfocus.com/bid/2984/info Jon Zeeff's lmail is a local mail delivery agent LDA designed to provide mail-to-pipe and mail-to-file aliasing for smail. A race condition vulnerability exists in lmail. The lmail program makes insecure use of temporary files, making it...
CVE-2001-1162
Directory traversal vulnerability in the %m macro in the smb.conf configuration file in Samba before 2.2.0a allows remote attackers to overwrite certain files via a .. in a NETBIOS name, which is used as the name for a .log file...
KDE KTVision 0.1 - File Overwrite
source: https://www.securityfocus.com/bid/2913/info KTVision works with frame-grabber cards and KDE Unix K Desktop Environment to support TV video display on the PC screen. KTVision is vulnerable to symbolic link attacks. It is possible for an attacker to anticipate the expected name of a KTVisio...
[eyeonsecurity.net] Incredimail allows automatic over writing offiles on your hard disk
Advisory Title: Incredimail allows automatic over writing of files on your hard disk Release Date: 05/08/2001 Application: Incredimail Platform: Windows NT4 Windows 2000 Windows 9x/me Build: 1400185 .. possibly earlier builds as well Severity: Malicious users can easily over write system files...
CVE-2001-0138
CVE-2001-0138 affects wu-ftpd; the privatepw helper allows a local user to overwrite arbitrary files via a symlink attack in wu-ftpd before version 2.6.1-6. The issue stems from a temporary file handling weakness. Mitigation: upgrade wu-ftpd to 2.6.1-6 or newer (as reflected in Debian/Mandrake ad...
CVE-2001-0109
rctab in SuSE 7.0 and earlier allows local users to create or overwrite arbitrary files via a symlink attack on the rctmp temporary file...
CVE-2001-1331
mandb in the man-db package before 2.3.16-3 allows local users to overwrite arbitrary files via the command line options 1 -u or 2 -c, which do not drop privileges and follow symlinks...
SuSE 7.0 - KFM Insecure .TMP File Creation
SuSE 7.0 - KFM Insecure .TMP File Creation source: https://www.securityfocus.com/bid/2629/info KFM is the KDE File Manager, included with version 1 of the KDE base package in most Linux installations. KFM is designed as a graphical, easily navigated interface to the Linux Filesystem. A problem wi...
SuSE 7.0 - KFM Insecure '.TMP' File Creation
source: https://www.securityfocus.com/bid/2629/info KFM is the KDE File Manager, included with version 1 of the KDE base package in most Linux installations. KFM is designed as a graphical, easily navigated interface to the Linux Filesystem. A problem with KFM could allow the overwriting of files...
MySQL 3.20.32 a3.23.34 - Root Operation Symbolic Link File Overwriting
MySQL 3.20.32 a3.23.34 - Root Operation Symbolic Link File Overwriting source: https://www.securityfocus.com/bid/2522/info MySQL is a relational database management system RDBMS, freely available and open source. It is maintained by MySQL AB. A problem with the implementation of some MySQL...
MySQL 3.20.32 a/3.23.34 - Root Operation Symbolic Link File Overwriting
source: https://www.securityfocus.com/bid/2522/info MySQL is a relational database management system RDBMS, freely available and open source. It is maintained by MySQL AB. A problem with the implementation of some MySQL databases may permit local users to overwrite sensitive system files. This...
FreeBSD-SA-01:17.exmh
-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:17 Security Advisory FreeBSD, Inc. Topic: exmh symlink vulnerability Category: ports Module: exmh2 Announced: 2001-01-29 Credits: Stanley G. Bubrouski Affects: Ports...
CVE-2000-0959
CVE-2000-0959 concerns glibc2/ld.so: the loader does not clear LD_DEBUG_OUTPUT and LD_DEBUG before invoking programs from a setuid context. This can enable a local attacker to exploit a symlink to overwrite arbitrary files. Concrete details exist in CERT/CC reports (Debian advisory) describing th...
Race condition in periodic
Overview A race condition in the 'periodic' script allows local files to be overwritten. We believe that 'periodic' is typically used only with FreeBSD systems, though it may be installed on other systems. Description 'periodic' is a script used in conjunction with cron to execute jobs at specifi...