BlackBook - Multiple Vunerabilities

------------------------------------------------------------------ - EXPL-A-2003-015 exploitlabs.com Advisory 015 ------------------------------------------------------------------ -= BlackBook =- Donnie Werner July 11, 2003 Vunerabilitys: ---------------- 1. XSS executes JS in PHP remotely 2...

[Full-Disclosure] BlackBook - Multiple Vunerabilities

------------------------------------------------------------------ - EXPL-A-2003-015 exploitlabs.com Advisory 015 ------------------------------------------------------------------ -= BlackBook =- Donnie Werner July 11, 2003 Vunerabilitys: ---------------- 1. XSS executes JS in PHP remotely 2...

CVE-2001-1198

CVE-2001-1198 affects HP-UX 10.20 and 11.0. The vulnerability in RLPDaemon lets local users overwrite arbitrary files and gain privileges by specifying the target file in the -L option. The provided documents do not include exploit details, workaround, or confirmed patch information.

CVE-1999-1507

Sun SunOS 4.1 through 4.1.3 allows local attackers to gain root access via insecure permissions on files and directories such as crash...

Проблемы с разрешениями в Acrobate Reader под unix (weak permissions)

Файл /AdobeFnt.lst имеет разрешения 777 независимо от umask...

CVE-2000-1127

registrar in the HP resource monitor service allows local users to read and modify arbitrary files by renaming the original registrar.log log file and creating a symbolic link to the target file, to which registrar appends log information and sets the permissions to be world readable...

CVE-2000-1239

The HTTP interface of Tivoli Lightweight Client Framework LCF in IBM Tivoli Management Framework 3.7.1 sets httpdisable to zero at install time, which allows remote authenticated users to bypass file permissions on Tivoli Endpoint Configuration data files via an unspecified manipulation of log...

HP-UX 10.20 resource monitor service

Problem: on HP-UX 10.20 you can change any file on the root partition to mode 644: $ uname -sr HP-UX B.10.20 $ cd /etc/opt/resmon/log $ mv registrar.log registrar.log.orig $ ls -l /.shhistory -rw------- 1 root sys 3316 Sep 20 15:22 /.shhistory $ ln /.shhistory registrar.log $ nc hpux.example.com...

CVE-2000-0770

IIS 4.0 and 5.0 does not properly restrict access to certain types of files when their parent folders have less restrictive permissions, which could allow remote attackers to bypass access restrictions to some files, aka the "File Permission Canonicalization" vulnerability...

Заткнута дырка в IIS (File Permission Canonicalization, Web Server Folder Traversal)

При определенных условиях со специальным образом сконструированной URL доступ к файлу может быть произведен с разрешениями на директорию, вместо разрешений на файл. Кроме того, можно обратиться к любому файлу на диске используя unicode-кодирование в URL...

CVE-2000-0770

IIS 4.0 and 5.0 does not properly restrict access to certain types of files when their parent folders have less restrictive permissions, which could allow remote attackers to bypass access restrictions to some files, aka the "File Permission Canonicalization" vulnerability...

CVE-2000-0770

CVE-2000-0770 affects Microsoft IIS 4.0 and 5.0, where file permission canonicalization allows remote attackers to bypass access restrictions on certain files when parent folders have permissive permissions. The connected documents corroborate the issue as the “File Permission Canonicalization” v...

Security Bulletin (MS00-057)

Microsoft Security Bulletin MS00-057 - -------------------------------------- Patch Available for "File Permission Canonicalization" Vulnerability Originally posted: August 10, 2000 Summary ======= Microsoft has released a patch that eliminates a security vulnerability in Microsoftr Internet...

Netscape Communicator 4.5/4.51/4.6/4.61/4.7/4.72/4.73 - '/tmp' Symlink

source: https://www.securityfocus.com/bid/1201/info Netscape Communicator version 4.73 and prior may be susceptible to a /tmp file race condition when importing certificates. Netscape creates a /tmp file which is world readable and writable in /tmp, without calling stat or fstat on the file. As...

HP HP-UX 10.2011.0 IBM AIX 4.3 SCO Unixware 7.0 Sun Solaris 2.6 - Change File Permission

HP HP-UX 10.2011.0 IBM AIX 4.3 SCO Unixware 7.0 Sun Solaris 2.6 - Change File Permission source: https://www.securityfocus.com/bid/131/info Due to improper checking of ownership, the dtappgather utility shipped with the Common Desktop Environment allows arbitrary users to overwrite any file prese...

HP HP-UX 10.20/11.0 / IBM AIX 4.3 / SCO Unixware 7.0 / Sun Solaris 2.6 - Change File Permission

source: https://www.securityfocus.com/bid/131/info Due to improper checking of ownership, the dtappgather utility shipped with the Common Desktop Environment allows arbitrary users to overwrite any file present on the filesystem, regardless of the owner of the file. dtappgather uses a directory o...

CVE-1999-1545

Joe's Own Editor joe 2.8 sets the world-readable permission on its crash-save file, DEADJOE, which could allow local users to read files that were being edited by other users...

CVE-1999-1229

Quake 2 server 3.13 on Linux does not properly check file permissions for the config.cfg configuration file, which allows local users to read arbitrary files via a symlink from config.cfg to the target file...

IRIX 5.26.0 - Permissions File Manipulation

IRIX 5.26.0 - Permissions File Manipulation source: https://www.securityfocus.com/bid/1751/info The IRIX's /usr/lib/desktop/permissions tool is a suid and sgid root applications normally used by users to modify permissions of their files and files they are privileged for. A vulnerability in the...