Oracle 9iAS XSQL Servlet ignores file permissions allowing arbitrary users to view sensitive configuration files

Overview It is possible to read the sensitive configuration files from an Oracle 9i Application Server without any authorization. This can lead to an intruder gaining access to sensitive information about the server and potentially compromising it. Description Default installation of the Oracle 9...

Многочисленные дырки в Alcatel 4400 PBX (multiple bugs)

Пароли по-умолчанию, предсказуемые номера TCP-последовательности, слабые разрешения на файлы и т.д...

Another local root vulnerability during installation of Tarantella Enterprise 3.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Larry W. Cashdollar Vapid Labs 2/18/2002 Another local root vulnerability during installation of Tarantella Enterprise 3. During installation a "twirling / | - " text graphic is displayed you remember them from the shareware games in DOS days.. they...

SCO UnixWare 7.1.X

Well.. Looks like a insecure file vuln exsists within the system created file when you do the initial install of SCO. Lets take a look here at /var/adm/isl/ifile [email protected] ls -l /var/adm/isl/ifile -rw-r--r-- 1 root root 4691 Sep 24 1999 /var/adm/isl/ifile And we all know the shadow file ...

zml.cgi Directory Traversal

ZML.cgi is vulnerable to a directory traversal attack. It enables a remote attacker to view any file on the computer with the privileges of the cgi/httpd user. %NASLMINLEVEL 70300 This script was written by Drew Hintz http://guh.nu It is based on scripts written by Renaud Deraison and HD Moore Se...

nwclient -- multiple vulnerabilities

Insecure file permissions, network access control and DNS usage put systems that use Legato NetWorker at risk. When the software is running, several files that contain sensitive information are created with insecure permissions. The information exposed include passwords and can therefore be used...

Many vulnerabilities in LSF 4.0

Hello. Load Shareing Facility from Platform http://www.platform.com is a suite of application resource management products that schedule, monitor and analyze the workload for a network of computers. In April 2001 I discovered some security bugs in it. I posted my exploits with technical details t...

CVE-2001-0832

Vulnerability in Oracle 8.0.x through 9.0.1 on Unix allows local users to overwrite arbitrary files, possibly via a symlink attack or incorrect file permissions in 1 the ORACLEHOME/rdbms/log directory or 2 an alternate directory as specified in the ORACLEHOME environmental variable, aka the "Orac...

MandrakeSoft Mandrake Linux Apache default configuration sample programs disclose server information

Overview The default installation of Apache on MandrakeSoft Mandrake Linux includes sample programs which may unnecessarily disclose information about the server. Description MandrakeSoft produces a Linux distribution called Mandrake Linux that includes the Apache web server. The default...

CVE-1999-1425

Solaris Solstice AdminSuite AdminSuite 2.1 incorrectly sets write permissions on source files for NIS maps, which could allow local users to gain privileges by modifying /etc/passwd...

CVE-1999-1126

Cisco Resource Manager (CRM) 1.1 and earlier stores sensitive configuration data in files with insecure permissions, enabling local users to read usernames, passwords, and SNMP community strings from (1) swim_swd.log, (2) swim_debug.log, (3) dbi_debug.log, and (4) temporary files beginning with D...

CVE-1999-1168

install.iss installation script for Internet Security Scanner ISS for Linux, version 5.3, allows local users to change the permissions of arbitrary files via a symlink attack on a temporary file...

CVE-1999-1229

Quake 2 server 3.13 on Linux does not properly check file permissions for the config.cfg configuration file, which allows local users to read arbitrary files via a symlink from config.cfg to the target file...

CVE-1999-1229

The CVE-1999-1229 issue affects the Quake 2 server 3.13 on Linux, where the server does not properly validate config.cfg permissions, allowing a local user to read arbitrary files via a symlink from config.cfg to the target file. The root cause is an insufficient permission check for the configur...

CVE-1999-1538

When IIS 2 or 3 is upgraded to IIS 4, ism.dll is inadvertently left in /scripts/iisadmin, which does not restrict access to the local machine and allows an unauthorized user to gain access to sensitive server information, including the Administrator's password...

Digital Unix 4.0 - MSGCHK MH_PROFILE Symbolic Link

Digital Unix 4.0 - MSGCHK MHPROFILE Symbolic Link source: https://www.securityfocus.com/bid/3320/info The msgchk utility under certain versions of Digital Unix contains an information disclosure vulnerability which could yield root privilege. Because msgchk fails to check file permissions before...

Digital Unix 4.0 - MSGCHK MH_PROFILE Symbolic Link

source: https://www.securityfocus.com/bid/3320/info The msgchk utility under certain versions of Digital Unix contains an information disclosure vulnerability which could yield root privilege. Because msgchk fails to check file permissions before opening user configuration files in the user's hom...

mf.txt

Potential Root Compromise in MicroFocus Cobol Summary ------- If the AppTrack feature is enabled, the default install of MicroFocus Cobol 4.1 Merant's commercial suite of cobol utilities contains a security hole which can lead to root compromise. Specifics --------- In the default install,...

Hewlett Packard HP-UX pcltotiff is installed with insecure permissions

Overview The utility pcltotiff is installed with insecure permissions on some Hewlett Packard systems. Description The HP utility pcltotiff is installed with sgid bin permissions in order to read files in /usr/lib/X11/fonts/ifo.st/typefaces/. This gives more permissions to pcltotiff than are...

Wvdial insecure conf?

I've compiled and installed wvdial a dialer for dial up connection and the program wvdialconf generate a file called wvdial.conf. In this file : AT strings, username, pass and another setting like /etc/ppp/options. But now the problem, with ls -l -rw-r--r-- 1 root root 335 Aug 1 18:21 wvdial.conf...