324 matches found
Debian: Security Advisory (DSA-933-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian Security Advisory DSA 148-1 (hylafax)
The remote host is missing an update to hylafax announced via advisory DSA 148-1. OpenVAS Vulnerability Test $Id: deb1481.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 148-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...
Debian Security Advisory DSA 865-1 (hylafax)
The remote host is missing an update to hylafax announced via advisory DSA 865-1. Javier Fernandez-Sanguino Pena discovered that several scripts of the hylafax suite, a flexible client/server fax software, create temporary files and directories in an insecure fashion, leaving them vulnerable to...
Debian Security Advisory DSA 401-1 (hylafax)
The remote host is missing an update to hylafax announced via advisory DSA 401-1. OpenVAS Vulnerability Test $Id: deb4011.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 401-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...
Debian: Security Advisory (DSA-865-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian Security Advisory DSA 401-1 (hylafax)
The remote host is missing an update to hylafax announced via advisory DSA 401-1. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian DSA-933-1 : hylafax - arbitrary command execution
Patrice Fournier found that hylafax passes unsanitized user data in the notify script, allowing users with the ability to submit jobs to run arbitrary commands with the privileges of the hylafax server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks i...
[Full-disclosure] capi4hylafax insecure manipulation with tmp files
capi4hylafax suite http://freshmeat.net/projects/capi4hylafax/ is addon for hylafax fax server http://www.hylafax.org/ vulnerable: capi4hylafax-01.03.00 /probably others/ in capi4hylafax-01.03.00/src/faxrecv/faxrecv.cpp : ifdef GENERATEDEBUGSFFDATAFILE dwarning DebugSffDataFile == 0; if...
Mandrake Linux Security Advisory : hylafax (MDKSA-2006:015)
Patrice Fournier discovered the faxrcvd/notify scripts executed as the uucp/fax user run user-supplied input through eval without any attempt at sanitising it first. This would allow any user who could submit jobs to HylaFAX, or through telco manipulation control the representation of callid...
GLSA-200601-03 : HylaFAX: Multiple vulnerabilities
The remote host is affected by the vulnerability described in GLSA-200601-03 HylaFAX: Multiple vulnerabilities Patrice Fournier discovered that HylaFAX runs the notify script on untrusted user input. Furthermore, users can log in without a password when HylaFAX is installed with the pam USE-flag...
[SECURITY] [DSA 933-1] New hylafax packages fix arbitrary command execution
-------------------------------------------------------------------------- Debian Security Advisory DSA 933-1 [email protected] http://www.debian.org/security/ Michael Stone January 9, 2006 http://www.debian.org/security/faq -...
[SECURITY] [DSA 933-1] New hylafax packages fix arbitrary command execution
-------------------------------------------------------------------------- Debian Security Advisory DSA 933-1 [email protected] http://www.debian.org/security/ Michael Stone January 9, 2006 http://www.debian.org/security/faq -...
HylaFAX hfaxd with PAM Password Policy Bypass
The remote host is running HylaFAX, a fax / pager server application for Linux / unix. The version of HylaFAX installed on the remote host does not check passwords when authenticating users via hfaxd, its fax server. An attacker can exploit this issue to bypass authentication using a valid userna...
DSA-933-1 hylafax - arbitrary command execution
Bulletin has no description...
HylaFax enterprise fax system multiple vulnerabilities
Unauthorized access and privilege escalation are possible...
[ GLSA 200601-03 ] HylaFAX: Multiple vulnerabilities
Gentoo Linux Security Advisory GLSA 200601-03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...
HylaFAX Security advisory - fixed in HylaFAX 4.2.4
I'm passing this on for Patrice Fournier who is not around today. ------------------------------------------------------------------------------ HylaFAX security advisory 4 Jan 2006 Subject: HylaFAX hfaxd and notify/faxrcvd vulnerabilities Introduction: HylaFAX is a mature est. 1991...
CVE-2005-3539
Multiple eval injection vulnerabilities in HylaFAX 4.2.3 and earlier allow remote attackers to execute arbitrary commands via 1 the notify script in HylaFAX 4.2.0 to 4.2.3 and 2 crafted CallID parameters to the faxrcvd script in HylaFAX 4.2.2 and 4.2.3...
CVE-2005-3538
HylaFAX vulnerability CVE-2005-3538 affects hfaxd when PAM support is disabled, allowing remote attackers to login with arbitrary passwords and potentially gain privileges. Connected sources confirm the issue is limited to HylaFAX 4.2.3 with PAM disabled and indicate that a fix was released in Hy...