SuSE 6.x/7.0 - MkDir Error Handling rctab Race Condition (2)

source: https://www.securityfocus.com/bid/2207/info rctab is the Run Control Tab script included with the SuSE distribution of the Linux Operating System. SuSE is a freely available, Open Source Operating system maintained by SuSE Incorporated. A race condition in the rctab script could allow an...

[SECURITY] [DSA-009-1] multiple stunnel vulnerabilities

Package : stunnel Problem type : insecure file handling, format string bug Debian-specific: no Lez discovered a format string problem in stunnel a tool to create Universal SSL tunnel for other network daemons. Brian Hatch responded by stating he was already preparing a new release with multiple...

KDE 1.1.2 KApplication configfile - Local Privilege Escalation (2)

source: https://www.securityfocus.com/bid/1291/info The KDE configuration-file management has a bug which could result in root compromise. Due to insecure creation of configuration rc files via KApplication-class, local users can modify ownership of arbitrary files when running setuid root...

ISSalert: ISS Security Advisory: Insecure file handling in IBM AIX frcactrl program

ISS Security Advisory April 26, 2000 Insecure file handling in IBM AIX frcactrl program Synopsis: Internet Security Systems ISS X-Force has discovered a vulnerability in the AIX frcactrl program. The Fast Response Cache Accelerator FRCA is a kernel module that can be used with the IBM HTTP server...

CVS DoS

Hi, I've just found annoying bug in cvs-1.10.7 probably others too. Let's assume you've decided to make your remote cvs repository available to several trusted people. Therefore you need to edit your /etc/inetd.conf file and add line similar to presented below: cvspserver stream tcp nowait root...

Sun Workshop 5.0 - Licensing Manager Symlink

source: https://www.securityfocus.com/bid/998/info A vulnerability exists in the installation of licenses for Sun's WorkShop 5.0 compilers, and other Sun products which use the FlexLM license management system. As part of the installation process, the 'lit' program is run. This program insecurely...

IRIX 6.5.x - '/usr/lib/InPerson/inpview' Race Condition

/ source: https://www.securityfocus.com/bid/1530/info Certain versions of IRIX ship with a version of inpview that creates files in '/var/tmp/' in an insecure manner and is therefore prone to a race condition. InPerson's 'inpview' is a networked multimedia conferencing tool. InPerson provides...

suse6.2pbpg.txt

Brock Tellier [email protected] Sent: Thursday, September 16, 1999 5:06 PM Subject: Two SuSE 6.2 local root exploits Greetings, /usr/bin/pb and /usr/bin/pg, suid root by default on SuSE 6.2, allow any user to read any file on the system as shown: susebox:/root ls -la /usr/bin/pb uname -rwsr-xr-...

Linux_suse_exploits.txt

Subject: Two SuSE 6.2 local root exploits To: [email protected] Greetings, /usr/bin/pb and /usr/bin/pg, suid root by default on SuSE 6.2, allow any user to read any file on the system as shown: susebox:/root ls -la /usr/bin/pb uname -rwsr-xr-x 1 root root 23544 Jul 22 20:07 /usr/bin/pb...

Oracle 8 - File Access

source: https://www.securityfocus.com/bid/170/info A number of security file access security vulnerabilities in suid programs that are part of Oracle may be exploited to obtain the privileges of the 'oracle' user and full access to the database system. Only the Unix version of Oracle is vulnerabl...

[SECURITY] Current versions of mailx fixes /tmp problem

Former versions of mailx used an unsecure means of opening files beneath /tmp for writing. This can be used to damage files in a users directory or even systemwide. We recommend you upgrade your mailx package immediately. dpkg -i file.deb will install the referenced file. Debian GNU/Linux 1.3.1...

APC PowerChute Plus 4.2.2 - Denial of Service

APC PowerChute Plus 4.2.2 - Denial of Service // source: https://www.securityfocus.com/bid/83/info // // APC PowerChute PLUS is a software package that will safely shutdown computer systems locally or accross a network when UPS power starts to fail. When operating PowerChute PLUS normally listens...

APC PowerChute Plus 4.2.2 - Denial of Service

// source: https://www.securityfocus.com/bid/83/info // // APC PowerChute PLUS is a software package that will safely shutdown computer systems locally or accross a network when UPS power starts to fail. When operating PowerChute PLUS normally listens to TCP ports 6547 and 6548, as well as for...

Slackware Linux 3.4 - liloconfig-color Temporary File

Slackware Linux 3.4 - liloconfig-color Temporary File source: https://www.securityfocus.com/bid/77/info liloconfig-color creates the file /tmp/reply insecurely and follows symbolic links. An attacker can create a symbolic link from /tmp/reply to any file and wait for root to run the program. This...

IBM AIX 4.2.1 - usrbinportmir Local Buffer Overflow Insecure Temporary File Creation

IBM AIX 4.2.1 - usrbinportmir Local Buffer Overflow Insecure Temporary File Creation / source: https://www.securityfocus.com/bid/385/info AIX version 4.2.1 introduced a new command titled 'portmir'. This new program had two notable vulnerabilites. First it contained a buffer overflow which allowe...

IBM AIX 4.2.1 - '/usr/bin/portmir' Local Buffer Overflow / Insecure Temporary File Creation

/ source: https://www.securityfocus.com/bid/385/info AIX version 4.2.1 introduced a new command titled 'portmir'. This new program had two notable vulnerabilites. First it contained a buffer overflow which allowed malicious users to obtain root privileges. Secondly it wrote it's log files to a...