CVE-2003-0498

CVE-2003-0498 affects InterSystems Caché Database 5.x. The vulnerability arises because /cachesys/csp is installed with insecure permissions, allowing local attackers to add server-side scripts or modify files that run with root privileges, enabling arbitrary code execution. The issue is document...

CVE-2003-0498

Caché Database 5.x installs the /cachesys/csp directory with insecure permissions, which allows local users to execute arbitrary code by adding server-side scripts that are executed with root privileges...

[Full-Disclosure] iDEFENSE Security Advisory 07.01.03: Caché Insecure Installation File and Directory Permissions

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 iDEFENSE Security Advisory 07.01.03: http://www.idefense.com/advisory/07.01.03.txt Cach Insecure Installation File and Directory Permissions July 1, 2003 I. BACKGROUND InterSystems Corp.’s Cach is a post-relational database for e-applications that is...

InterSystems Cache Insecure Default Permissions Vulnerability

Description It has been reported that the permissions set by default on the files and directories comprising InterSystems Cache are insecure. The permissions on directories allegedly allow for any user to overwrite any file. This creates many opportunities for local attackers to obtain root...

[SECURITY] [DSA-335-1] New mantis packages fix insecure file permissions

-------------------------------------------------------------------------- Debian Security Advisory DSA 335-1 [email protected] http://www.debian.org/security/ Matt Zimmerman June 28th, 2003 http://www.debian.org/security/faq -...

CVE-2003-0359

nethack 3.4.0 and earlier installs certain setgid binaries with insecure permissions, which allows local users to gain privileges by replacing the original binaries with malicious code...

CVE-2001-1409

dexconf in XFree86 Xserver 4.1.0-2 creates the /dev/dri directory with insecure permissions 666, which allows local users to replace or create files in the root file system...

CVE-2001-1409

Vulnerability CVE-2001-1409 affects XFree86 Xserver 4.1.0-2 where dexconf creates /dev/dri with insecure permissions (666). This allows local users to replace or create files on the root filesystem. Red Hat advisories RHSA-2003:064/065/067 reference updated XFree86 packages and fixes; the issue i...

ScriptLogic sets insecure permissions on "LOGS$" share

Overview Version 4.01 of ScriptLogic contains a vulnerability in the default permissions assigned to the network share used for logging. Description The ScriptLogic product from ScriptLogic, Inc. provides remote system administration capabilities for Microsoft Windows systems in a domain...

CVE-2002-0172

/dev/ipfilter on SGI IRIX 6.5 is installed by /dev/MAKEDEV with insecure default permissions 644, which could allow a local user to cause a denial of service traffic disruption...

CVE-2002-0172

CVE-2002-0172 concerns SGI IRIX 6.5 where the /dev/ipfilter device is created by /dev/MAKEDEV with insecure default permissions (644). A local user could exploit this to cause a denial of service by disrupting network traffic. The issue is mitigated by upgrading to IRIX 6.5.11 or later, as noted ...

CVE-2002-0642

CVE-2002-0642 corresponds to an elevation-of-privilege issue in Microsoft SQL Server 2000 and MSDE 2000 caused by insecure permissions on the registry key that stores the SQL Server service account. The OpenVAS/SECURITYVULNS entries corroborate a privilege-escalation risk tied to the SQL Server s...

CVE-2001-1059

VMware creates a temporary file vmware-log.USERNAME with insecure permissions, enabling local users to read or modify license information. This CVE (CVE-2001-1059) is rated Low (CVSSv2 base 3.6) with local attack vector and no remote access. The connected documents reiterate the same issue but pr...

CVE-2002-0642

The registry key containing the SQL Server service account information in Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine MSDE 2000, has insecure permissions, which allows local users to gain privileges, aka "Incorrect Permission on SQL Server Service Account Registry Key...

[SECURITY] [DSA 230-1] New bugzilla packages fix unauthorized data modification

-------------------------------------------------------------------------- Debian Security Advisory DSA 230-1 [email protected] http://www.debian.org/security/ Martin Schulze January 16th, 2003 http://www.debian.org/security/faq -...

[SECURITY] [DSA 230-1] New bugzilla packages fix unauthorized data modification

-------------------------------------------------------------------------- Debian Security Advisory DSA 230-1 [email protected] http://www.debian.org/security/ Martin Schulze January 16th, 2003 http://www.debian.org/security/faq -...

CVE-2002-1672

Webmin 0.92, when installed from an RPM, creates /var/webmin with insecure permissions world readable, which could allow local users to read the root user's cookie-based authentication credentials and possibly hijack the root user's session using the credentials...

CVE-2002-2407

Certain patches for QNX Neutrino realtime operating system RTOS 6.2.0 set insecure permissions for the files 1 /sbin/io-audio by OS Update Patch A, 2 /bin/shutdown, 3 /sbin/fs-pkg, and 4 phshutdown by QNX experimental patches, 5 cpim, 6 vpim, 7 phrelaycfg, and 8 columns, 9 othello, 10 peg, 11...

CVE-2002-2263

The installation program for HP-UX Visualize Conference B.11.00.11 running on HP-UX 11.00 and 11.11 installs /etc/dt and its subdirecties with insecure permissions, which allows local users to read or write arbitrary files...

The default NTFS permissions are not applied to a converted boot partition on Microsoft Windows 2000 and Windows XP systems when CONVERT.EXE is used

Overview Several commercial desktops and laptops from OEM distributors ship with insecure permissions set on files and directories. It has been confirmed that this is due to the use of Microsoft's CONVERT.EXE utility. Description Microsoft's CONVERT.EXE program is used to convert FAT32 file syste...