Linux Kernel 'truncate()'本地特权提升漏洞

BUGTRAQ ID: 31368 CVE ID：CVE-2008-4210 CNCVE ID：CNCVE-20084210 Linux是一款开放源代码的操作系统。 Linux内核'truncate'和'ftruncate'函数存在设计错误，本地攻击者可以利用漏洞提升特权。 当建立文件时，open/creat允许通过模式参数设置setgid位，由于bsdgroups mount选项或在setgid目录中建立文件，用户不属于新文件的组的成员。用户可以使用ftruncate和memory-mapped I/O使新文件成为任意两进制，获得此组的特权，原因是这些操作没有清除setgid位。...

kernel: missing check before setting mount propagation

The dochangetype function in fs/namespace.c in the Linux kernel before 2.6.22 does not verify that the caller has the CAPSYSADMIN capability, which allows local users to gain privileges or cause a denial of service by modifying the properties of a mountpoint...

Gentoo Security Advisory GLSA 200511-17 (FUSE)

The remote host is missing updates announced in advisory GLSA 200511-17. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Gentoo Security Advisory GLSA 200511-17 (FUSE)

The remote host is missing updates announced in advisory GLSA 200511-17. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DEBIAN-CVE-2008-3970

pammount 0.10 through 0.45, when luserconf is enabled, does not verify mountpoint and source ownership before mounting a user-defined volume, which allows local users to bypass intended access restrictions via a local mount...

CVE-2008-3970

pammount 0.10 through 0.45, when luserconf is enabled, does not verify mountpoint and source ownership before mounting a user-defined volume, which allows local users to bypass intended access restrictions via a local mount...

FreeBSD Security Advisory (FreeBSD-SA-07:01.jail.asc)

The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-07:01.jail.asc ADV FreeBSD-SA-07:01.jail.asc OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft In...

FreeBSD Security Advisory (FreeBSD-SA-08:08.nmount.asc)

The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-08:08.nmount.asc ADV FreeBSD-SA-08:08.nmount.asc OpenVAS Vulnerability Test $ Description: Auto generated from ADV FreeBSD-SA-08:08.nmount.asc Authors: Thomas Reinke Copyright: Copyright c 2008...

USN-637-1: Linux kernel vulnerabilities

It was discovered that there were multiple NULL-pointer function dereferences in the Linux kernel terminal handling code. A local attacker could exploit this to execute arbitrary code as root, or crash the system, leading to a denial of service. CVE-2008-2812 The dochangetype routine did not...

SuSe mount/umount溢出漏洞

由于mount/umount命令没有对用户的输入进行正确的边界检查，如果攻击者以超长的相对路径名为参数运行mount/umount程序，将会覆盖为realpath函数动态分配的内存空间的内容。攻击者通过修改堆heap数据有可能会获得root特权。 SuSe Linux 所有版本 Package: util 2.10f 升级util软件包，或去掉mount/umount的suid位。 ftp://ftp.suse.com/pub/suse/axp/update/6.1/a1/util-2.10f-4.alpha.rpm...

Memory corruption

Unspecified vulnerability in Alias Manager in Apple Mac OS X 10.5.1 and earlier on Intel platforms allows local users to gain privileges or cause a denial of service memory corruption and application crash by resolving an alias that contains crafted AFP volume mount information...

CVE-2008-2308

Unspecified vulnerability in Alias Manager in Apple Mac OS X 10.5.1 and earlier on Intel platforms allows local users to gain privileges or cause a denial of service memory corruption and application crash by resolving an alias that contains crafted AFP volume mount information...

CVE-2008-2308

Unspecified vulnerability in Alias Manager in Apple Mac OS X 10.5.1 and earlier on Intel platforms allows local users to gain privileges or cause a denial of service memory corruption and application crash by resolving an alias that contains crafted AFP volume mount information...

SOL8924 - Linux kernel vulnerability CVE-2007-3843

A flaw in the CIFS handling of the mount option sec= that did not enable integrity checking and did not produce any error message. Information about this advisory is available at the following location:...

openSUSE 10 Security Update : cifs-mount (cifs-mount-5294)

Samba has been updated to fix a security problem : CVE-2008-1105: Secunia research discovered vulnerability in Samba, which can be exploited by malicious people to compromise a vulnerable system. The vulnerability is caused due to a boundary error within the 'receivesmbraw' function in...

RHEL 5 : kernel (RHSA-2008:0089)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2008:0089 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. These new kernel packages fix the following security...

Important: Red Hat Security Advisory: kernel security and bug fix update

Updated kernel packages that fix several security issues and several bugs in the Red Hat Enterprise Linux 5 kernel are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any...

Debian Security Advisory DSA 823-1 (util-linux)

The remote host is missing an update to util-linux announced via advisory DSA 823-1. David Watson discoverd a bug in mount as provided by util-linux and other packages such as loop-aes-utils that allows local users to bypass filesystem access restrictions by re-mounting it read-only. For the old...

Debian: Security Advisory (DSA-1237-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-823-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...