Pre-open files attack agains locked file

Hello lists, hello Roger. It's me again. Sorry for annoyance, but there is one more attack vector with pre-open files I meant, but forgot to mention. It seems dangerous enough and need to be investigated for different applications. Attack is against application relying on mandatory locks. Attack...

vixie cron...

Attached shell-script exploits fopen + preserved umask vulnerability in Paul Vixie's cron code. It will work on systems where /var/spool/cron is user-readable eg. 0755 - AFAIR Debian does so. RedHat at least 6.1 and previous have mode 0700 on /var/spool/cron, and thus it isn't exploitable in its...

[SECURITY] New version of lsof fixes buffer overflow

We have received reports that the lsof package is distributed in Debian GNU/Linux 2.0 contains a buffer overflow. Using this overflow it is possible for local users to gain root-access. We have fixed this problem in version 4.37-3. We recommend you upgrade your lsof package immediately. wget url...