pam_console.bug

When accepting luser console login, pamconsole called by /bin/login tries to be user-friendly, doing several chowns on devices like login tty and corresponding vcsa device, as well as other interesting devices: fd, audio devices dsp, mixer, audio, midi, sequencer, cdrom, streamer/zip drive device...

rm.racecondition

Synopsis: If root ever does "rm -rf /tmp/foo" for a directory structure not completely owned by root, a local user can delete all files that root can. Such deletions are common for a /tmp cleanup and b before creating a specific directory in /tmp/. Details: "rm -r" implementations Solaris 7, Gnu...

unixware7.mail.txt

Greetings, OVERVIEW Any user can read/modify others' mail. BACKGROUND Only UnixWare 7.1 was tested. DETAILS Imagine my suprise when I saw that /var/mail was mode 777. As such, any user may create a file called /var/mail/ with a mode readable by him and trap all incoming mail. Afraid of getting...

unixware.chown.txt

Greetings, OVERVIEW Any user can change the owner of any file he or she owns. BACKGROUND All my testing was done on UnixWare 7.1, however chances are excellent that this problem exists for all versions of UnixWare. DETAILS This hole is, erm, different. Apparently any user can change the ownership...

CVE-2000-0366

dump in Debian GNU/Linux 2.1 does not properly restore symlinks, which allows a local user to modify the ownership of arbitrary files...

HP HP-UX 10.2011.0 IBM AIX 4.3 SCO Unixware 7.0 Sun Solaris 2.6 - Change File Permission

HP HP-UX 10.2011.0 IBM AIX 4.3 SCO Unixware 7.0 Sun Solaris 2.6 - Change File Permission source: https://www.securityfocus.com/bid/131/info Due to improper checking of ownership, the dtappgather utility shipped with the Common Desktop Environment allows arbitrary users to overwrite any file prese...

insmod.linux.txt

Date: Tue, 30 Mar 1999 22:08:13 -0500 From: Brian Szymanski To: [email protected] Subject: linux insmod bug/security vulnerability Howdy all, Recently I discovered a bug in insmod that would require a lot of time and luck to exploit, but is nonetheless important for systems wanting rock-solid...

CVE-1999-1299

rcp on various Linux systems including Red Hat 4.0 allows a "nobody" user or other user with UID of 65535 to overwrite arbitrary files, since 65535 is interpreted as -1 by chown and other system calls, which causes the calls to fail to modify the ownership of the file...

PT-1997-1154 · Microsoft · Windows Nt

Name of the Vulnerable Software and Affected Versions: Windows NT affected versions not specified Description: The issue concerns a Windows NT user having inappropriate rights or privileges. This includes privileges such as Act as System, Add Workstation, Backup, Change System Time, Create...