82 matches found
SUSE SLES12 Security Update : nfs-utils (SUSE-SU-2019:2771-1)
This update for nfs-utils fixes the following issues : CVE-2019-3689: Fixed root-owned files stored in insecure /var/lib/nfs. bsc1150733 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automaticall...
SUSE-SU-2019:2776-1 Security update for nfs-utils
This update for nfs-utils fixes the following issues: - CVE-2019-3689: Fixed root-owned files stored in insecure /var/lib/nfs. bsc1150733...
SUSE-SU-2019:2771-1 Security update for nfs-utils
This update for nfs-utils fixes the following issues: - CVE-2019-3689: Fixed root-owned files stored in insecure /var/lib/nfs. bsc1150733...
CVE-2019-3689 nfs-utils: root-owned files stored in insecure /var/lib/nfs directory
The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including version 2.1.1-6.10.2 the directory /var/lib/nfs is owned by statd:nogroup. This directory contains files owned and managed by root. If...
openSUSE Security Update : gvfs (openSUSE-2019-261)
This update for gvfs fixes the following issues : Security vulnerability fixed : - CVE-2019-3827: Fixed an issue whereby an unprivileged user was not prompted to give a password when acessing root owned files. bsc1125084 This update was imported from the SUSE:SLE-15:Update update project...
Security update for gvfs (important)
openSUSE Security Update: Security update for gvfs Announcement ID: openSUSE-SU-2019:0261-1 Rating: important References: 1125084 Cross-References: CVE-2019-3827 Affected Products: openSUSE Leap 15.0 An update that fixes one vulnerability is now available. Description: This update for gvfs fixes...
SUSE-SU-2019:0438-1 Security update for gvfs
This update for gvfs fixes the following issues: Security vulnerability fixed: - CVE-2019-3827: Fixed an issue whereby an unprivileged user was not prompted to give a password when acessing root owned files. bsc1125084...
postgresql: Start scripts permit database administrator to modify root-owned files
Privilege escalation flaws were found in the Red Hat initialization scripts of PostgreSQL. An attacker with access to the postgres user account could use these flaws to obtain root access on the server machine...
CVE-2017-16882
Icinga Core through 1.14.0 initially executes bin/icinga as root but supports configuration options in which this file is owned by a non-root account and similarly can have etc/icinga.cfg owned by a non-root account, which allows local users to gain privileges by leveraging access to this non-roo...
Vulnerability in contrib module (CVE-2017-12172)
Start scripts permit database administrator to modify root-owned files...
SGI IRIX <= 6.4 startmidi Vulnerabilty
No description provided by source. source: http://www.securityfocus.com/bid/469/info A vulnerability exists in the startmidi program from Silicon Graphics. This utility is included with Irix versions 5.x and 6.x with the Iris Digital Media Execution Environment. startmidi is setuid root, and...
OpenFabrics ibutils 1.5.7 /tmp clobbering vulnerability
OpenFabrics ibutils 1.5.7 /tmp clobbering vulnerability 3/6/2013 Larry W. Cashdollar @larry0 The infiniband diagnostic utiltiy handles files in /tmp insecurely. A malicious user can clobber root owned files with common symlink attacks. http://www.openfabrics.org/downloads/ibutils/ nobody@exdb01...
OpenFabrics ibutils 1.5.7 /tmp File Clobber
OpenFabrics ibutils 1.5.7 /tmp clobbering vulnerability 3/6/2013 Larry W. Cashdollar @larry0 The infiniband diagnostic utiltiy handles files in /tmp insecurely. A malicious user can clobber root owned files with common symlink attacks. http://www.openfabrics.org/downloads/ibutils/ nobody@exdb01...
Oracle Auto Service Request File Clobber
Oracle Auto Service Request software package creates files insecurely in /tmp using time stamps instead of mkstemp. You can clobber root owned files if you know when around the time the root administrator will be using this utility. larry@oracle-os-lab01 tmp$ for x in seq 500 999; do ln -s...
Another Solaris 10 Patch Cluster Symlink Attack
Larry W. Cashdollar 8/6/2012 Here is another symlink attack with temp file creation using process id in Solaris 10 patch cluster. You can over write the contents of root owned files with the contents of inetd.conf. In patches/137097-01/SUNWcsr/reloc/lib/svc/method/inetd-upgrade lines : 72...
Solaris 10 Patch 137097-01 Symlink Attack Privilege Escalation
Exploit for solaris platform in category local exploits Larry W. Cashdollar 8/6/2012 Here is another symlink attack with temp file creation using process id in Solaris 10 patch cluster. You can over write the contents of root owned files with the contents of inetd.conf. In...
jakarta-commons-daemon: jsvc does not drop capabilities allowing access to files and directories owned by the superuser
native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for...
Prismstumbler 0.7.3 File Overwrite
I found a symlink vuln in this older program. Prismstumbler 0.7.3 is most often ran as root to utilize all of capabilities. Prismstumbler pst creates /tmp/.psintercom and /tmp/spotkoord.txt as default. Can be changed within preferences. srw-rw-rw- 1 root root 0 2009-04-02 00:44 .psintercom...
[UNIX] Liblesstif Local Root (Exploit)
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...