Serious security flaw in SuSE rctab

Hi @ll, it seems that the problem described below has not been discussed on Bugtraq. Problem description ------------------- Due to a various race conditions in the init level editing script /sbin/rctab it is possible for any local user to overwrite any system's file with arbitrary data. This may...

Cgisecurity.com Advisory #3.1

The staff at cgisecurity.com have found a security issue with a forum script that is widley used. Below is the advisory along with the vendor patch. -zenomorph Cgi Security Advisory 3.1 [email protected] bbsforum.cgi Found January 3rd 2001 Vendor Contacted January 3rd 2001 Public Release...

(SRADV00007) Local root compromise through Lexmark MarkVision printer drivers

================================================= Secure Reality Pty Ltd. Security Advisory 7 SRADV00007 http://www.securereality.com.au ================================================= Title Local root compromise through Lexmark MarkVision printer drivers Released 6/11/2000 Vulnerable Versions...

SRADV00007.txt

================================================= Secure Reality Pty Ltd. Security Advisory 7 SRADV00007 http://www.securereality.com.au ================================================= Title Local root compromise through Lexmark MarkVision printer drivers Released 6/11/2000 Vulnerable Versions...

SuSE Security Announcement: modules

-----BEGIN PGP SIGNED MESSAGE----- SuSE Security Announcement Package: modules Announcement-ID: SuSE-SA:2000:44 Date: Monday, November 13th, 2000 10:00 MEST Affected SuSE versions: 6.4, 7.0 Vulnerability Type: local root compromise Severity 1-10: 8 SuSE default package: yes Other affected systems...

RedHat 7.0 (and SuSE): modutils + netkit = root compromise. (fwd)

Motto from the modprobe manpage: "BUGS: Naah..." ------------------------------------------------ This vulnerability has been found by Sebastian Krahmer some time ago he is posting an advisory right now. Stupid shell command execution within userspace kernel helper application, modprobe, is...

Linux modutils 2.3.9 - 'modprobe' Arbitrary Command Execution

source: https://www.securityfocus.com/bid/1936/info Modutils is a component of many linux systems that includes tools for using loadable kernel modules. One of these tools, modprobe, loads a set of modules that correspond to a provided "name" passed at the command line automatically. Modprobe...

RedHat 0.4 b15 restore - Insecure Environment Variables

RedHat 0.4 b15 restore - Insecure Environment Variables source: https://www.securityfocus.com/bid/1914/info restore is a program for backup and recovery procedures, distributed with the RedHat Linux Operating System. A vulnerability exists that could allow a user elevated permissions. The problem...

RedHat 0.4 b15 restore - Insecure Environment Variables

source: https://www.securityfocus.com/bid/1914/info restore is a program for backup and recovery procedures, distributed with the RedHat Linux Operating System. A vulnerability exists that could allow a user elevated permissions. The problem occurs in the RSH environment variable. restore is...

rpc.statd vulnerable to remote root compromise via format string stack overwrite

Overview The CERT/CC has begun receiving reports of an input validation vulnerability in the rpc.statd program being exploited. This program is included, and often installed by default, in several popular Linux distributions. Please see the vendors section of this document for specific informatio...

Security Advisory 2000-015

-----BEGIN PGP SIGNED MESSAGE----- NetBSD Security Advisory 2000-015 ================================= Topic: format-string bugs in passwd/libutil Version: all releases up to and including 1.4.2 Severity: local root compromise possible Fixed: 2000/10/03 in -current and netbsd-1-5 branches...

SuSE Security Announcement: ypbind/ypclient (SuSE-SA:2000:042)

-----BEGIN PGP SIGNED MESSAGE----- SuSE Security Announcement Package: ypbind/ypclient Announcement-ID: SuSE-SA:2000:042 Date: Wednesday, October 18th, 2000 19:15 MEST Affected SuSE versions: 6.0, 6.1, 6.2, 6.3, 6.4, 7.0 Vulnerability Type: possible remote root compromise Severity 1-10: 8 SuSE...

FreeBSD-SA-00:56.lprng

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:56 Security Advisory FreeBSD, Inc. Topic: LPRng contains potential root compromise Category: ports Module: LPRng Announced: 2000-10-13 Credits: Chris Evans Affects: Ports...

Format strings: bug #2: LPRng

Hi, SUMMARY ------- LPRng is almost certainly vulnerable to remote-root compromise on account of a format string bug. The flaw is almost identical to the rpc.statd one I found; namely a faulty syslog wrapper. This is becoming a very common flaw. Details ------- Here is a code excerpt from:...

klogd-linux.txt

OVERVIEW Kernel logging daemon klogd in the sysklogd package for Linux contains a "format bug" making it vulnerable to local root compromise successfully tested on Linux/x86. There's also a possibility for remote vulnerability under certain rather unprobable circumstances and a more probable...

klogd format bug

OVERVIEW Kernel logging daemon klogd in the sysklogd package for Linux contains a "format bug" making it vulnerable to local root compromise successfully tested on Linux/x86. There's also a possibility for remote vulnerability under certain rather unprobable circumstances and a more probable...

FreeBSD-SA-00:50.listmanager

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:50 Security Advisory FreeBSD, Inc. Topic: listmanager port allows local root compromise Category: ports Module: listmanager Announced: 2000-09-13 Affects: Ports...

(SRADV00002) Remote root compromise through pam_smb and pam_ntdom

================================================= Secure Reality Pty Ltd. Security Advisory 1 SRADV00002 http://www.securereality.com.au ================================================= Title Remote root compromise through pamsmb and pamntdom Released 11/09/2000 Vulnerable pamsmb - stable versio...

IRIX telnetd vulnerability

-----BEGIN PGP SIGNED MESSAGE----- SGI Security Advisory Title: IRIX telnetd vulnerability Number: 20000801-01-P Date: September 6, 2000 SGI provides this information freely to the SGI user community for its consideration, interpretation, implementation and use. SGI recommends that this informati...

Gert Doering mgetty 1.1.191.1.201.1.211.22.8 - Symbolic Link Traversal

Gert Doering mgetty 1.1.191.1.201.1.211.22.8 - Symbolic Link Traversal source: https://www.securityfocus.com/bid/1612/info A vulnerability exists in a portion of the mgetty package, by Gert Doering. By exploiting a flaw in the faxrunq and faxrunqd programs, it is possible for local users to creat...