helvis -- information leak vulnerabilities

Once a recovery file has been preserved by the setuid root elvprsv utility it is placed in a worldreadable directory with worldreadable permissions. This possibly allows sensitive information to leak. In addition to this information leak, it is possible for users to recover files that belong to...

helvis -- arbitrary file deletion problem

The setuid root elvprsv utility, used to preserve recovery helvis files, can be abused by local users to delete with root privileges. The problem is that elvprsv deletes files when it thinks they have become corrupt. When elvprsv is pointed to a normal file then it will almost always think the fi...

CVE-2004-0564

CVE-2004-0564 concerns rp-pppoe (pppoe) when the rp-pppoe package is configured to run setuid root. The description states that if rp-pppoe is installed or configured to operate with setuid root contrary to its design, local users can overwrite arbitrary files. Several connected sources (SUSE and...

CVE-2004-0564

Roaring Penguin pppoe rp-ppoe, if installed or configured to run setuid root contrary to its design, allows local users to overwrite arbitrary files. NOTE: the developer has publicly disputed the claim that this is a vulnerability because pppoe "is NOT designed to run setuid-root." Therefore this...

CVE-2004-0564

Roaring Penguin pppoe rp-ppoe, if installed or configured to run setuid root contrary to its design, allows local users to overwrite arbitrary files. NOTE: the developer has publicly disputed the claim that this is a vulnerability because pppoe "is NOT designed to run setuid-root." Therefore this...

Debian DSA-034-1 : ePerl - remote root exploit

Fumitoshi Ukai and Denis Barbier have found several potential buffer overflow bugs in our version of ePerl as distributed in all of our distributions. When eperl is installed setuid root, it can switch to the UID/GID of the scripts owner. Although Debian doesn't ship the program setuid root, this...

Debian DSA-299-1 : leksbot - improper setuid-root execution

Maurice Massar discovered that, due to a packaging error, the program /usr/bin/KATAXWR was inadvertently installed setuid root. This program was not designed to run setuid, and contained multiple vulnerabilities which could be exploited to gain root privileges. %NASLMINLEVEL 70300 C Tenable Netwo...

Debian DSA-310-1 : xaos - improper setuid-root execution

XaoS, a program for displaying fractal images, is installed setuid root on certain architectures in order to use svgalib, which requires access to the video hardware. However, it is not designed for secure setuid execution, and can be exploited to gain root privileges. In these updated packages,...

RsyncX vulnerabilities

Product: RsyncX is a frontend for rsync running on OS X, with additional features such as crontab editing. http://www.macosxlabs.org/rsyncx/rsyncx.html Problems: 1 RsyncX is installed setuid root and setgid wheel. Upon execution, the program drops root privileges only via seteuidgetuid . However ...

MacOSXLabs RsyncX 2.1 - Local Privilege Escalation

MacOSXLabs RsyncX 2.1 - Local Privilege Escalation source: https://www.securityfocus.com/bid/11211/info It is reported that RsyncX is prone to a local privilege escalation vulnerability. RsyncX is installed setuid root and setgid wheel. It is reported that RsyncX drops root privileges properly bu...

CVE-2003-0019

umlnet in the kernel-utils package for Red Hat Linux 8.0 has incorrect setuid root privileges, which allows local users to modify network interfaces, e.g. by modifying ARP entries or placing interfaces into promiscuous mode...

CVE-2003-1052

IBM DB2 7.1 and 8.1 allow the bin user to gain root privileges by modifying the shared libraries that are used in setuid root programs...

Mandrake Linux Security Advisory : gnupg (MDKSA-2001:053-1)

A format string vulnerability exists in gnupg 1.0.5 and previous versions which is fixed in 1.0.6. This vulnerability can be used to invoke shell commands with privileges of the currently logged-in user. Update : The /usr/bin/gpg executable was installed setuid root and setgid root. While being...

[Full-Disclosure] OpenServer 5.0.6 OpenServer 5.0.7 : MMDF Various buffer overflows and other security issues

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SCO Security Advisory Subject: OpenServer 5.0.6 OpenServer 5.0.7 : MMDF Various buffer overflows and other security issues Advisory number: SCOSA-2004.7 Issue date: 2004 July 14 Cross reference: sr884728 fz528322 erg712434 CAN-2004-0510 CAN-2004-0511...

[SECURITY] [DSA 472-1] New fte packages fix buffer overflows

-------------------------------------------------------------------------- Debian Security Advisory DSA 472-1 [email protected] http://www.debian.org/security/ Matt Zimmerman April 3rd, 2004 http://www.debian.org/security/faq -...

DSA-472 fte - several vulnerabilities

Bulletin has no description...

Microsoft Virtual PC Services Insecure Temporary File Creation

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 @stake, Inc. www.atstake.com Security Advisory Advisory Name: Virtual PC Services Insecure Temporary File Creation Release Date: 02/10/2004 Application: Connectix Virtual PC 6.0.x Microsoft Virtual PC 6.1 Platform: Mac OS X Severity: Local privilege...

CVE-2003-1097

Buffer overflow in rexec on HP-UX B.10.20, B.11.00, and B.11.04, when setuid root, may allow local users to gain privileges via a long -l option...

TerminatorX 3.8 - Multiple Command-Line and Environment Buffer Overrun Vulnerabilities (2)

// source: https://www.securityfocus.com/bid/8993/info It has been reported that TerminatorX may be prone to multiple vulnerabilities when handling command-line and environment variable data. As a result, an attacker may be capable of exploiting the application in a variety of ways to execute...

kpopup 0.9.x - Privileged Command Execution

kpopup 0.9.x - Privileged Command Execution // source: https://www.securityfocus.com/bid/8915/info It has been alleged that it is possible for local attackers to gain root privileges through kpopup, which is is installed setuid root by default. According to the report, kpopup uses the system3...