830 matches found
ikiwiki -- improper symlink verification vulnerability
The ikiwiki development team reports: Ikiwiki did not check if path to the srcdir to contained a symlink. If an attacker had commit access to the directories in the path, they could change it to a symlink, causing ikiwiki to read and publish files that were not intended to be published. But not...
Design/Logic Flaw
The remotecmds component in Apple Mac OS X 10.4 through 10.4.10 contains a symbolic link from the tftpboot private directory to the root directory, which allows tftpd users to escape the private directory and access arbitrary files...
CVE-2007-3921
gforge 3.1 and 4.5.14 allows local users to truncate arbitrary files via a symlink attack on temporary files...
Fedora 7 : spamassassin-3.2.1-1.fc7 (2007-0390)
Local symlink vulnerability. Fedora is not vulnerable in any default or common configurations. Read upstream's announcement for details. http://spamassassin.apache.org/advisories/CVE-2007-2873.txt Note that Tenable Network Security has extracted the preceding description block directly from the...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal. Directory traversal vulnerability in the containsdotdot function in src/names.c in GNU tar allows user-assisted remote attackers to overwrite arbitrary files via certain //.. slash slash dot dot sequences in directo...
Fedora Core 5 : spamassassin-3.1.9-1.fc5.1 (2007-584)
Local symlink vulnerability. Fedora is not vulnerable in any default or common configurations. Read upstream's announcement for details. http://spamassassin.apache.org/advisories/CVE-2007-2873.txt Note that Tenable Network Security has extracted the preceding description block directly from the...
FreeBSD -- Jail rc.d script privilege escalation
Problem Description: In multiple situations the host's jail rc.d8 script does not check if a path inside the jail file system structure is a symbolic link before using the path. In particular this is the case when writing the output from the jail start-up to /var/log/console.log and when mounting...
FreeBSD-SA-06:26.gtar
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-06:26.gtar Security Advisory The FreeBSD Project Topic: gtar name mangling symlink vulnerability Category: contrib Module: contribtar Announced: 2006-12-06...
Xcode OpenBase <= 10.0.0 (symlink) Local Root Exploit (OSX)
No description provided by source. !/usr/bin/perl http://www.digitalmunition.com written by kf kflistsatdigitalmunitiondotcom = ftp://www.openbase.com/pub/OpenBase10.0 vulnerable ? Create a new file anywhere on the filesystem with rw-rw-rw privs. Sorry you can NOT overwrite existing files. Writin...
Xcode OpenBase 10.0.0 (OSX) - Symlink Privilege Escalation
Xcode OpenBase 10.0.0 OSX - Symlink Privilege Escalation !/usr/bin/perl http://www.digitalmunition.com written by kf kflistsatdigitalmunitiondotcom \n\nTargets:\n\n"; foreach $key sortkeys %tgts $a,$b = split/:/,$tgts"$key"; print "\t$key . $a\n"; print "\n"; exit 1; $ret = pack"l", $retval; $a,$...
GLSA-200606-23 : KDM: Symlink vulnerability
The remote host is affected by the vulnerability described in GLSA-200606-23 KDM: Symlink vulnerability Ludwig Nussel discovered that KDM could be tricked into allowing users to read files that would otherwise not be readable. Impact : A local attacker could exploit this issue to obtain potential...
Design/Logic Flaw
Safari on Apple Mac OS X 10.4.6, when "Open safe' files after downloading" is enabled, will automatically expand archives, which could allow remote attackers to overwrite arbitrary files via an archive that contains a symlink...
Ejabberd : Symlink vulnerability during installation process
Date : 2006-04-25 Vendor : www.process-one.net Products : ejabberd binary installation for Linux Vulnerable Versions : 1.1.11 and prior versions When root user is running ejabberd-1.1.11-linux-installer.bin in order to install the Jabber server ejabberd. It creates in an insecure mode a file name...
CVE-2005-3785
Second-order symlink vulnerability in eix-sync.in in Ebuild IndeX eix before 0.5.0pre2 allows local users to overwrite arbitrary files via a symlink attack on the exi.X.sync temporary file, which is processed by the diff-eix program...
Mandrake Linux Security Advisory : smb4k (MDKSA-2005:157)
A severe security issue has been discovered in Smb4K. By linking a simple text file FILE to /tmp/smb4k.tmp or /tmp/sudoers, an attacker could get access to the full contents of the /etc/super.tab or /etc/sudoers file, respectively, because Smb4K didn't check for the existance of these files befor...
CVE-2005-1879
LutelWall 0.97 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file created by a system call to wget...
CVE-2005-0017
The f2c translator in the f2c package 3.1 allows local users to read arbitrary files via a symlink attack on temporary files...
sharutils security update
CentOS Errata and Security Advisory CESA-2005:377-01 An updated sharutils package is now available. This update has been rated as having low security impact by the Red Hat Security Response Team. The sharutils package contains a set of tools for encoding and decoding packages of files in binary o...
GLSA-200504-12 : rsnapshot: Local privilege escalation
The remote host is affected by the vulnerability described in GLSA-200504-12 rsnapshot: Local privilege escalation The copysymlink subroutine in rsnapshot follows symlinks when changing file ownership, instead of changing the ownership of the symlink itself. Impact : Under certain circumstances,...
rsnapshot: Local privilege escalation
Background rsnapshot is a filesystem snapshot utility based on rsync, allowing local and remote systems backups. Description The copysymlink subroutine in rsnapshot follows symlinks when changing file ownership, instead of changing the ownership of the symlink itself. Impact Under certain...