Serious security flaw in SuSE rctab

Hi @ll, it seems that the problem described below has not been discussed on Bugtraq. Problem description ------------------- Due to a various race conditions in the init level editing script /sbin/rctab it is possible for any local user to overwrite any system's file with arbitrary data. This may...

SuSE 6.x/7.0 - MkDir Error Handling rctab Race Condition (2)

source: https://www.securityfocus.com/bid/2207/info rctab is the Run Control Tab script included with the SuSE distribution of the Linux Operating System. SuSE is a freely available, Open Source Operating system maintained by SuSE Incorporated. A race condition in the rctab script could allow an...

tar-symlink.txt

Title : GNU tar Tape ARchive symlinkvulnerability Author : Marco van Berkum Organisation : OBIT b.v. URL : http://www.obit.nl Email : [email protected] Date : 06-01-2001 The usefull program tar Tape ARchive is used by all UNIX, Linux and BSD versions around and is used to ARCHIVE files to disk o...

Solaris 2.7/2.8 Catman - Local Insecure tmp Symlink

!/usr/local/bin/perl -w The problem is catman creates files in /tmp insecurly. They are based on the PID of the catman process, catman will happily clobber any files that are symlinked to that file. The idea of this script is to create a block of symlinks to the target file with the current PID a...

Уязвимость glint

Уязвимость символьных линков позволяет испортить любой системный файл...

Дырка в Extent RBS

Обратный путь в директории к параметру программы Newuser позволяет получить доступ к любому системному файлу...

Очередная дырка в Sambar

Search.dll позволяет обратиться к любому файлу в системе используя полный путь...

Дырка в photoalbum

Обратный путь в директориях позволяет получить любой системный файл через explorer.php...

Дырка в QNX Voyager

Обратный путь в директориях позволяет доступ к любым системным файлам...

Poll It CGI data_dir Parameter Arbitrary File Access

'PollItSSIv2.0.cgi' is installed. This CGI has a well known security flaw that lets an attacker retrieve any file from the remote system, e.g. /etc/passwd. %NASLMINLEVEL 70300 This script was written by Thomas Reinke See the Nessus Scripts License for details Changes by Tenable: - attempt to read...

Linux Kernel 2.2.122.2.142.3.99 (RedHat 6.x) - Socket Denial of Service

Linux Kernel 2.2.122.2.142.3.99 RedHat 6.x - Socket Denial of Service / source: https://www.securityfocus.com/bid/1072/info A denial of service exists in Linux kernels, as related to Unix domain sockets ignoring limits as set in /proc/sys/net/core/wmemmax. By creating successive Unix domain...

CVE-1999-0663

A system-critical program, library, or file has a checksum or other integrity measurement that indicates that it has been modified...

altavista.txt

hola, more bugs in the AV-Search thing .. using uri-encoded strings it is possible to view "any" file on the system .. examples: unixxxsss ... http://server:port/cgi-bin/query?mss=%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f/etc/passwd or on an micro$oft IIS...

icq99.web.server.txt

Date: Mon, 5 Apr 1999 23:50:56 +0200 From: Jan Vogelgesang To: [email protected] Subject: security hole in ICQ-Webserver Hi, Some days ago i've read a message here in Bugtraq from Ronald A. Jarell about a vulnerability in the ICQ-Webserver . I tried to reproduce this vulnerability with my...