159 matches found
Scientific Linux Security Update : policycoreutils on SL6.x, SL7.x i386/x86_64
Security Fixes : - It was found that the sandbox tool provided in policycoreutils was vulnerable to a TIOCSTI ioctl attack. A specially crafted program executed via the sandbox command could use this flaw to execute arbitrary commands in the context of the parent shell, escaping the sandbox...
policycoreutils security update
CentOS Errata and Security Advisory CESA-2016:2702 An update for policycoreutils is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base...
RedHat Update for policycoreutils RHSA-2016:2702-01
The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Amazon Linux AMI : policycoreutils (ALAS-2016-765)
It was found that the sandbox tool provided in policycoreutils was vulnerable to a TIOCSTI ioctl attack. A specially crafted program executed via the sandbox command could use this flaw to execute arbitrary commands in the context of the parent bash, escaping the sandbox. C Tenable Network...
Debian DLA-638-1 : policycoreutils security update
It was discovered that there was a sandbox escape via the 'TIOCSTI' ioctl in policycoreutils, a set of programs required for the basic operation of an SELinux-based system. For Debian 7 'Wheezy', this issue has been fixed in policycoreutils version 2.1.10-9+deb7u1. We recommend that you upgrade...
DLA-638-1 policycoreutils - security update
Bulletin has no description...
CVE-2006-7098
The Debian GNU/Linux 033-FNOSETSID patch for the Apache HTTP Server 1.3.34-4 does not properly disassociate httpd from a controlling tty when httpd is started interactively, which allows local users to gain privileges to that tty via a CGI program that calls the TIOCSTI ioctl...
DEBIAN-CVE-2013-6409
Debian adequate before 0.8.1, when run by root with the --user option, allows local users to hijack the tty and possibly gain privileges via the TIOCSTI ioctl...
CVE-2013-6409
Debian adequate before 0.8.1, when run by root with the --user option, allows local users to hijack the tty and possibly gain privileges via the TIOCSTI ioctl...
CVE-2013-6409
Debian adequate before 0.8.1, when run by root with the --user option, allows local users to hijack the tty and possibly gain privileges via the TIOCSTI ioctl...
CVE-2013-6409
Debian adequate before 0.8.1, when run by root with the --user option, allows local users to hijack the tty and possibly gain privileges via the TIOCSTI ioctl...
CVE-2013-6409
Debian adequate before 0.8.1, when run by root with the --user option, allows local users to hijack the tty and possibly gain privileges via the TIOCSTI ioctl...
Plash沙盒中进程TIOCSTI ioctl()权限提升漏洞
Plash是用于在沙盒中运行GNU/Linux程序的系统，以使程序只能获得最低权限。 Plash没有正确的限制沙盒中的进程通过TIOCSTI ioctl向终端的文件描述符插入字符，如果该终端上运行着shell的话，恶意的沙盒中进程就可能以该shell的权限执行任意命令。 Plash 1.17 临时解决方法： 代理访问stdin/stdout/stderr，通过cat管道传输： cat | pola-run ... 2&1 | cat 厂商补丁： Plash ----- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...
CVE-2007-1400
Plash permits sandboxed processes to open /dev/tty, which allows local users to escape sandbox restrictions and execute arbitrary commands by sending characters to a shell process on the same termimal via the TIOCSTI ioctl...
Design/Logic Flaw
Plash permits sandboxed processes to open /dev/tty, which allows local users to escape sandbox restrictions and execute arbitrary commands by sending characters to a shell process on the same termimal via the TIOCSTI ioctl...
CVE-2007-1400
Plash permits sandboxed processes to open /dev/tty, which allows local users to escape sandbox restrictions and execute arbitrary commands by sending characters to a shell process on the same termimal via the TIOCSTI ioctl...
CVE-2007-1400
Plash allows sandboxed processes to open /dev/tty via TIOCSTI, enabling local users to escape sandbox restrictions and send characters to a shell process on the same terminal to execute arbitrary commands. This CVE (CVE-2007-1400) is documented with a local-privilege/escalation impact and does no...
CVE-2006-7098
The Debian GNU/Linux 033-FNOSETSID patch for the Apache HTTP Server 1.3.34-4 does not properly disassociate httpd from a controlling tty when httpd is started interactively, which allows local users to gain privileges to that tty via a CGI program that calls the TIOCSTI ioctl...
CVE-2006-7098
The Debian GNU/Linux 033-FNOSETSID patch for the Apache HTTP Server 1.3.34-4 does not properly disassociate httpd from a controlling tty when httpd is started interactively, which allows local users to gain privileges to that tty via a CGI program that calls the TIOCSTI ioctl...