catman-race.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Solaris 2.7/2.8 catman temp file vulnerability. Larry W. Cashdollar Vapid Labs Date Published: 12/18/2000 Advisory ID: 11242000-02 Risk: Low Title: catman temp file vulnerability. Class: Design Error Remotely Exploitable: no Locally Exploitable: Yes...

Catman file clobbering vulnerability Solaris 2.x

Solaris 2.7/2.8 catman temp file vulnerability. Larry W. Cashdollar Vapid Labs Date Published: 12/18/2000 Advisory ID: 11242000-02 Risk: Low Title: catman temp file vulnerability. Class: insecure temp file handling. Remotely Exploitable: no Locally Exploitable: Yes Vulnerability Description:...

[SECURITY] New version of xpdf released

Package : xpdf Problem type : local exploit Debian-specific: no xpdf as distributed in Debian GNU/Linux 2.2 suffered from two problems: 1. creation of temporary files was not done safely which made xpdf vulnerable to a symlink attack. 2. when handling URLs in documents no checking was done for...

Solaris 2.5.1 lp lpsched - Symlink

Solaris 2.5.1 lp lpsched - Symlink !/bin/sh lpNet & temp file exploit: break lp, then use lp priv to break root or bin, etc.... Written by: Chris Sheldon [email protected] Tested on Solaris-2.5.1: SunOS testhost 5.5.1 Generic sun4m sparc SUNW,SPARCstation-20 Caveat: This system is running...

Solaris 2.5.1 lp / lpsched - Symlink

!/bin/sh lpNet & temp file exploit: break lp, then use lp priv to break root or bin, etc.... Written by: Chris Sheldon [email protected] Tested on Solaris-2.5.1: SunOS testhost 5.5.1 Generic sun4m sparc SUNW,SPARCstation-20 Caveat: This system is running without patches. Sun released patch...