3804 matches found
Information leakage via key file duplication during nCipher import
generatekey utility creates temporary PEM file and fails to delete it...
Low: Red Hat Security Advisory: python security update
An insecure use of a temporary file has been found in Python. Python is an interpreted, interactive, object-oriented programming language. Zack Weinberg discovered that os.execvpe from os.py in Python 2.2.1 and earlier creates temporary files with predictable names. This could allow local users t...
BitKeeper remote shell command execution/local vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Synopsis: BitKeeper remote shell command execution/local vulnerability Product: BitKeeper http://www.bitkeeper.com Version: 3.0.x Author: Maurycy Prodeus [email protected] Date: 11 November 2002 Issue: - ------ BitKeeper is a source management software. It...
Multiple cgihtml vulnerabilities
Overview -------- cgihtml is a collection of routines for parsing World Wide Web WWW Common Gateway Interface CGI input and outputting HyperText Markup Language HTML. http://www.eekim.com/software/cgihtml/ According to the authors website, it has potentially been used in the implementation of...
DEBIAN-CVE-2002-2267
bogopass in bogofilter 0.9.0.4 allows local users to overwrite arbitrary files via a symlink attack on the bogopass temporary file...
tmpwatch attack
File name may be changed or deleted during temporary files removing process leaving possibility of symlink attack...
[SECURITY] [DSA 202-1] New IM packages fix insecure temporary file creation
-------------------------------------------------------------------------- Debian Security Advisory DSA 202-1 [email protected] http://www.debian.org/security/ Martin Schulze December 3rd, 2002 http://www.debian.org/security/faq -...
bogofilter contrib/bogopass temp file vulnerability
bogofilter-SA-2002:01.bogopass Topic: vulnerability in bogopass Announcement: bogofilter-SA-2002:01 Writer: Matthias Andree Version: 1.00 Announced: 2002-11-29 Category: contrib Type: temporary file created insecurely Impact: anonymous local file destruction or change Credits: - Danger: medium th...
Bogofilter symbolic links problem
file /tmp/bogopass.$$ is created without symbolic link check...
CVE-2002-0920
CGIScript.net csPassword.cgi stores usernames and unencrypted passwords in the password.cgi.tmp temporary file while modifying data, which could allow local users and possibly remote attackers to gain privileges by stealing the file before it has been processed...
Symbolic links in python
os.py execvpe method creates temporary file insecurely...
CVE-2002-0920
CGIScript.net csPassword.cgi stores usernames and unencrypted passwords in the password.cgi.tmp temporary file while modifying data, which could allow local users and possibly remote attackers to gain privileges by stealing the file before it has been processed...
DSA-159 python - insecure temporary files
Bulletin has no description...
[SECURITY] [DSA 137-1] New mm packages fix insecure temporary file creation
-------------------------------------------------------------------------- Debian Security Advisory DSA 137-1 [email protected] http://www.debian.org/security/ Martin Schulze July 30th, 2002 - -------------------------------------------------------------------------- Package : mm Vulnerability...
DSA-137 mm - insecure temporary files
Bulletin has no description...
util-linux package vulnerable to privilege escalation when "ptmptmp" file is not removed properly when using "chfn" utility
Overview The util-linux package contains a race condition vulnerability that can be used to elevate privileges on the system. Description util-linux is shipped with Red Hat Linux and numerous other Linux distributions. It contains a collection of utility programs, such as fstab, mkfs, and chfn. T...
Sun Cobalt RaQ 4.0 - Predictable Temporary Filename Symbolic Link Attack
source: https://www.securityfocus.com/bid/5529/info A vulnerability has been reported in Cobalt RaQ that may allow attackers to obtain elevated privileges. The vulnerability exists in the /usr/lib/authenticate utility which is used by Apache for authentication purposes. Reportedly, the utility...
CVE-2001-1146
AllCommerce with debugging enabled in EnGarde Secure Linux 1.0.1 is affected. The issue stems from creating temporary files with predictable names, enabling local users to perform a symlink attack to modify files. The description in the Connected documents confirms the root cause as predictable t...
CVE-2001-1085
CVE-2001-1085 concerns Lmail 2.7 and earlier. The vulnerability arises from a symlink attack on a temporary file, allowing local users to overwrite arbitrary files. The reports indicate local access is required; impact is partial on confidentiality, integrity, and availability per the provided me...