CVE-2001-0125

CVE-2001-0125 affects exmh 2.2 and earlier, where insecure handling of temporary files in /tmp (e.g., exmhErrorMsg) allows local users to overwrite files via a symlink attack. Connected advisories confirm the issue and note that newer versions (e.g., exmh 2.3.1+) fix the vulnerability by switchin...

CVE-2001-0109

rctab in SuSE 7.0 and earlier allows local users to create or overwrite arbitrary files via a symlink attack on the rctmp temporary file...

CVE-2001-0310

sort in FreeBSD 4.1.1 and earlier, and possibly other operating systems, uses predictable temporary file names and does not properly handle when the temporary file already exists, which causes sort to crash and possibly impacts security-sensitive scripts...

CVE-2001-0310

The issue is with the UNIX sort utility on FreeBSD 4.1.1 and earlier, where temporary files are created with predictable names and not properly handled when the file already exists. This can cause sort to crash, effectively denying service to scripts or administration tasks that rely on sort. Pub...

MDKSA-2001:043 - rpmdrake update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Linux-Mandrake Security Update Advisory Package name: rpmdrake Date: April 27th, 2001 Advisory ID: MDKSA-2001:043 Affected versions: 8.0 Problem Description: A temporary file vulnerability exists in rpmdrake. This updated rpmdrake corrects the problem...

[SECURITY] [DSA-053-1] nedit symlink attack

Package : nedit Problem type : insecure temporary file Debian-specific: no The nedit Nirvana editor package as shipped in the non-free section accompanying Debian GNU/Linux 2.2/potato had a bug in its printing code: when printing text it would create a temporary file with the to be printed text a...

VMware symlink problems

Problem description ---------------------- There is symlink vulnerability in the vmware-mount.pl script which comes with lates VMware. 2. Details ---------- While mounting virtual disk drives using the vmware-mount.pl script, a temporary file named vmware-mount.pl.PID where PID is the current...

Проблемы в exuberant-ctags (symbolic link)

Проблема символьных линков при создании временных файлов...

CVE-2001-0235

Vulnerability in crontab allows local users to read crontab files of other users by replacing the temporary file that is being edited while crontab is running...

MDKSA-2001:029 - Mesa update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Linux-Mandrake Security Update Advisory Package name: Mesa Date: March 13th, 2001 Advisory ID: MDKSA-2001:029 Affected versions: 7.2 Problem Description: Ben Collins identified a temporary file race in the Utah-glx component of the Mesa package which...

FreeBSD-SA-01:25.kerberosIV

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:25 Security Advisory FreeBSD, Inc. Topic: Local and remote vulnerabilities in Kerberos IV Category: core Module: libkrb, telnetd Announced: 2001-02-14 Credits: Jouko...

Дырка в sort (FreeBSD)

Небезопасная работа с временными файлами...

CVE-2000-1096

crontab by Paul Vixie uses predictable file names for a temporary file and does not properly ensure that the file is owned by the user executing the crontab -e command, which allows local users with write access to the crontab spool directory to execute arbitrary commands by creating...

CVE-2000-1096

crontab by Paul Vixie uses predictable file names for a temporary file and does not properly ensure that the file is owned by the user executing the crontab -e command, which allows local users with write access to the crontab spool directory to execute arbitrary commands by creating...

Дырка в ksh

Проблема при создании временных файлов при перенаправлении ввода аналогична sh, tcsh bash и др...

Дырка в patchadd под Solaris

Уязвимость символьных линков + некорректные разрешения на временные файлы...

Solaris patchadd(1) (3) symlink vulnerabilty

Greetings Bugtraq, I was playing around with patchadd and the bug was found when I issued a "truss -f -o patch.log patchadd patch" where patch was a tarball and then patchadd omitted an error because of it being a tarball, so then when I went through the debug output, i found out that there was a...

Pine (Local Message Grabber) Exploit

Exploit for linux platform in category local exploits ==================================== Pine Local Message Grabber Exploit ==================================== !/bin/sh Grab local pine messages Usage: ./monpine.sh victim pine must use following settings email protected http://hacksware.com x...

Pine (Local Message Grabber) - Local Message Read

Pine Local Message Grabber - Local Message Read !/bin/sh Grab local pine messages Usage: ./monpine.sh victim pine must use following settings [email protected] http://hacksware.com x enable-alternate-editor-cmd x enable-alternate-editor-implicitly editor = /usr/bin/vi PID=$1 PICOFILE=printf...

Pine (Local Message Grabber) - Local Message Read

!/bin/sh Grab local pine messages Usage: ./monpine.sh victim pine must use following settings [email protected] http://hacksware.com x enable-alternate-editor-cmd x enable-alternate-editor-implicitly editor = /usr/bin/vi PID=$1 PICOFILE=printf "/tmp/pico.%.6d" $PID TRASHCAN=/tmp/.trashcan.date|se...