Important: Red Hat Security Advisory: lha security update

An updated lha package that fixes a buffer overflow is now available. LHA is an archiving and compression utility for LHarc format archives. Lukasz Wojtow discovered a stack-based buffer overflow in all versions of lha up to and including version 1.14. A carefully created archive could allow an...

security flaw

Buffer overflow in the extractone function from lhext.c in LHA may allow attackers to execute arbitrary code via a long w working directory command line option, a different issue than CVE-2004-0769. NOTE: this issue may be REJECTED if there are not any cases in which LHA is setuid or is otherwise...

security flaw

Buffer overflow in LHA 1.14 and earlier allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via unknown vectors related to "command line processing," a different vulnerability than CVE-2004-0771. NOTE: this issue may be REJECTED if there are not any case...

CVE-2004-0108

The isag utility, which processes sysstat data, allows local users to overwrite arbitrary files via a symlink attack on temporary files, a different vulnerability than CAN-2004-0107...

CVE-2004-0108

The isag utility, which processes sysstat data, allows local users to overwrite arbitrary files via a symlink attack on temporary files, a different vulnerability than CAN-2004-0107...

CVE-2004-0108

The CVE-2004-0108 entry concerns the isag utility (used for processing sysstat data) and describes a local privilege issue where a symlink attack on temporary files allows local users to overwrite arbitrary files. The vulnerability arises from insecure temporary file handling rather than remote e...

Possible root compromose with bsdmainutils 6.0.x < 6.0.15 (Debian testing/unstable)

Possible root compromise with calendar bsdmainutils 6.0.x 6.0.15 -------------------------------------------------------------------- Introduction ------------ The calendar utility is a handy little tool that informs you about upcoming events. Each user can define his/her own calendar events. In...

RHEL 3 : lha (RHSA-2004:323)

An updated lha package that fixes a buffer overflow is now available. LHA is an archiving and compression utility for LHarc format archives. Lukasz Wojtow discovered a stack-based buffer overflow in all versions of lha up to and including version 1.14. A carefully created archive could allow an...

Debian bsdmainutils 6.0.14 - Calendar Information Disclosure

// source: https://www.securityfocus.com/bid/11077/info The calendar utility contained in the bsdmainutils package on Debian GNU/Linux systems is reported susceptible to an information disclosure vulnerability. This is due to a lack of proper file authorization checks by the application. The...

GLSA-200404-04 : Multiple vulnerabilities in sysstat

The remote host is affected by the vulnerability described in GLSA-200404-04 Multiple vulnerabilities in sysstat There are two vulnerabilities in the way sysstat handles symlinks: The isag utility, which displays sysstat data in a graphical format, creates a temporary file in an insecure manner...

CVE-2004-0213

Utility Manager in Windows 2000 launches winhlp32.exe while Utility Manager is running with raised privileges, which allows local users to gain system privileges via a "Shatter" style attack that sends a Windows message to cause Utility Manager to launch winhlp32 by directly accessing the context...

Mandrake Linux Security Advisory : sharutils (MDKSA-2002:052)

The uudecode utility creates output files without checking to see if it is about to write to a symlink or pipe. This could be exploited by a local attacker to overwrite files or lead to privilege escalation if users decode data into share directories, such as /tmp. This update fixes this...

Mandrake Linux Security Advisory : util-linux (MDKSA-2002:047)

Michal Zalewski found a vulnerability in the util-linux package with the chfn utility. This utility allows users to modify some information in the /etc/passwd file, and is installed setuid root. Using a carefully crafted attack sequence, an attacker can exploit a complex file locking and...

Mandrake Linux Security Advisory : util-linux (MDKSA-2003:016)

The util-linux package provides the mcookie utility, a tool for generating random cookies that can be used for X authentication. The util-linux packages that were distributed with Mandrake Linux 8.2 and 9.0 had a patch that made it use /dev/urandom instead of /dev/random, which resulted in the...

SoX: Multiple buffer overflows

Background SoX is a command line utility that can convert various formats of computer audio files in to other formats. Description Ulf Harnhammar discovered two buffer overflows in the sox and play commands when handling WAV files with specially crafted header fields. Impact By enticing a user to...

Microsoft Windows Server 2000 - Utility Manager All-in-One (MS04-019)

Microsoft Windows Server 2000 - Utility Manager All-in-One MS04-019 / COROMPUTER2004 Crpt Utility Manager exploit v2.666 modified by kralor Crpt It gets system language and sets windows names to work on any win2k :P Feel free to add other languages : v2.666: added autonomous allinone remote...

MS Windows 2k Utility Manager (All-In-One) Exploit (MS04-019)

Exploit for unknown platform in category local exploits ============================================================= MS Windows 2k Utility Manager All-In-One Exploit MS04-019 ============================================================= / COROMPUTER2004 Crpt Utility Manager exploit v2.666 modifi...

Microsoft Windows Server 2000 - Utility Manager All-in-One (MS04-019)

/ COROMPUTER2004 Crpt Utility Manager exploit v2.666 modified by kralor Crpt It gets system language and sets windows names to work on any win2k :P Feel free to add other languages : v2.666: added autonomous allinone remote exploitation system ; It can be executed through poor cmd.exe shells like...

MS Windows 2000 Universal Language Utility Manager Exploit (MS04-019)

Exploit for unknown platform in category local exploits ===================================================================== MS Windows 2000 Universal Language Utility Manager Exploit MS04-019 ===================================================================== / COROMPUTER2004 Crpt Utility...

Microsoft Windows Server 2000 - Universal Language Utility Manager (MS04-019)

Microsoft Windows Server 2000 - Universal Language Utility Manager MS04-019 / COROMPUTER2004 Crpt Utility Manager exploit v1.666 modified by kralor Crpt It gets system language and sets windows names to work on any win2k :P Feel free to add other languages : You know where we are.. COROMPUTER2004...