USN-43-1: groff utility vulnerabilities

Javier Fernández-Sanguino Peña discovered that the auxiliary scripts "eqn2graph" and "pic2graph" created temporary files in an insecure way, which allowed exploitation of a race condition to create or overwrite files with the privileges of the user invoking the program...

RHEL 2.1 / 3 : zip (RHSA-2004:634)

An updated zip package that fixes a buffer overflow vulnerability is now available. The zip program is an archiving utility which can create ZIP-compatible archives. A buffer overflow bug has been discovered in zip when handling long file names. An attacker could create a specially crafted path...

DXFScope 0.2 - Remote Client-Side Buffer Overflow

DXFScope 0.2 - Remote Client-Side Buffer Overflow source: https://www.securityfocus.com/bid/11986/info A remote, client-side buffer overflow vulnerability reportedly affects the DXFscope utility. This issue is due to a failure of the application to properly sanitize user-supplied input prior to...

GLSA-200412-09 : ncpfs: Buffer overflow in ncplogin and ncpmap

The remote host is affected by the vulnerability described in GLSA-200412-09 ncpfs: Buffer overflow in ncplogin and ncpmap Karol Wiesek discovered a buffer overflow in the handling of the '-T' option in the ncplogin and ncpmap utilities, which are both installed as SUID root by default. Impact : ...

file: Arbitrary code execution

Background file is a utility used to identify the type of a file. Description A possible stack overflow has been found in the ELF header parsing code of file. Impact An attacker may be able to create a specially crafted ELF file which, when processed with file, may allow the execution of arbitrar...

[SA13340] Sun Solaris ping Utility Privilege Escalation Vulnerability

TITLE: Sun Solaris ping Utility Privilege Escalation Vulnerability SECUNIA ADVISORY ID: SA13340 VERIFY ADVISORY: http://secunia.com/advisories/13340/ CRITICAL: Less critical IMPACT: Privilege escalation WHERE: Local system OPERATING SYSTEM: Sun Solaris 9 http://secunia.com/product/95/ Sun Solaris...

Mandrake Linux Security Advisory : a2ps (MDKSA-2004:140)

The GNU a2ps utility fails to properly sanitize filenames, which can be abused by a malicious user to execute arbitrary commands with the privileges of the user running the vulnerable application. The updated packages have been patched to prevent this problem. %NASLMINLEVEL 70300 C Tenable Networ...

helvis -- arbitrary file deletion problem

The setuid root elvprsv utility, used to preserve recovery helvis files, can be abused by local users to delete with root privileges. The problem is that elvprsv deletes files when it thinks they have become corrupt. When elvprsv is pointed to a normal file then it will almost always think the fi...

helvis -- information leak vulnerabilities

Once a recovery file has been preserved by the setuid root elvprsv utility it is placed in a worldreadable directory with worldreadable permissions. This possibly allows sensitive information to leak. In addition to this information leak, it is possible for users to recover files that belong to...

CVE-2004-0917

The default installation of Vignette Application Portal installs the diagnostic utility without authentication requirements, which allows remote attackers to gain sensitive information, such as server and OS version, and conduct unauthorized activities via an HTTP request to /diag...

[Full-Disclosure] FreeBSD Security Advisory FreeBSD-SA-04:16.fetch

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-04:16.fetch Security Advisory The FreeBSD Project Topic: Overflow error in fetch Category: core Module: fetch Announced: 2004-11-18 Credits: Colin Percival Affect...

FreeBSD : SA-04:16.fetch

The remote host is running a version of FreeBSD which contains a flaw in the 'fetch' utility. 'fetch' is a command-line tool used to retrieve data at a given URL. It is used among others by the FreeBSD port collection. There is an integer overflow condition in the processing of HTTP headers which...

FreeBSD-SA-04:16.fetch

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-04:16.fetch Security Advisory The FreeBSD Project Topic: Overflow error in fetch Category: core Module: fetch Announced: 2004-11-18 Credits: Colin Percival...

Debian DSA-594-1 : apache - buffer overflows

Two vulnerabilities have been identified in the Apache 1.3 webserver : - CAN-2004-0940 'Crazy Einstein' has discovered a vulnerability in the 'modinclude' module, which can cause a buffer to be overflown and could lead to the execution of arbitrary code. - NO VULN ID Larry Cashdollar has discover...

zip: Path name buffer overflow

Background zip is a compression and file packaging utility. Description zip does not check the resulting path length when doing recursive folder compression. Impact An attacker could exploit this by enticing another user or web application to create an archive including a specially-crafted path...

ncompress: Buffer overflow

Background ncompress is a utility handling compression and decompression of Lempel-Ziv archives, compatible with the original nix compress and uncompress utilities .Z extensions. Description compress and uncompress do not properly check bounds on command line options, including the filename. Larg...

sysstat symbolic links problem

unsafe isag utility temporary files creation...

[VulnWatch] Vignette Application Portal Unauthenticate Diagnostics

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 @stake, Inc. www.atstake.com Security Advisory Advisory Name: Vignette Application Portal Unauthenticated Diagnostics Release Date: 09-28-2004 Application: Vignette Application Portal Platform: Multiple Severity: Unauthenticated diagnostic functionali...

Debian DSA-460-1 : sysstat - insecure temporary file

Alan Cox discovered that the isag utility which graphically displays data collected by the sysstat tools, creates a temporary file without taking proper precautions. This vulnerability could allow a local attacker to overwrite files with the privileges of the user invoking isag. %NASLMINLEVEL 703...

Vignette Application Portal Diagnostic Utility Information Disclosure

The remote host is running Vignette Application Portal, a commercially available portal suite. There is an information disclosure vulnerability in the remote version of this software. An attacker can request the diagnostic utility which will disclose information about the remote site by requestin...