sudo upgrade fixes a potential vulnerability

New sudo packages are available to fix a security problem which may allow users to become root, or to execute arbitrary code as root. Here's the information from the Slackware 8.0 ChangeLog: ---------------------------- Thu Apr 25 12:00:50 PDT 2002 patches/packages/sudo.tgz: Upgraded to sudo-1.6....

CVE-2002-0096

The installation of Geeklog 1.3 creates an extra groupassignments record which is not properly deleted, which causes the first newly created user to be added to the GroupAdmin and UserAdmin groups, which could provide that user with administrative privileges that were not intended...

Unauthorized access via starscream/skank in ISS RealSecure

In default installation addtional rights are granted to user account skank from starscream host...

[SECURITY] [DSA 117-1] New CVS packages fix potential security problems

-------------------------------------------------------------------------- Debian Security Advisory DSA 117-1 [email protected] http://www.debian.org/security/ Martin Schulze March 5th, 2002 - -------------------------------------------------------------------------- Package : cvs Vulnerability...

Advisory for MP3Mystic

Advisory for MP3Mystic MP3Mystic is made by mp3mystic.com Site: http://www.mp3mystic.com by nemesystm of the DHC http://dhcorp.cjb.net - [email protected] ADV-0117 /-|=explanation=|- MP3Mystic is a webserver that lets a visitor browse your harddrive only showing MP3 files. It is vulnerable to...

[wsir-01/02-03] PGP 7.0 Split Key/Cached Passphrase Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 TITLE: PGP 7.0 Split Key/Cached Passphrase Vulnerability ADVISORY ID: WSIR-01/02-03 DISCOVERED BY: Patrik Birgersson, Wkit Security AB CONTACT: [email protected] CLASS: --- OBJECT: PGP Desktop Security 7.0 VENDOR: Network Associates Technology Inc...

Junsoft JSparm 4.0 - Logging Output File

Junsoft JSparm 4.0 - Logging Output File source: https://www.securityfocus.com/bid/2515/info JSparm is the Junsoft Performance Analysis Report Maker package. This software package provides an enhanced perfmon performance monitoring package and interface, as well as a performance report generation...

Vulnerability in FtpXQ Server

----- Begin Hush Signed Message from [email protected] ----- Vulnerability in FtpXQ Server Overview FtpXQ Server 2.0.93 is an ftp server available from http://www.datawizard.net and http://www.download.com. A vulnerability exists which allows an attacker to download files outside the ftp root...

APC WEB/SNMP Management Card (9606) Firmware 3.0 - Telnet Administration Denial of Service

source: https://www.securityfocus.com/bid/2430/info Symmetra is an Uninterruptable Power Supply manufactured by American Power Conversation Corporation APC. Symmetra supports network options that allow a remote administrator to access the system via telnet, and gather information from the power...

Novell Groupwise Client Vulnerability

Novell GroupWise Client read file/view vulnerability gw5.5epsp2--file view problems-- OS Affected Win 95/98/NT/2000/ME all sp levels Programs Affected GroupWise 5.5ep sp1 other versions of GroupWise 5 are probably vulnerable Discussion with zen polices or NT Polices installed properly on a window...

Glibc Local Root Exploit

Hi all, This has been bouncing around on vuln-dev and the debian-devel lists. It effects glibc = 2.1.9x and it would seem many if not all OSes using these versions of glibc. Ben Collins writes, "This wasn't supposed to happen, and the actual fix was a missing comma in the list of secure env vars...

Informix webdriver CGI Unauthenticated Database Access

The remote host may be running Informix Webdriver, a web-to-database interface. If not configured properly, this CGI script may give an unauthenticated attacker the ability to modify and even delete databases on the remote host. Nessus relied solely on the presence of this CGI; it did not try to...

Дырка в thttpd (ssi CGI file retrieval)

Исполользуя абсолютный путь в Cgi-скрипте ssi можно получить доступ к любому открытому файлу в системе...

Another thingy.

-- Standard disclaimer applies. I am speaking as a private person, -- and doing it in completely informal way, which shouldn't be interpreted -- in any other way but as my personal opinions and beliefs, which don't have -- to be true. Another thing to add to "commercial products security" thread...

IE 5.5/Outlook Express security vulnerability - GetObject() expose user's files

Georgi Guninski security advisory 22, 2000 IE 5.5/Outlook Express security vulnerability - GetObject expose user's files Systems affected: IE 5.5, Outlook Express,probably Outlook - Win98/2000. Probably other versions - have not tested. Risk: High Date: 26 September 2000 Legal Notice: This Adviso...

Mac Volumes & Junctions

I recently encountered a problem where, if you mount a partition to a path rather than a drive letter and then create a Macintosh volume for it, the permissions set for that volume will be ignored by Mac clients. This is what I did and you can too to reproduce the problem: 1. Create a generic use...

websitepro.txt

Sender: Bugtraq List From: Crono Subject: WebServer Pro 2.3.7 Vulnerability To: [email protected] -- WebSite Pro 2.3.7 Vulnerability -- WebSite Pro is a Web Server for Win95/98/NT plataforms. The vulnerability or bad server administration allow any user to create arbitrary files with...

Infosec.20000712.worldclient.2.1

Infosec Security Vulnerability Report No: Infosec.20000712.worldclient.2.1 Vulnerability Summary --------------------- Problem: The web server for remote access to e-mail in WorldClient 2.1 is vulnerable for root dot dot. It is possible to read and in some cases download any file known by name an...

Дырка в Sawmill

Специальным образом сконструированный GET-запрос позволяет прочитать первую строчку любого файла, причем приложение запускается от root...

glftpd.privpath.txt

Glftpd 1.18 till 1.21b8 current beta have a serious problem with the privpath directives.... It will probably be fixed in the comming 1.21b9 but i have included a quick fix in this one to prevent exploits of this bug. Thanx for Hoopy for the quick fix glftpd dev team. Problem: When you know the...