Code injection

Unspecified vulnerability in Sun Solaris 9, when Solaris Auditing BSM is enabled for file read, write, attribute modify, create, or delete audit classes, allows local users to cause a denial of service panic via unknown vectors, possibly related to the auditsavepath function...

Linux Security Auditing Tool不安全临时文件建立漏洞

Linux Security Auditing Tool是一款安全审核工具。 Linux Security Auditing Tool不安全建立临时文件，本地攻击者可以利用漏洞覆盖敏感文件，造成拒绝服务攻击。 攻击者可以利用符号链接进行攻击。目前没有详细漏洞细节提供。 Linux Security Auditing Tool 0.9.2 Gentoo Linux 目前没有解决方案提供： http://usat.sourceforge.net/...

Code injection

The Linux Security Auditing Tool LSAT allows local users to overwrite arbitrary files via a symlink attack on temporary files, as demonstrated using /tmp/lsat1.lsat...

CVE-2007-1500

The Linux Security Auditing Tool LSAT allows local users to overwrite arbitrary files via a symlink attack on temporary files, as demonstrated using /tmp/lsat1.lsat...

CVE-2007-1500

The Linux Security Auditing Tool LSAT allows local users to overwrite arbitrary files via a symlink attack on temporary files, as demonstrated using /tmp/lsat1.lsat...

CVE-2007-1500

CVE-2007-1500 affects the Linux Security Auditing Tool (LSAT). The vulnerability arises from insecure temporary file handling: LSAT creates temporary files in /tmp with a predictable name, enabling a local attacker to exploit a symlink attack to overwrite arbitrary files with the caller’s privile...

Linux Security Auditing Tool symbolic links problem

Symbolic links problem on temporary file creation...

LSAT: Insecure temporary file creation

Background The Linux Security Auditing Tool LSAT is a post install security auditor which checks many system configurations and local network settings on the system for common security or configuration errors and for packages that are not needed. Description LSAT insecurely writes in /tmp with a...

Nessus Windows Scan Not Performed with Admin Privileges

The Nessus scanner testing the remote host has been given SMB credentials to log into the remote host, however these credentials do not have administrative privileges. Typically, when Nessus performs a patch audit, it logs into the remote host and reads the version of the DLLs on the remote host ...

Mandrake Linux Security Advisory : libpng (MDKSA-2006:209)

Buffer overflow in the pngdecompresschunk function in pngrutil.c in libpng before 1.2.12 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors related to 'chunk error processing,' possibly involving the 'chunkname'. CVE-2006-33...

Syslog PRIORITY Field Enforcement

Syslog is a standard for transporting event notification messages over IP networks to event message collectors, or Syslog servers. Syslog is often used for system management and security auditing. Syslog servers, by default, listen on UDP port 514.Also, it is possible to have event message relays...

CentOS 4 : openssh (CESA-2006:0044)

Updated openssh packages that fix bugs in sshd and add auditing of user logins are now available for Red Hat Enterprise Linux 4. This update has been rated as having low security impact by the Red Hat Security Response Team. OpenSSH is OpenBSD's SSH Secure SHell protocol implementation. This...

Fedora Core 5 : gdm-2.14.1-1.fc5.2 (2006-338)

Notes taken from upstream release mail - The sockets connection between the slaves and the GDM daemon is now better managed to better ensure that sockets are never left open. Brian Cameron - Corrected bug that causes a core dump when you click on gdmgreeter fields that have an id. Brian Cameron -...

openssh security update

CentOS Errata and Security Advisory CESA-2006:0044 Updated openssh packages that fix bugs in sshd and add auditing of user logins are now available for Red Hat Enterprise Linux 4. This update has been rated as having low security impact by the Red Hat Security Response Team. OpenSSH is OpenBSD's...

imlock2006.txt

IM Lock 2006 - Insecure Registry Permission Vulnerability --------------------------------------------------------- Application: IM Lock 2006 Vendor: www.comvigo.com Corporation: Comvigo, Inc. Version: Latest: 2 March 2006 - Home Edition, Enterprise & Professional Description: IM Lock 2006...

RHEL 4 : openssh (RHSA-2006:0044)

Updated openssh packages that fix bugs in sshd and add auditing of user logins are now available for Red Hat Enterprise Linux 4. This update has been rated as having low security impact by the Red Hat Security Response Team. OpenSSH is OpenBSD's SSH Secure SHell protocol implementation. This...

Low: Red Hat Security Advisory: openssh security update

Updated openssh packages that fix bugs in sshd and add auditing of user logins are now available for Red Hat Enterprise Linux 4. This update has been rated as having low security impact by the Red Hat Security Response Team. OpenSSH is OpenBSD's SSH Secure SHell protocol implementation. This...

Code injection

BEA WebLogic Server and WebLogic Express 8.1 through SP4, when configuration auditing is enabled and a password change occurs, stores the old and new passwords in cleartext in the DefaultAuditRecorder.log file, which could allow attackers to gain privileges...

CVE-2006-0426

BEA WebLogic Server and WebLogic Express 8.1 through SP4, when configuration auditing is enabled and a password change occurs, stores the old and new passwords in cleartext in the DefaultAuditRecorder.log file, which could allow attackers to gain privileges...

CVE-2006-0426

BEA WebLogic Server and WebLogic Express 8.1 through SP4, when configuration auditing is enabled and a password change occurs, stores the old and new passwords in cleartext in the DefaultAuditRecorder.log file, which could allow attackers to gain privileges...