GNU Coreutils pam_succeed_if PAM模块本地绕过认证漏洞

BUGTRAQ ID: 30363 CVECAN ID: CVE-2008-1946 GNU核心工具（Coreutils）是GNU操作系统所使用的基本文件、shell和文本操控工具。 Coreutils软件包没有对su命令正确地使用配置文件中的pamsucceedif可插拔认证模块（PAM），如果运行su的用户知道目标帐号的口令的话，任何本地用户都可以使用这个命令更改锁定的或过期的用户帐号。 GNU Coreutils 5.2.1 RedHat ------ RedHat已经为此发布了一个安全公告（RHSA-2008:0780-01）以及相应补丁:...

CSRF: don't underestimate my damage and ability to attack-vulnerability warning-the black bar safety net

Author: iceskysl Source: IceskYsl@1sters! CSRF, this attack way, although proposed a long time in the 2 0 0 6 time of year there, but this sleepy attack the giants until recently only gradually into our line of sight, what is CSRF what is that harm in the end how much? Common use is the How to,...

CVE-2008-1396

Plone CMS 3.x uses invariant data a client username and a server secret when calculating an HMAC-SHA1 value for an authentication cookie, which makes it easier for remote attackers to gain permanent access to an account by sniffing the network...

CVE-2008-0900

CVE-2008-0900 affects BEA WebLogic Server and Express versions 8.1 SP4–SP6, 9.2 MP1, and 10.0. The root cause is a session fixation vulnerability that allows remote authenticated users to hijack web sessions via unknown vectors. Affected components are web session handling functions in these BEA ...

March Networks DVR 3204 Logfile Information Disclosure Exploit

No description provided by source. !/usr/bin/perl March Networks DVR 3204 Logfile Information Disclosure Exploit Since configuration of the IP address, user console and root is carried out over the "administrator console", the vulnerability lies within Watchdog's HTTP server application. Any user...

sip-fraud.txt

SIP Digest Access Authentication RELAY-ATTACK for Toll-Fraud In this post, we would like to inform about a potential Authentication vulnerability in SIP, where all SIP equipments using Digest Access Authentication which can issue re-INVITEs are vulnerable. The problem lies in an attack scenario,...

Important: Red Hat Security Advisory: mysql security update

Updated mysql packages that fix a security flaw are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server...

CVE-2007-4074

The default configuration of Centre for Speech Technology Research CSTR Festival 1.95 beta aka 2.0 beta on Gentoo Linux, SUSE Linux, and possibly other distributions, is run locally with elevated privileges without requiring authentication, which allows local and remote attackers to execute...

Moderate: evolution-data-server security update

1.8.0-15.0.3.el5 - Add patch for RH bug 235289 APOP authentication vulnerability. 1.8.0-15.0.2.el5 - Remove Makefile.in changes that accidentally slipped into the patch. 1.8.0-15.0.1.el5 - Add patch for RH bug 229707 timezone updates...

MIT krb5: makes sudo authentication issue MUCH worse.

On Wed, Jun 06, 2007 at 11:19:01PM -0400, Thor Lancelot Simon wrote: On Wed, Jun 06, 2007 at 09:57:25PM -0400, Thor Lancelot Simon wrote: But woe betide any system administrator who accidentally puts a Kerberos-enabled sudo on a host that's configured as a Kerberos client only! Actually, if you...

Moderate: evolution security update

2.0.2-35.0.2.el4 - Add missing BuildRequires scrollkeeper. 2.0.2-35.0.1.el4 - Add patch for RH bug 238565 APOP authentication vulnerability...

CVE-2007-0618

Unspecified vulnerability in 1 pop3d, 2 pop3ds, 3 imapd, and 4 imapds in IBM AIX 5.3.0 has unspecified impact and attack vectors, involving an "authentication vulnerability."...

CVE-2007-0618

Unspecified vulnerability in 1 pop3d, 2 pop3ds, 3 imapd, and 4 imapds in IBM AIX 5.3.0 has unspecified impact and attack vectors, involving an "authentication vulnerability."...

CVE-2007-0405

The LazyUser class in the AuthenticationMiddleware for Django 0.95 does not properly cache the user name across requests, which allows remote authenticated users to gain the privileges of a different user...

sqlledger.txt

Hi all; I have received many requests from security professions responsible for the security of Linux distros to move the full disclosure ahead. Now that I am reasonably sure that the full scope of the problem is known and fixed in the fix that Chris Murtagh and myself put together, it has been...

CentOS 4 : openldap / nss_ldap (CESA-2005:767)

Updated openldap and nssldap packages that correct a potential password disclosure issue and possible authentication vulnerability are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. OpenLDAP is an open source suite of LDAP...

CVE-2006-1700

Buy.php in Aweb Scripts Seller uses predictable cookies for authentication based on the time and the script number, which allows remote attackers to bypass authentication...

CVE-2006-0724

profile.php in Reamday Enterprises Magic News Lite 1.2.3, when registerglobals is enabled, allows remote attackers to modify program behavior, potentially bypassing authentication controls, via modified 1 action, 2 passwd, 3 adminpassword, 4 newpasswd, and 5 confirmpasswd variables, which are not...

Code injection

Direct static code injection vulnerability in edit.php in ACal Calendar Project 2.2.5 allows authenticated users to execute arbitrary PHP code via 1 the edit=header value, which modifies header.php, or 2 the edit=footer value, which modifies footer.php. NOTE: this issue might be resultant from th...

CVE-2005-3532

authpam.c in courier-authdaemon for Courier Mail Server 0.37.3 through 0.52.1, when using pamtally, does not call the pamacctmgmt function to verify that access should be granted, which allows attackers to authenticate to the server using accounts that have been disabled...