GNU libnss_db 2.2.3 库本地信息泄露漏洞

BUGTRAQ ID: 39132 CVE ID: CVE-2010-0826 nssdb软件包提供了一套C库扩展，允许将Berkeley DB数据库用作别名、组、主机、网络、协议、用户、RPC、服务和影子口令的主来源。 nssdb库在遇到解析错误时可能会显示DBCONFIG文件的某些内容，本地用户可以通过将DBCONFIG符号链接到受限制的文件上然后执行使用该库的suid root应用程序来读取敏感信息。 GNU libnssdb 2.2.3 厂商补丁： GNU --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

RedHat Update for nss_db RHSA-2010:0347-01

Check for the Version of nssdb OpenVAS Vulnerability Test RedHat Update for nssdb RHSA-2010:0347-01 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms...

RedHat Update for nss_db RHSA-2010:0347-01

Check for the Version of nssdb OpenVAS Vulnerability Test RedHat Update for nssdb RHSA-2010:0347-01 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms...

Moderate: Red Hat Security Advisory: nss_db security update

Updated nssdb packages that fix one security issue are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

nss_db: Information leak due the DB_CONFIG file read from current working directory

The Free Software Foundation FSF Berkeley DB NSS module aka libnss-db 2.2.3pre1 reads the DBCONFIG file in the current working directory, which allows local users to obtain sensitive information via a symlink attack involving a setgid or setuid application that uses this module...

[SECURITY] Fedora 13 Update: nss_db-2.2.3-0.3.pre1.fc13

Nssdb is a set of C library extensions which allow Berkeley Databases to be used as a primary source of aliases, ethers, groups, hosts, networks, protocol, users, RPCs, services, and shadow passwords instead of or in addition to using flat files or NIS. Install nssdb if your flat name service fil...

CVE-2010-0826

The Free Software Foundation FSF Berkeley DB NSS module aka libnss-db 2.2.3pre1 reads the DBCONFIG file in the current working directory, which allows local users to obtain sensitive information via a symlink attack involving a setgid or setuid application that uses this module...

CVE-2010-0826

The Free Software Foundation FSF Berkeley DB NSS module aka libnss-db 2.2.3pre1 reads the DBCONFIG file in the current working directory, which allows local users to obtain sensitive information via a symlink attack involving a setgid or setuid application that uses this module...

DEBIAN-CVE-2010-0826

The Free Software Foundation FSF Berkeley DB NSS module aka libnss-db 2.2.3pre1 reads the DBCONFIG file in the current working directory, which allows local users to obtain sensitive information via a symlink attack involving a setgid or setuid application that uses this module...

Design/Logic Flaw

The Free Software Foundation FSF Berkeley DB NSS module aka libnss-db 2.2.3pre1 reads the DBCONFIG file in the current working directory, which allows local users to obtain sensitive information via a symlink attack involving a setgid or setuid application that uses this module...

CVE-2010-0826

The Free Software Foundation FSF Berkeley DB NSS module aka libnss-db 2.2.3pre1 reads the DBCONFIG file in the current working directory, which allows local users to obtain sensitive information via a symlink attack involving a setgid or setuid application that uses this module...

CVE-2010-0826

The Free Software Foundation FSF Berkeley DB NSS module aka libnss-db 2.2.3pre1 reads the DBCONFIG file in the current working directory, which allows local users to obtain sensitive information via a symlink attack involving a setgid or setuid application that uses this module...

CVE-2010-0826

The CVE-2010-0826 issue affects the Free Software Foundation’s Berkeley DB NSS module (libnss-db) in the nss_db package (2.2.3pre1). The vulnerability arises because DB_CONFIG can be read from the current working directory, enabling a local attacker with setgid/setuid usage of the module to exfil...

CVE-2010-0826: Exposure of Sensitive Information to an Unauthorized Actor

The Free Software Foundation FSF Berkeley DB NSS module aka libnss-db 2.2.3pre1 reads the DBCONFIG file in the current working directory, which allows local users to obtain sensitive information via a symlink attack involving a setgid or setuid application that uses this module...

CVE-2010-0826

The Free Software Foundation FSF Berkeley DB NSS module aka libnss-db 2.2.3pre1 reads the DBCONFIG file in the current working directory, which allows local users to obtain sensitive information via a symlink attack involving a setgid or setuid application that uses this module...

[SECURITY] Fedora 13 Update: cups-1.4.2-34.fc13

The Common UNIX Printing System provides a portable printing layer for UNIX=C2=AE operating systems. It has been developed by Easy Software Produc ts to promote a standard printing solution for all UNIX vendors and users. CUPS provides the System V and Berkeley command-line interfaces...

Fedora Update for bind FEDORA-2010-0868

Check for the Version of bind OpenVAS Vulnerability Test Fedora Update for bind FEDORA-2010-0868 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms of...

Fedora Update for bind FEDORA-2010-0861

Check for the Version of bind OpenVAS Vulnerability Test Fedora Update for bind FEDORA-2010-0861 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms of...

[SECURITY] Fedora 11 Update: bind-9.6.1-4.P1.fc11

BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which resolves host names to IP addresses; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server ...

From the webshell to sniff for linux-vulnerability warning-the black bar safety net

Special thanks to the bridge brother! Long time no get too, and forgot how to in the linux below to sniff. Get a webshell is a linux machine and want to try sniffing him within the network of the database server. So with this article! First with backshell bounce a SHELL to the local. 我 用 的 是 xi4o...