88 matches found
Oracle Auto Service Request File Clobber
Oracle Auto Service Request software package creates files insecurely in /tmp using time stamps instead of mkstemp. You can clobber root owned files if you know when around the time the root administrator will be using this utility. larry@oracle-os-lab01 tmp$ for x in seq 500 999; do ln -s...
Sun Update Manager /tmp Clobber
author http://packetstormsecurity.org/user/lcashdol/ Noticed this during routine patching. /tmp file clobbering vulnerability in Sun Update manager. 7/15/2012 noticed this while patching my lab solaris system tonight. larry@s0l4r1s:/tmp$ ln -s /etc/shadow com.sun.swup.client.LOCK updatemanager is...
Solaris Update manager and Sun Patch Cluster symlink vulnerability
Exploit for solaris platform in category local exploits ================================================================== Solaris Update manager and Sun Patch Cluster symlink vulnerability ================================================================== Symlink attack with Solaris Update manag...
xen security and bug fix update
3.0.3-64.el52.9 - More fixes for Xenstore unsafe data access CVE-2008-4405, rhbz 464817 - Fix block-detach regression due to CVE-2008-4405, rhbz 473882 3.0.3-64.el52.8 - Remove unneccessary patch & rebuild 3.0.3-64.el52.7 - Fix reboots after CVE-2008-4405 changes rhbz 471588 3.0.3-64.el52.6 -...
RHEL 2.1 : php (RHSA-2007:0081)
Updated PHP packages that fix several security issues are now available for Red Hat Enterprise Linux 2.1. This update has been rated as having important security impact by the Red Hat Security Response Team. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server....
RHEL 4 : php (RHSA-2007:0076)
The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2007:0076 advisory. - security flaw CVE-2007-0906, CVE-2007-0907, CVE-2007-0908, CVE-2007-0909, CVE-2007-0910, CVE-2007-0988 - php session extension information...
php session extension global variable clobber
PHP 4 before 4.4.5, and PHP 5 before 5.2.1, when registerglobals is enabled, allows context-dependent attackers to execute arbitrary code via deserialization of session data, which overwrites arbitrary global variables, as demonstrated by calling sessiondecode on a string beginning with...