CVE-2008-1078

expn in the am-utils and net-fs packages for Gentoo, rPath Linux, and other distributions, allows local users to overwrite arbitrary files via a symlink attack on the expnPID temporary file. NOTE: this is the same issue as CVE-2003-0308.1...

CVE-2008-1078

CVE-2008-1078 affects the expn component of am-utils (and related net-fs usage) on Gentoo, rPath Linux, and other distros. The issue is an insecure temporary-file handling in expn that allows a local user to perform a symlink attack on expn[PID], enabling overwriting of arbitrary files. This vuln...

Linux Kernel copy_from_user_mmap_sem()函数内存访问漏洞

BUGTRAQ ID: 27796 CVECAN ID: CVE-2008-0010 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的实现上存在漏洞，本地攻击者可能利用此漏洞获取内核内存的敏感信息。 Linux Kernel的fs/splice.c文件中的copyfromusermmapsem函数未经验证用户提供的指针便使用copyfromuserinatomic拷贝了用户进程内存中的数据： ---8--- fs/splice.c:1188 ---8--- partial = copyfromuserinatomicdst, src, n;...

Linux Kernel vmsplice_to_user()函数本地权限提升漏洞

BUGTRAQ ID: 27799 CVECAN ID: CVE-2008-0009 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的实现上存在漏洞，本地攻击者可能利用此漏洞提升自己的权限。 Linux Kernel的fs/splice.c文件中的vmsplicetouser函数错误地引用了用户提供的内存指针: ---8--- fs/splice.c:1378 ---8--- error = getuserbase, &iov-iovbase; / ... / if unlikely!base error = -EFAULT; break; ...

Null pointer dereference

The copyfromusermmapsem function in fs/splice.c in the Linux kernel 2.6.22 through 2.6.24 does not validate a certain userspace pointer before dereference, which allow local users to read from arbitrary kernel memory locations...

CVE-2008-0009

The CVE-2008-0009 entry is supported by connected documents: it affects Linux kernel 2.6.22–2.6.24 where vmsplice_to_user dereferences a userspace pointer without validation, enabling local access to kernel memory. The issue is a local privilege‑escalation vulnerability; remediation is associated...

Sun Solaris I_PEEK IOCTL处理器信息泄露漏洞

Sun Solaris是一款商业性质的操作系统。 Sun Solaris IPEEK IOCTL处理器存在整数无符号错误，本地攻击者可以利用漏洞获得内存敏感信息。 Sun Solaris内核提供的FIFO FS先进先出文件系统服务用于IPC通信，一个FIFO代表文件系统中的节点类似windows系统中的有名管道概念。 kernel FIFOs ioctl处理器存在漏洞，IPEEK ioctl用于进程查看包含在FIFO中的字节数，而实际该操作并清除队列中的消息。这个命令的其中一个参数代表要取数的字节数，是符号整数值，由于这个参数没有正确验证，提供负值可导致内核内存内容被泄露。 Sun...

iDefense Security Advisory 10.02.07: Sun Microsystems Solaris FIFO FS Information Disclosure Vulnerability

Sun Microsystems Solaris FIFO FS Information Disclosure Vulnerability iDefense Security Advisory 10.02.07 http://labs.idefense.com/intelligence/vulnerabilities/ Oct 02, 2007 I. BACKGROUND Solaris is a UNIX operating system developed by Sun Microsystems. More information can be found at the...

HP-UX Security Patch : PHKL_33500

Probe,IDDS,PM,VM,PA-8700,AIO,T600,FS,PDC,CLK %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if !definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid26419; scriptversion"1.8"; scriptsetattributeattribute:"pluginmodificationdate",...

HP-UX Security Patch : PHKL_34341

Probe,IDDS,PM,VM,PA-8700,AIO,T600,FS,PDC,CLK %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if !definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid26428; scriptversion"1.8"; scriptsetattributeattribute:"pluginmodificationdate",...

HP-UX Security Patch : PHKL_27759

Probe,IDDS,PM,VM,PA-8700,AIO,T600,FS,Hang %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if !definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid26377; scriptversion"1.8"; scriptsetattributeattribute:"pluginmodificationdate",...

HP-UX Security Patch : PHKL_28053

Probe,IDDS,PM,VM,PA-8700,AIO,T600,FS,PDC %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if !definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid26382; scriptversion"1.8"; scriptsetattributeattribute:"pluginmodificationdate",...

HP-UX Security Patch : PHKL_27919

Probe,IDDS,PM,VM,PA-8700,AIO,T600,FS,PDC %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if !definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid26380; scriptversion"1.8"; scriptsetattributeattribute:"pluginmodificationdate",...

HP-UX Security Patch : PHKL_27710

VVOS Probe,IDDS,PM,VM,PA-8700,AIO,T600,FS %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if !definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid26376; scriptversion"1.8"; scriptsetattributeattribute:"pluginmodificationdate",...

Important: kernel security and bug fix update

2.6.18-8.1.6.0.1.el5 -Fix bonding primary=ethX so it picks correct network Bert Barbe IT 101532 ORA 5136660 -Add entropy module option to e1000 John Sobecki ORA 6045759 -Add entropy module option to bnx2 John Sobecki ORA 6045759 2.6.18.8-1.6.el5 - bluetooth close information leaks in setsockopt...

Linux Kernel 2.6.17 - 'Sys_Tee' Local Privilege Escalation

source: https://www.securityfocus.com/bid/22823/info The Linux kernel is prone to a local privilege-escalation vulnerability. Exploiting this issue allows local attackers to gain superuser privileges, facilitating the complete compromise of affected computers. Linux 2.6.16 - 2.6.17.6 local root...

Linux Kernel 2.6.17 - Sys_Tee Local Privilege Escalation

Linux Kernel 2.6.17 - SysTee Local Privilege Escalation source: https://www.securityfocus.com/bid/22823/info The Linux kernel is prone to a local privilege-escalation vulnerability. Exploiting this issue allows local attackers to gain superuser privileges, facilitating the complete compromise of...

Samba: Multiple vulnerabilities

Background Samba is a suite of SMB and CIFS client/server programs for UNIX. Description A format string vulnerability exists in the VFS module when handling AFS file systems and an infinite loop has been discovered when handling file rename operations. Impact A user with permission to write to a...

libgtop buffer overflow

Buffer overflow on /proc FS parsing...

CVE-2006-6304

The docoredump function in fs/exec.c in the Linux kernel 2.6.19 sets the flag variable to OEXCL but does not use it, which allows context-dependent attackers to modify arbitrary files via a rewrite attack during a core dump...