IBM AIX NFSv4 GID远程拒绝服务漏洞

Bugtraq ID:55546 CVE ID:CVE-2012-4817 IBM AIX是一款商业性质的操作系统。 IBM AIX NFS客户端实现不正确处理GID值，远程攻击者可以利用漏洞使NFS服务不稳定。 0 IBM Aix 7.1.1 IBM Aix 7.1 IBM Aix 6.1.7 IBM Aix 6.1.6 IBM AIX 6.1.5 IBM AIX 6.1.4 IBM AIX 6.1.3 IBM AIX 6.1.2 IBM AIX 6.1.1 IBM AIX 5.3.10 IBM AIX 5.3.9 IBM AIX 5.3.8 IBM AIX 5.3.7 IBM AIX...

CVE-2012-4817

The NFSv4 client implementation in IBM AIX 5.3, 6.1, and 7.1, and VIOS before 2.2.1.4-FP-25 SP-02, does not properly handle GID values, which allows remote attackers to cause a denial of service via unspecified vectors...

CVE-2012-4817: Undefined Security Weakness

The NFSv4 client implementation in IBM AIX 5.3, 6.1, and 7.1, and VIOS before 2.2.1.4-FP-25 SP-02, does not properly handle GID values, which allows remote attackers to cause a denial of service via unspecified vectors...

PT-2012-5595

Name of the Vulnerable Software and Affected Versions IBM AIX versions 5.3 through 7.1 VIOS versions prior to 2.2.1.4-FP-25 SP-02 Description The issue is related to the NFSv4 client implementation, which does not properly handle GID values. This allows remote attackers to cause a denial of servi...

AIX NFSv4 vulnerability

IBM SECURITY ADVISORY First Issued: Thu Sept 13 13:43:29 CDT 2012 | Updated: Wed Sept 26 13:25:50 CDT 2012 | Updated: Removed the cve.mitre.org reference | Updated: Thu Dec 12 12:55:11 CST 2013 | Update: 1. Added KEYs for parsing purposes | 2. Moved to OpenSSL signature The most recent version of...

Mandrake Linux Security Advisory : dump (MDKSA-2000:007)

Dump may cause security problem due to a buffer overflow. This package removes the set gid root on the dump exec file. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandrake Linux Security Advisory MDKSA-2000:007. T...

CVE-2012-1106: Undefined Security Weakness

The C handler plug-in in Automatic Bug Reporting Tool ABRT, possibly 2.0.8 and earlier, does not properly set the group GID permissions on core dump files for setuid programs when the sysctl fs.suiddumpable option is set to 2, which allows local users to obtain sensitive information...

cifs-utils security, bug fix, and enhancement update

4.8.1-10 - mount.cifs: don't allow unprivileged users to mount onto dirs they can't chdir into bz 812782 4.8.1-9 - cifs.upcall: use krb5snametoprincipal to construct principal name bz 805490 4.8.1-8 - mount.cifs: add backupuid=/backupgid= mount options bz 806337 4.8.1-7 - RFE: Improve selection o...

DEBIAN-CVE-2012-1053

The changeuser method in the SUIDManager lib/puppet/util/suidmanager.rb in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise PE Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, which allows local users to gain privileges via vectors...

nfs-utils security, bug fix, and enhancement update

1.0.9-60.0.1.el5 - Add support for resvport for unmonting orabug 13567018 1.0.9-60 - Updated idmapd.conf and idmapd.conf.man to reflect the static user name mapping 502707 - Fixed an umount regression introduced by bz 513094 bz 781931 1.0.9-59 - gss: turned of even more excessive syslogs bz 59309...

PYSEC-2011-17

Celery 2.1 and 2.2 before 2.2.8, 2.3 before 2.3.4, and 2.4 before 2.4.4 changes the effective id but not the real id during processing of the --uid and --gid arguments to celerybeat, celeryddetach, celeryd-multi, and celeryev, which allows local users to gain privileges via vectors involving...

Family Connections CMS 2.5.02.7.1 - less.php Remote Command Execution

Family Connections CMS 2.5.02.7.1 - less.php Remote Command Execution $theme = isset$argv1 ? $argv1 : 'default'; system"clear"; if fileexists"$dir/themes/$theme/style.css" echo "\n themes/$theme/style.css already exists.\n\n"; echo "Overwrite y/n ? "; $handle = fopen "php://stdin","r"; $line =...

CVE-2010-4875

The CVE-2010-4875 issue affects the Vodpod Video Gallery Plugin for WordPress, specifically version 3.1.5, where a Cross-site Scripting (XSS) vulnerability exists in vodpod_gallery_thumbs.php. The root cause is improper sanitization of the gid parameter, allowing remote attackers to inject arbitr...

CVE-2010-4875: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in vodpod-video-gallery/vodpodgallerythumbs.php in the Vodpod Video Gallery Plugin 3.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the gid parameter...

PT-2011-1810

Name of the Vulnerable Software and Affected Versions Vodpod Video Gallery Plugin version 3.1.5 Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the gid parameter in the vodpod-gallery/vodpod galler...

DSA-2283-1 krb5-appl - programming error

Bulletin has no description...

openSUSE Security Update : sudo (openSUSE-SU-2011:0050-1)

This update of sudo fixes : - CVE-2011-0010: Does ask for the user password for GID changes now. - CVE-2010-1646: CVSS v2 Base Score: 6.6 CWE-264: The secure environment option can handle multiple occurrence of PATH now. - CVE-2010-1163: CVSS v2 Base Score: 6.9 CWE-20: Improved command matching...

Mandriva Update for apache MDVSA-2011:057 (apache)

Check for the Version of apache OpenVAS Vulnerability Test Mandriva Update for apache MDVSA-2011:057 apache Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under t...

Design/Logic Flaw

The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileg...

FreeBSD Ports: sudo

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2011 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...