Linux Security Auditing Tool不安全临时文件建立漏洞

Linux Security Auditing Tool是一款安全审核工具。 Linux Security Auditing Tool不安全建立临时文件，本地攻击者可以利用漏洞覆盖敏感文件，造成拒绝服务攻击。 攻击者可以利用符号链接进行攻击。目前没有详细漏洞细节提供。 Linux Security Auditing Tool 0.9.2 Gentoo Linux 目前没有解决方案提供： http://usat.sourceforge.net/...

CVE-2006-7094

ftpd, as used by Gentoo and Debian Linux, sets the gid to the effective uid instead of the effective group id before executing /bin/ls, which allows remote authenticated users to list arbitrary directories with the privileges of gid 0 and possibly enable additional attack vectors...

Mandrake Linux Security Advisory : libpng (MDKSA-2006:209)

Buffer overflow in the pngdecompresschunk function in pngrutil.c in libpng before 1.2.12 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors related to 'chunk error processing,' possibly involving the 'chunkname'. CVE-2006-33...

Gentoo Linux Acme Thttpd文件访问信息泄露漏洞

Gentoo Linux是一个基于源码包的Linux系统。 Gentoo的www-servers/thttpd软件包实现上存在漏洞，远程攻击者可能利用此漏洞非授权获取敏感信息。 如果在新的Gentoo baselayout中使用start-stop-daemon命令的话，就会导致thttpd在启动时将文档根设置为系统的根目录“/”，这允许非授权用户远程访问thttpd进程可读的所有系统文件。 Gentoo Linux 1.12.6 临时解决方法：...

CVE-2007-0664

thttpd before 2.25b-r6 in Gentoo Linux is started from the system root directory / by the Gentoo baselayout 1.12.6 package, which allows remote attackers to read arbitrary files...

CVE-2007-0664

thttpd before 2.25b-r6 in Gentoo Linux is started from the system root directory / by the Gentoo baselayout 1.12.6 package, which allows remote attackers to read arbitrary files...

Directory traversal

thttpd before 2.25b-r6 in Gentoo Linux is started from the system root directory / by the Gentoo baselayout 1.12.6 package, which allows remote attackers to read arbitrary files...

CVE-2007-0664

thttpd before 2.25b-r6 in Gentoo Linux is started from the system root directory / by the Gentoo baselayout 1.12.6 package, which allows remote attackers to read arbitrary files...

CVE-2007-0664

CVE-2007-0664 affects thttpd prior to 2.25b-r6 when started from the system root (/) by Gentoo baselayout 1.12.6, causing the web server root to be "/" and enabling remote attackers to read arbitrary files. The underlying change to start-stop-daemon is cited in Gentoo GLSA 200701-28 and related a...

Wordpress Pingback SourceURI拒绝服务和信息泄露漏洞

Wordpress是一款基于WEB的网络日记应用程序。 Wordpress包含的XMLRPC和Pingback存在多个问题，远程攻击者可以利用漏洞进行拒绝服务攻击或者获得敏感信息。 Wordpress处理Pingback机制存在问题，发送恶意请求可导致拒绝服务攻击。 另外由于在传递给wpremotefopen函数时对sourceURI参数缺少过滤，可导致指定非HTTP资源来读取类似本地文件或者FTP源的信息。特定情况下，恶意用户可判断部分文件是否存在在系统中。 WordPress Wordpress B2 0.6.2 .1 WordPress Wordpress B2 0.6.2...

Design/Logic Flaw

The gencert.sh script, when installing OpenLDAP before 2.1.30-r10, 2.2.x before 2.2.28-r7, and 2.3.x before 2.3.30-r2 as an ebuild in Gentoo Linux, does not create temporary directories in /tmp securely during emerge, which allows local users to overwrite arbitrary files via a symlink attack...

CVE-2007-0476

The gencert.sh script, when installing OpenLDAP before 2.1.30-r10, 2.2.x before 2.2.28-r7, and 2.3.x before 2.3.30-r2 as an ebuild in Gentoo Linux, does not create temporary directories in /tmp securely during emerge, which allows local users to overwrite arbitrary files via a symlink attack...

CVE-2007-0476

CVE-2007-0476 : The Gentoo OpenLDAP ebuilds (pre-2.1.30-r10, pre-2.2.28-r7, pre-2.3.30-r2) use gencert.sh and do not securely create temporary directories in /tmp during emerge, allowing a local attacker to create a symlink and overwrite arbitrary files. This is a local vulnerability with potenti...

CVE-2007-0476

The gencert.sh script, when installing OpenLDAP before 2.1.30-r10, 2.2.x before 2.2.28-r7, and 2.3.x before 2.3.30-r2 as an ebuild in Gentoo Linux, does not create temporary directories in /tmp securely during emerge, which allows local users to overwrite arbitrary files via a symlink attack...

OpenLDAP: Insecure usage of /tmp during installation

Background OpenLDAP Software is an open source implementation of the Lightweight Directory Access Protocol. Description Tavis Ormandy of the Gentoo Linux Security Team has discovered that the file gencert.sh distributed with the Gentoo ebuild for OpenLDAP does not exit upon the existence of a...

Texinfo File Handling Buffer Overflow Vulnerability

Texinfo is prone to a buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer. Exploiting this issue allows attackers to cause the affected applications using Texinfo to crash, denying...

Kerberos administration daemon may free uninitialized pointers

Overview A vulnerability exists in the Kerberos administration daemon that may allow a remote, unauthenticated user to free uninitialized pointers. Freeing uninitialized pointers corrupts memory in a way that could allow an attacker to execute code. Description The MIT krb 5 administration daemon...

Fetchmail多个密码信息泄露漏洞

Fetchmail是一款多功能的IMAP和POP客户程序。 Fetchmail存在设计问题，远程攻击者可以利用漏洞可能获得用户密码敏感信息。 具体问题如下： -sslcertck/sslfingerprint选项本来必须应用到"sslproto tls1"来迫使使用TLS协商，但程序没有。 -在配置文件中即使使用"sslproto tls1"，但如果STLS/STARTTLS没有使用，获取邮件也是明文过程。 -无论TLS选项是否采用，POP3的抓取完全忽略TLS，因为在检查STLS支持前没有可靠的发送CAPA，而CAPA是STLS所必须的。无论CAPA是否检测到，依靠的是"auth"选项...

GLSA-200612-18 : ClamAV: Denial of Service

The remote host is affected by the vulnerability described in GLSA-200612-18 ClamAV: Denial of Service Hendrik Weimer discovered that ClamAV fails to properly handle deeply nested MIME multipart/mixed content. Impact : By sending a specially crafted email with deeply nested MIME multipart/mixed...

DocuWiki With ImageMagick远程命令执行和拒绝服务漏洞

DocuWiki是一款基于web的WIKI程序。 DocuWiki存在多个安全问题，远程攻击者可以利用漏洞进行拒绝服务和命令执行攻击。 问题一是对图像的调整大小处理没有进行限制，可导致拒绝服务攻击。当libGD使用时（默认需要）必须先计算所需RAM，如果没有足够的RAM（一般8到20MB）给php进程使用，那么函数就会放弃。但是如果使用ImageMagick $conf'imconvert'使用时，没有限制存在，允许攻击者利用此特性消耗大量内存，造成拒绝服务攻击。...