CVE-2005-4659

CVE-2005-4659 affects IPCop (IPCop Firewall) prior to 1.4.10. The backup.key file has world-readable permissions, potentially allowing local users to overwrite system configuration files by creating a malicious encrypted backup archive owned by nobody and then running ipcoprscfg to restore from t...

CVE-2005-4659: Undefined Security Weakness

IPCop aka IPCop Firewall before 1.4.10 has world-readable permissions for the backup.key file, which might allow local users to overwrite system configuration files and gain privileges by creating a malicious encrypted backup archive owned by "nobody", then executing ipcoprscfg to restore from th...

CVE-2005-4660: Undefined Security Weakness

Race condition in IPCop aka IPCop Firewall before 1.4.10 might allow local users to overwrite system configuration files and gain privileges by replacing a backup archive during the time window when the archive is owned by "nobody" but not yet encrypted, then executing ipcoprscfg to restore from...

CVE-2005-4659

IPCop aka IPCop Firewall before 1.4.10 has world-readable permissions for the backup.key file, which might allow local users to overwrite system configuration files and gain privileges by creating a malicious encrypted backup archive owned by "nobody", then executing ipcoprscfg to restore from th...

CVE-2005-4660

Race condition in IPCop aka IPCop Firewall before 1.4.10 might allow local users to overwrite system configuration files and gain privileges by replacing a backup archive during the time window when the archive is owned by "nobody" but not yet encrypted, then executing ipcoprscfg to restore from...

IPCop Web Interface Detection

Binary data 3288.prm...

[SA17513] IPCop Squid Vulnerability and Web Backup Security Issue

TITLE: IPCop Squid Vulnerability and Web Backup Security Issue SECUNIA ADVISORY ID: SA17513 VERIFY ADVISORY: http://secunia.com/advisories/17513/ CRITICAL: Less critical IMPACT: Exposure of sensitive information, DoS WHERE: From remote OPERATING SYSTEM: IPCop 1.4.x http://secunia.com/product/5028...

IPCop weak file permissions

Backup files and backup files encryption key have weak permissions...

CVE-2004-1210

Cross-site scripting XSS vulnerability in proxylog.dat in IPCop 1.4.1 and possibly other versions, allows remote attackers to inject arbitrary web script or HTML via the 1 url or 2 part variables...

CVE-2004-1210

Cross-site scripting XSS vulnerability in proxylog.dat in IPCop 1.4.1 and possibly other versions, allows remote attackers to inject arbitrary web script or HTML via the 1 url or 2 part variables...

CVE-2004-1210

The CVE-2004-1210 entry describes a Cross-site scripting (XSS) vulnerability in IPCop 1.4.1 (and potentially other versions) affecting proxylog.dat. The issue allows remote attackers to inject arbitrary web script or HTML through the url or part variables, enabling partial confidentiality/integri...

CVE-2004-1210: Undefined Security Weakness

Cross-site scripting XSS vulnerability in proxylog.dat in IPCop 1.4.1 and possibly other versions, allows remote attackers to inject arbitrary web script or HTML via the 1 url or 2 part variables...

[KA Advisory 0411291] IPCop Cross Site Scripting Vulnerability in "proxylog.dat"

IPCop Cross Site Scripting Vulnerability in "proxylog.dat" http://www.kurczaba.com/html/security/0411291.htm ---------------------------------------------------------- Overview: "IPCop implements existing technology, secure programming practices and outstanding new concepts to make it ‘the’ Linux...

IPCop 1.4.1 - Web Administration Interface Proxy Log HTML Injection

IPCop 1.4.1 - Web Administration Interface Proxy Log HTML Injection source: https://www.securityfocus.com/bid/11779/info IPCop is reported susceptible to an HTML injection vulnerability in its proxy log viewer. This issue is due to a failure of the application to properly sanitize user-supplied...

IPCop 1.4.1 - Web Administration Interface Proxy Log HTML Injection

source: https://www.securityfocus.com/bid/11779/info IPCop is reported susceptible to an HTML injection vulnerability in its proxy log viewer. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated web pages. This...