SCO OpenServer/UnixWare vi creates temporary files insecurely

Overview The implementation of vi, a text editor, provided with SCO Openunix creates insecure temporary files with predictable names. Using a symbolic link attack, an intruder can overwrite any file writable by the user of vi. Description vi is a screen-oriented text editor. The implementation...

diffutils sdiff creates temporary files insecurely

Overview diffutils, a set of utilities distributed with many versions of linux, contains a utility called sdiff, which creates temporary files of predictable names in an insecure fashion. Using a symbolic link attack, an intruder can cause overwrite of any file writable by the user executing sdif...

getty_ps creates temporary files insecurely

Overview gettyps is an open-source software package designed to support logons to the console and terminals. Some implementations create temporary files insecurely with predictable names, leading to corruption of arbitrary files via symbolic link attack. Description Under certain circumstances,...

Sun Solaris catman creates temporary files insecurely

Overview catman, the unix manual display utility, creates insecure temporary files with predictable names in a world-writable directory. Since catman executes with system administration privileges, a symbolic link attack could overwrite arbitrary files. Description There is a vulnerability in...

Merit AAA RADIUS Server 3.8 - rlmadmin Symbolic Link

Merit AAA RADIUS Server 3.8 - rlmadmin Symbolic Link source: https://www.securityfocus.com/bid/3302/info The 'rlmadmin' user management utility included with the Merit AAA RADIUS Server package is susceptible to a trivial symbolic link attack. The program allows users to specify a directory from...

Merit AAA RADIUS Server 3.8 - rlmadmin Symbolic Link

source: https://www.securityfocus.com/bid/3302/info The 'rlmadmin' user management utility included with the Merit AAA RADIUS Server package is susceptible to a trivial symbolic link attack. The program allows users to specify a directory from which configuration files should be loaded at runtime...

Lmail 2.7 - Temporary File Race Condition

// source: https://www.securityfocus.com/bid/2984/info Jon Zeeff's lmail is a local mail delivery agent LDA designed to provide mail-to-pipe and mail-to-file aliasing for smail. A race condition vulnerability exists in lmail. The lmail program makes insecure use of temporary files, making it...

KDE KTVision 0.1 - File Overwrite

KDE KTVision 0.1 - File Overwrite source: https://www.securityfocus.com/bid/2913/info KTVision works with frame-grabber cards and KDE Unix K Desktop Environment to support TV video display on the PC screen. KTVision is vulnerable to symbolic link attacks. It is possible for an attacker to...

KDE KTVision 0.1 - File Overwrite

source: https://www.securityfocus.com/bid/2913/info KTVision works with frame-grabber cards and KDE Unix K Desktop Environment to support TV video display on the PC screen. KTVision is vulnerable to symbolic link attacks. It is possible for an attacker to anticipate the expected name of a KTVisio...

Thibault Godouet FCron 1 - Symbolic Link

Thibault Godouet FCron 1 - Symbolic Link source: https://www.securityfocus.com/bid/2835/info FCron is an implementation of the popular UNIX 'cron' utility that runs user-specified programs at periodic scheduled times. fcron is vulnerable to symbolic link attacks. It is possible for an attacker to...

Thibault Godouet FCron 1 - Symbolic Link

source: https://www.securityfocus.com/bid/2835/info FCron is an implementation of the popular UNIX 'cron' utility that runs user-specified programs at periodic scheduled times. fcron is vulnerable to symbolic link attacks. It is possible for an attacker to anticipate the expected name of an fcron...

CVE-2001-0406

CVE-2001-0406 affects Samba before 2.2.0, allowing local attackers to overwrite arbitrary files via a symlink attack triggered by (1) a printer queue query, (2) the smbclient 'more' command, or (3) the smbclient 'mput' command. The vulnerability arises from insecure temporary file handling; attac...

KDE2 kdesu 'keep password' option does not verify socket listener potentially exposing su password

Overview kdesu is a interactive interface to the substitute user su command for the KDE environment. To pass authentication information, it creates a file that may be read by unauthorized users. Description kdesu communicates with su using a socket, implemented as a file in /tmp with a predictabl...

CVE-2000-1127

registrar in the HP resource monitor service allows local users to read and modify arbitrary files by renaming the original registrar.log log file and creating a symbolic link to the target file, to which registrar appends log information and sets the permissions to be world readable...

Apple Mac OSX 10 HP-UX 91011 Mandriva 67 RedHat 56 SCO 5 IRIX 6 - Shell Redirection Race Condition

Apple Mac OSX 10 HP-UX 91011 Mandriva 67 RedHat 56 SCO 5 IRIX 6 - Shell Redirection Race Condition source: https://www.securityfocus.com/bid/2006/info bash, tcsh, cash, ksh and sh are all variations of the Unix shell distributed with many Unix and Unix clone operating systems. A vulnerability...

Apple Mac OSX 10 / HP-UX 9/10/11 / Mandriva 6/7 / RedHat 5/6 / SCO 5 / IRIX 6 - Shell Redirection Race Condition

source: https://www.securityfocus.com/bid/2006/info bash, tcsh, cash, ksh and sh are all variations of the Unix shell distributed with many Unix and Unix clone operating systems. A vulnerability exists in these shells that could allow an attacker to arbitrarily write to files. A vulnerability has...

Ascend CascadeViewUX 1.0 tftpd - Symbolic Link

Ascend CascadeViewUX 1.0 tftpd - Symbolic Link source: https://www.securityfocus.com/bid/910/info The tftpd bundled with CascadeView for Ascend's B-STDX 8000/9000 network devices creates a log in /tmp called tftpdxferstatus.log. If /tmp/tftpdxferstatus.log already exists as a symbolic link, tftpd...

Ascend CascadeView/UX 1.0 tftpd - Symbolic Link

source: https://www.securityfocus.com/bid/910/info The tftpd bundled with CascadeView for Ascend's B-STDX 8000/9000 network devices creates a log in /tmp called tftpdxferstatus.log. If /tmp/tftpdxferstatus.log already exists as a symbolic link, tftpd will follow it and overwrite any data it point...

Slackware Linux 3.4 - netconfig Temporary File

Slackware Linux 3.4 - netconfig Temporary File source: https://www.securityfocus.com/bid/81/info netconfig creates the file /tmp/tmpmsg insecurely and follows symbolic links. An attacker can create a symbolic link from /tmp/tmpmsg to any file and wait for root to run the program. This will clober...

Slackware Linux 3.4 - makebootdisk Temporary File

Slackware Linux 3.4 - makebootdisk Temporary File source: https://www.securityfocus.com/bid/78/info makebootdisk creates the file /tmp/return insecurely and follows symbolic links. An attacker can create a symbolic link from /tmp/return to any file and wait for root to run the program. This will...