Folder Lock 5.9.5 - Weak Password Encryption Local Information Disclosure

source: https://www.securityfocus.com/bid/30766/info Folder Lock is prone to an information-disclosure vulnerability because it stores credentials in an insecure manner. A local attacker can exploit this issue to obtain passwords used by the application, which may aid in further attacks. Folder...

IBM OS/400 'BrSmRcvAndCheck()'缓冲区溢出漏洞

BUGTRAQ ID: 29660 IBM OS/400是一款AS/400机器上的操作系统。 IBM OS/400 'BrSmRcvAndCheck'存在缓冲区溢出，本地攻击者可以利用漏洞对服务进行拒绝服务攻击。 问题是由于memcpy时对长度缺少检查，攻击者可以利用此问题是IPL bootstrap进程停止。 IBM OS/400 V6R1M0 IBM OS/400 V5R4M5 IBM OS/400 V5R4M0 可参考如下安全公告获得补丁信息：...

opensuse-updater符号链接本地信息泄漏漏洞

BUGTRAQ ID: 29608 CVE ID：CVE-2008-2389 CNCVE ID:CNCVE-20082389 opensuse-updater是一款类似apt-get的软件包更新实现。 opensuse-updater处理符号链接存在问题，本地攻击者可以利用漏洞获得敏感信息。 目前没有详细漏洞细节提供。 S.u.S.E. opensuse-updater 0 S.u.S.E. openSUSE 10.2 SUSE-SR:2008:012已经修正此漏洞：...

Linux Kernel fcntl_setlk()函数本地竞争条件漏洞

BUGTRAQ ID: 29076 CVECAN ID: CVE-2008-1669 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux kernel没有对fcntl功能应用某些保护机制，本地攻击者可以在SMP系统上利用fcntlsetlk与close调用之间的竞争条件获得对文件描述符表的不正确序列访问，这可能导致拒绝服务的情况。 Linux kernel 2.6.25.2 Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

CVE-2008-1675

The bdxioctlpriv function in the tehuti driver tehuti.c in Linux kernel 2.6.x before 2.6.25.1 does not properly check certain information related to register size, which has unspecified impact and local attack vectors, probably related to reading or writing kernel memory...

Design/Logic Flaw

The bdxioctlpriv function in the tehuti driver tehuti.c in Linux kernel 2.6.x before 2.6.25.1 does not properly check certain information related to register size, which has unspecified impact and local attack vectors, probably related to reading or writing kernel memory...

CVE-2008-1675

The bdxioctlpriv function in the tehuti driver tehuti.c in Linux kernel 2.6.x before 2.6.25.1 does not properly check certain information related to register size, which has unspecified impact and local attack vectors, probably related to reading or writing kernel memory...

CVE-2008-1675

The bdxioctlpriv function in the tehuti driver tehuti.c in Linux kernel 2.6.x before 2.6.25.1 does not properly check certain information related to register size, which has unspecified impact and local attack vectors, probably related to reading or writing kernel memory...

Design/Logic Flaw

Unspecified vulnerability in the Oracle Net Services component in Oracle Database 9.2.0.8, 10.1.0.5, and 10.2.0.3 has unknown impact and local attack vectors, aka DB09...

CVE-2008-1831

Multiple unspecified vulnerabilities in the Siebel SimBuilder component in Oracle Siebel Enterprise 7.8.2 and 7.8.5 have unknown impact and remote or local attack vectors, aka 1 SEBL01, 2 SEBL02, 3 SEBL03, 4 SEBL04, 5 SEBL05, and 6 SEBL06...

CVE-2008-1812

CVE-2008-1812 affects the Oracle Enterprise Manager component in Oracle Database 9.0.1.5 FIPS+, Application Server 1.0.2.2, and Enterprise Manager for AS 1.0.2.2 and Database 9.0.1.5. The vulnerability is described as unspecified with unknown impact and local attack vectors (EM01). The connected ...

CVE-2008-1819

Unspecified vulnerability in the Oracle Net Services component in Oracle Database 9.2.0.8, 10.1.0.5, and 10.2.0.3 has unknown impact and local attack vectors, aka DB09...

CVE-2008-1812

Unspecified vulnerability in the Oracle Enterprise Manager component in Oracle Database 9.0.1.5 FIPS+; Application Server 1.0.2.2; and Enterprise Manager for AS 1.0.2.2 and Database 9.0.1.5 has unknown impact and local attack vectors, aka EM01...

CVE-2008-1831

Multiple unspecified vulnerabilities in the Siebel SimBuilder component in Oracle Siebel Enterprise 7.8.2 and 7.8.5 have unknown impact and remote or local attack vectors, aka 1 SEBL01, 2 SEBL02, 3 SEBL03, 4 SEBL04, 5 SEBL05, and 6 SEBL06...

IBM AIX 'man'本地特权提升漏洞

BUGTRAQ ID: 28180 CNCAN ID:CNCAN-2008031105 IBM AIX是一款商业性质的操作系统。 IBM AIX 'man'没有使用全路径两进制，本地攻击者可以利用漏洞提升特权。 目前没有详细漏洞细节提供。 IBM AIX 6.1 补丁下载： IBM AIX 6.1 IBM IZ17177 http://www.ibm.com/servers/eserver/support/unixservers/aixfixes.html...

IBM AIX逻辑卷标管理器多个命令本地缓冲区溢出漏洞

BUGTRAQ ID: 27431 IBM AIX是一款商业性质的UNIX操作系统。 AIX的逻辑卷标管理命令工具集实现上存在缓冲区溢出漏洞，本地攻击者可能利用此漏洞提升自己的权限。 AIX的逻辑卷标管理器提供了一套用于管理逻辑卷标的工具。逻辑卷标管理器的bos.rte.lvm和bos.clvm.enh命令中存在缓冲区溢出漏洞。如果本地攻击者执行了以下bos.rte.lvm命令： /usr/sbin/lchangevg /usr/sbin/ldeletepv /usr/sbin/putlvodm /usr/sbin/lvaryoffvg /usr/sbin/lvgenminor...

CORE FORCE防火墙和注册模块多个本地内核缓冲区溢出漏洞

BUGTRAQ ID: 27341 CNCAN ID:CNCAN-2008012102 CORE FORCE是一款免费的防火墙应用程序。 CORE FORCE防火墙和注册模块不正确验证用户提供的输入，本地攻击者可以利用漏洞进行拒绝服务攻击或提升特权。 CORE FORCE的防火墙内核驱动可通过IOCTL函数访问，防火墙驱动模块中的四个IOCTL函数使用从用户空间的输入，并没有对输入缓冲区长度进行正确的验证，通过使用特定构建的参数调用任何一个IOCTL，非特权用户可在这个驱动中触发漏洞并导致拒绝服务攻击，可能导致任意特权提升。 Core Security Technologies CORE...

CVE-2008-0347

Unspecified vulnerability in the Oracle Ultra Search component in Oracle Collaboration Suite 10.1.2; Database 9.2.0.8, 10.1.0.5, and 10.2.0.3; and Application Server 9.0.4.3 and 10.1.2.0.2; has unknown impact and local attack vectors, aka OCS01. NOTE: Oracle has not disputed a reliable claim that...

Debian Security Advisory DSA 956-1 (lsh-utils)

The remote host is missing an update to lsh-utils announced via advisory DSA 956-1. Stefan Pfetzing discovered that lshd, a Secure Shell v2 SSH2 protocol server, leaks a couple of file descriptors, related to the randomness generator, to user shells which are started by lshd. A local attacker can...

Kerio WinRoute防火墙未明代理验证绕过漏洞

Kerio WinRoute Firewall是一款商业性质的防火墙应用程序。 Kerio WinRoute Firewall存在未明安全问题，本地攻击者可以利用漏洞绕过代理验证，未授权访问受限资源。 目前没有详细漏洞细节提供。 Kerio WinRoute Firewall 6.2.3 Kerio WinRoute Firewall 6.2.2 Kerio WinRoute Firewall 6.2.1 Kerio WinRoute Firewall 6.2 Kerio WinRoute Firewall 6.1.4 Patch 2 Kerio WinRoute Firewall...