DSA-836-1 cfengine2 - insecure temporary files

Bulletin has no description...

CVE-2004-1117

The init scripts in ChessBrain 20407 and earlier execute user-owned programs with root privileges, which allows local users to gain privileges by modifying the programs...

Weak permissions in Etnus TotalView 5

write access to files and directories owned by root...

CVE-1999-0860

Solaris chkperm vulnerability allows local users to read files owned by bin via the VMSYS environment variable and a symlink attack. The affected software is the Solaris chkperm utility; the vulnerability arises from a symlink-based access path involving VMSYS, leading to a partial confidentialit...

solaris.chkperm+arp.txt

Greetings, OVERVIEW /usr/vmsys/bin/chkperm and /usr/sbin/arp can be used to read bin-owned files. BACKGROUND All my testing was done on Solaris 2.7 and 2.6 SPARC edition. DETAILS Vuln 1 - chkperm This one isn't nearly as interesting as the instant-shell variety. Here's how it works: chkperm is...

sol2.51-6.lockfiles.txt

Date: Wed, 21 Oct 1998 20:22:38 +0200 From: Joel Eriksson To: [email protected] Subject: License Manager's lockfiles Solaris 2.5.1 License Manager on Solaris 2.5.1 tends to make stupid lockfiles owned by root and mode 666 worldwrite'able. That is not good, since anyone could create rootowned...

Digital UNIX 4.04.0 B4.0 D - SUIDSGID Core File

Digital UNIX 4.04.0 B4.0 D - SUIDSGID Core File source: https://www.securityfocus.com/bid/74/info Digital UNIX 4.0 will follow symlinks while writting core files if two setuid programs dump core in sucession. The core file is owned by root but with the user's groud id. The core file permissions a...