CVE-2005-3346

Buffer overflow in the environment variable substitution code in main.c in OSH 1.7-14 allows local users to inject arbitrary environment variables, such as LDPRELOAD, via pathname arguments of the form "$VAR/EVAR=arg", which cause the EVAR portion to be appended to a buffer returned by a getenv...

CVE-2005-3346

CVE-2005-3346 affects osh (OSHevironment) 1.7-14, where a buffer overflow in the environment variable substitution code (main.c) can be triggered by pathname args like "$VAR/EVAR=arg". This allows a local attacker to inject arbitrary environment variables (e.g., LD_PRELOAD) and, per Debian's advi...

IIS IDA/IDQ Path Disclosure

IIS 4.0 allows a remote attacker to obtain the real pathname of the document root by requesting non-existent files with .ida or .idq extensions. An attacker may use this flaw to gain more information about the remote host, and hence make more focused attacks. OpenVAS Vulnerability Test $Id:...

HP-UX ftpd glob() Expansion STAT Buffer Overflow

Buffer overflow in FTP server in HPUX 11 and previous allows remote attackers to execute arbitrary commands by creating a long pathname and calling the STAT command, which uses glob to generate long strings. OpenVAS Vulnerability Test $Id: hpftpglobstat.nasl 6522 2017-07-04 15:22:28Z cfischer $...

CVE-2005-3467

Serv-U FTP Server before 6.1.0.4 allows attackers to cause a denial of service crash via 1 malformed packets and possibly other unspecified issues with unknown impact and attack vectors including 2 use of "" in a pathname, and 3 memory consumption of the daemon. NOTE: it is not clear whether item...

CVE-2005-3431

CVE-2005-3431 describes an absolute path traversal vulnerability in Rockliffe MailSite Express prior to 6.1.22. The issue allows remote attackers to read arbitrary files by supplying a full pathname in the AttachPath field of a mail message under composition. The provided sources confirm the affe...

CVE-2005-2372

Oracle Forms 4.5 through 10g starts form executables from arbitrary directories and executes them as the Oracle or System user, which allows attackers to execute arbitrary code by uploading a malicious .fmx file and referencing it using an absolute pathname argument in the 1 form or 2 module...

SUSE-SA:2005:036: sudo

The remote host is missing the patch for the advisory SUSE-SA:2005:036 sudo. Sudo8 allows the execution of commands as another user and gives the administrator more flexibility than su1. A race condition in the pathname handling of sudo may allow a local user to execute arbitrary commands. To...

CVE-2002-2024

Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request for 1 poppassd.php3, 2 login.php3?reason=chpass2, 3 spelling.php3, and 4 ldap.search.php3?ldapserv=nonsense which leaks the information in error messages...

CVE-2002-2024

Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request for 1 poppassd.php3, 2 login.php3?reason=chpass2, 3 spelling.php3, and 4 ldap.search.php3?ldapserv=nonsense which leaks the information in error messages...

CVE-2002-2024

Horde IMP 2.2.7 is affected. The issue allows remote attackers to obtain the full web root pathname by requesting specific files (poppassd.php3, login.php3?reason=chpass2, spelling.php3, ldap.search.php3?ldap_serv=nonsense), with error messages leaking the information. Impact is information discl...

FreeBSD : perl -- vulnerabilities in PERLIO_DEBUG handling (a5eb760a-753c-11d9-a36f-000a95bc6fae)

Kevin Finisterre discovered bugs in perl's I/O debug support : - The environmental variable PERLIODEBUG is honored even by the set-user-ID perl command usually named sperl or suidperl. As a result, a local attacker may be able to gain elevated privileges. CVE-2005-0155 - A buffer overflow may occ...

[SECURITY] [DSA 735-2] New sudo packages fix pathname validation race

------------------------------------------------------------------------ Debian Security Advisory DSA 735-2 [email protected] http://www.debian.org/security/ Michael Stone July 07, 2005 http://www.debian.org/security/faq - ------------------------------------------------------------------------...

[SECURITY] [DSA 735-2] New sudo packages fix pathname validation race

------------------------------------------------------------------------ Debian Security Advisory DSA 735-2 [email protected] http://www.debian.org/security/ Michael Stone July 07, 2005 http://www.debian.org/security/faq - ------------------------------------------------------------------------...

DSA-735-2 sudo - pathname validation race

Bulletin has no description...

DEBIAN-CVE-2005-2147

Trac before 0.8.4 allows remote attackers to read or upload arbitrary files via a full pathname in the id parameter to the 1 upload or 2 attachment viewer scripts...

Debian DSA-735-1 : sudo - pathname validation race

A local user who has been granted permission to run commands via sudo could run arbitrary commands as a privileged user due to a flaw in sudo's pathname validation. This bug only affects configurations which have restricted user configurations prior to an ALL directive in the configuration file. ...

Sudo 1.3.1 - 1.6.8p Pathname Validation Local Root Exploit (openbsd)

Exploit for bsd platform in category local exploits ==================================================================== Sudo 1.3.1 - 1.6.8p Pathname Validation Local Root Exploit openbsd ==================================================================== include include include include include...

Sudo 1.3.1 < 1.6.8p (OpenBSD) - Pathname Validation Privilege Escalation

include include include include include define SUDO "/usr/bin/sudo" ifdef BUFSIZ undef BUFSIZ define BUFSIZ 128 endif / ANY MODIFIED REPUBLISHING IS RESTRICTED OpenBSD sudo 1.3.1 - 1.6.8p local root exploit Tested under OpenBSD 3.6 sudo 1.6.7p5 Vuln by OpenBSD errata,...

Sudo 1.3.1 1.6.8p (OpenBSD) - Pathname Validation Privilege Escalation

Sudo 1.3.1 1.6.8p OpenBSD - Pathname Validation Privilege Escalation include include include include include define SUDO "/usr/bin/sudo" ifdef BUFSIZ undef BUFSIZ define BUFSIZ 128 endif / ANY MODIFIED REPUBLISHING IS RESTRICTED OpenBSD sudo 1.3.1 - 1.6.8p local root exploit Tested under OpenBSD...