CVE-2010-3430

The privilege-dropping implementation in the 1 pamenv and 2 pammail modules in Linux-PAM aka pam 1.1.2 does not perform the required setfsgid and setgroups system calls, which might allow local users to obtain sensitive information by leveraging unintended group permissions, as demonstrated by a...

CVE-2010-3431

The privilege-dropping implementation in the 1 pamenv and 2 pammail modules in Linux-PAM aka pam 1.1.2 does not check the return value of the setfsuid system call, which might allow local users to obtain sensitive information by leveraging an unintended uid, as demonstrated by a symlink attack on...

pam security update

0.99.6.2-6.2 - fix insecure dropping of priviledges in pamxauth and pammail - CVE-2010-3316 637898, CVE-2010-3435 641335 - fix insecure executing of scripts with user supplied environment variables in pamnamespace - CVE-2010-3853 643043...

CVE-2008-0008

The padroproot function in PulseAudio 0.9.8, and a certain 0.9.9 build, does not check return values from 1 setresuid, 2 setreuid, 3 setuid, and 4 seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail via attacks such as...

Debian Security Advisory DSA 108-1 (wmtv)

The remote host is missing an update to wmtv announced via advisory DSA 108-1. OpenVAS Vulnerability Test $Id: deb1081.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 108-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Ubuntu 4.10 : ntp vulnerability (USN-175-1)

Thomas Biege discovered a flaw in the privilege dropping of the NTP server. When ntpd was configured to drop root privileges, and the group to run under was specified as a name as opposed to a numeric group ID, ntpd changed to the wrong group. Depending on the actual group it changed to, this cou...

[SA17922] Mac OS X Perl "$<" Privilege Dropping Security Issue

TITLE: Mac OS X Perl "$" Privilege Dropping Security Issue SECUNIA ADVISORY ID: SA17922 VERIFY ADVISORY: http://secunia.com/advisories/17922/ CRITICAL: Less critical IMPACT: Security Bypass WHERE: From remote OPERATING SYSTEM: Apple Macintosh OS X http://secunia.com/product/96/ DESCRIPTION: Jason...

USN-175-1: ntp server vulnerability

Thomas Biege discovered a flaw in the privilege dropping of the NTP server. When ntpd was configured to drop root privileges, and the group to run under was specified as a name as opposed to a numeric group ID, ntpd changed to the wrong group. Depending on the actual group it changed to, this cou...

CVE-2005-0072

zhcon before 0.2 does not drop privileges before reading a user configuration file, which allows local users to read arbitrary files...

[SECURITY] [DSA 557-1] New rp-pppoe packages fix potential root compromise

-------------------------------------------------------------------------- Debian Security Advisory DSA 557-1 [email protected] http://www.debian.org/security/ Martin Schulze October 4th, 2004 http://www.debian.org/security/faq -...

Debian DSA-050-1 : sendfile - broken privileges dropping, broken tempfile

Colin Phipps and Daniel Kobras discovered and fixed several serious bugs in the saft daemon sendfiled' which caused it to drop privileges incorrectly. Exploiting this a local user can easily make it execute arbitrary code under root privileges. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

CVE-2002-1311

Courier sqwebmail before 0.40.0 does not quickly drop privileges after startup in certain cases, which could allow local users to read arbitrary files...

GLSA-200401-02 : Honeyd remote detection vulnerability via a probe packet

The remote host is affected by the vulnerability described in GLSA-200401-02 Honeyd remote detection vulnerability via a probe packet A bug in handling NMAP fingerprints caused Honeyd to reply to TCP packets with both the SYN and RST flags set. Watching for replies, it is possible to detect IP...

CVE-2003-0949

xsok 1.02 does not properly drop privileges before finding and executing the "gunzip" program, which allows local users to execute arbitrary commands...

CVE-2003-0949

xsok 1.02 does not properly drop privileges before finding and executing the "gunzip" program, which allows local users to execute arbitrary commands...

ProFTPd 1.2.7/1.2.8 - '.ASCII' File Transfer Buffer Overrun

// source: https://www.securityfocus.com/bid/8679/info A remotely exploitable buffer overrun vulnerability has been reported in ProFTPD. This issue could be triggered if an attacker uploads a malformed file and then that file is downloaded in ASCII mode. Successful exploitation will permit a...

ProFTPd 1.2.71.2.8 - .ASCII File Transfer Buffer Overrun

ProFTPd 1.2.71.2.8 - .ASCII File Transfer Buffer Overrun // source: https://www.securityfocus.com/bid/8679/info A remotely exploitable buffer overrun vulnerability has been reported in ProFTPD. This issue could be triggered if an attacker uploads a malformed file and then that file is downloaded ...

CVE-2002-0469

Ecartis formerly Listar 1.0.0 in snapshot 20020125 and earlier does not properly drop privileges when Ecartis is installed setuid-root, "lock-to-user" is not set, and ecartis is called by certain MTA's, which could allow local users to gain privileges...

Ecartis/Listar multiple vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Name: Ecartis / Listar Version: read the details Vendor: The Ecartis Project. http://www.ecartis.org/ Author: Janusz Niewiadomski [email protected], Wojciech Purczynski [email protected] Date: March 10, 2002 Issue: ====== Multiple buffer overflow...

CVE-2001-0623

CVE-2001-0623 affects the sendfiled component of SAFT on Linux, where privileges are not properly dropped when sending notification emails, enabling a local user to gain privileges (local privilege escalation). The issue is documented in Debian security advisories DSA-050-1 and DSA-052-1, which d...