RHEL 4 / 5 : sblim (RHSA-2008:0497)

Updated sblim packages that resolve a security issue are now available for Red Hat Enterprise Linux 4 and Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. SBLIM stands for Standards-Based Linux Instrumentation for...

vsftpd-dos.txt

!/usr/bin/perl -w vsftpd 2.0.5 FTP Server on Red Hat Enterprise Linux RHEL 5, Fedora 6 to 8, Foresight Linux, rPath Linux is prone to Denial-of-ServiceDoS vulnerability. Can be xploited by large number of CWD commands to vsftp daemon with denyfile configuration option in /etc/vsftpd/vsftpd.conf o...

CVE-2008-2366: Undefined Security Weakness

Untrusted search path vulnerability in a certain Red Hat build script for OpenOffice.org OOo 1.1.x on Red Hat Enterprise Linux RHEL 3 and 4 allows local users to gain privileges via a malicious library in the current working directory, related to incorrect quoting of the ORIGIN symbol for use in...

openoffice.org: insecure relative RPATH in OOo 1.1.x packages

Untrusted search path vulnerability in a certain Red Hat build script for OpenOffice.org OOo 1.1.x on Red Hat Enterprise Linux RHEL 3 and 4 allows local users to gain privileges via a malicious library in the current working directory, related to incorrect quoting of the ORIGIN symbol for use in...

Important: Red Hat Security Advisory: openoffice.org security update

Updated openoffice.org packages to correct two security issues are now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having important security impact by the Red Hat Security Response Team. OpenOffice.org is an office productivity suite that includes desktop...

Design/Logic Flaw

Memory leak in a certain Red Hat patch, applied to vsftpd 2.0.5 on Red Hat Enterprise Linux RHEL 5 and Fedora 6 through 8, and on Foresight Linux and rPath appliances, allows remote attackers to cause a denial of service memory consumption via a large number of CWD commands, as demonstrated by an...

CVE-2007-5962

Memory leak in a certain Red Hat patch, applied to vsftpd 2.0.5 on Red Hat Enterprise Linux RHEL 5 and Fedora 6 through 8, and on Foresight Linux and rPath appliances, allows remote attackers to cause a denial of service memory consumption via a large number of CWD commands, as demonstrated by an...

CVE-2007-5962

CVE-2007-5962 describes a memory-leak vulnerability in vsftpd triggered by a large number of CWD commands when the deny_file option is set. The issue affects vsftpd 2.0.5 on Red Hat Enterprise Linux 5 and Fedora 6–8, as well as Foresight Linux and rPath appliances. Remote attackers could cause de...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the rootpw plugin in rPath Appliance Platform Agent 2 and 3 allows remote attackers to reset the root password as the administrator via a crafted URL...

CVE-2008-2140

Cross-site request forgery CSRF vulnerability in the rootpw plugin in rPath Appliance Platform Agent 2 and 3 allows remote attackers to reset the root password as the administrator via a crafted URL...

Design/Logic Flaw

The rootpw plugin in rPath Appliance Platform Agent 2 and 3 does not re-validate requests from a browser with a valid administrator session, including requests to change the password, which makes it easier for physically proximate attackers to gain privileges and maintain control over the...

CVE-2008-2139

The rootpw plugin in rPath Appliance Platform Agent 2 and 3 does not re-validate requests from a browser with a valid administrator session, including requests to change the password, which makes it easier for physically proximate attackers to gain privileges and maintain control over the...

CVE-2008-2139

The CVE-2008-2139 entry concerns the rootpw plugin in rPath Appliance Platform Agent 2 and 3, where requests from a browser with a valid administrator session are not re-validated (including password-change requests). This weakens session handling and can allow physically proximate attackers to g...

CVE-2008-2140

Cross-site request forgery CSRF vulnerability in the rootpw plugin in rPath Appliance Platform Agent 2 and 3 allows remote attackers to reset the root password as the administrator via a crafted URL...

CVE-2008-2140

CVE-2008-2140 corresponds to a CSRF vulnerability in the rootpw plugin of the rPath Appliance Platform Agent (versions 2 and 3). The underlying issue enables remote attackers to reset the root password for the administrator account through a crafted URL. The linked documents confirm the affected ...

CVE-2008-2139

The rootpw plugin in rPath Appliance Platform Agent 2 and 3 does not re-validate requests from a browser with a valid administrator session, including requests to change the password, which makes it easier for physically proximate attackers to gain privileges and maintain control over the...

CVE-2008-2140: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the rootpw plugin in rPath Appliance Platform Agent 2 and 3 allows remote attackers to reset the root password as the administrator via a crafted URL...

CVE-2008-2139: Undefined Security Weakness

The rootpw plugin in rPath Appliance Platform Agent 2 and 3 does not re-validate requests from a browser with a valid administrator session, including requests to change the password, which makes it easier for physically proximate attackers to gain privileges and maintain control over the...

rPSA-2008-0151-1 libpng

rPath Security Advisory: 2008-0151-1 Published: 2008-04-29 Products: rPath Linux 1 rPath Appliance Platform Linux Service 1 Rating: Major Exposure Level Classification: Indirect User Deterministic Unauthorized Access Updated Versions: libpng=conary.rpath.com@rpl:1/1.2.26-2.1-1 rPath Issue Trackin...

rPSA-2008-0132-1 lighttpd

rPath Security Advisory: 2008-0132-1 Published: 2008-03-31 Products: rPath Linux 1 Rating: Major Exposure Level Classification: Remote Deterministic Denial of Service Updated Versions: lighttpd=conary.rpath.com@rpl:1/1.4.18-0.5-1 rPath Issue Tracking System: https://issues.rpath.com/browse/RPL-24...