CVE-2018-13405

The inodeinitowner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigge...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2017-3657)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3657 advisory. - mm: Tighten x86 /dev/mem with zeroing reads Kees Cook Orabug: 26675925 CVE-2017-7889 - more biomapuseriov leak fixes Al Viro Orabug: 27069042...

AUFS (Ubuntu 15.10) Privilege Escalation

Source: http://www.halfdog.net/Security/2016/AufsPrivilegeEscalationInUserNamespaces/ Introduction Problem description: Aufs is a union filesystem to mix content of different underlying filesystems, e.g. read-only medium with r/w RAM-fs. That is also allowed in user namespaces when module was...

Uber: pam-ussh may be tricked into using another logged in user's ssh-agent

Summary https://github.com/uber/pam-ussh was open-sourced today kudos! and is presumably used within Uber's infrastructure. This is a PAM module written a Go that "will authenticate a user based on them having an ssh certificate in their ssh-agent signed by a specified ssh CA." A cursory look at...

Ubuntu 14.0415.10 - User Namespace Overlayfs Xattr SetGID Privilege Escalation

Ubuntu 14.0415.10 - User Namespace Overlayfs Xattr SetGID Privilege Escalation Source: http://www.halfdog.net/Security/2016/UserNamespaceOverlayfsXattrSetgidPrivilegeEscalation/ Introduction Problem description: Linux user namespace allows to mount file systems as normal user, including the...

Debian DSA-3687-1 : nspr - security update

Two vulnerabilities were reported in NSPR, a library to abstract over operating system interfaces developed by the Mozilla project. - CVE-2016-1951 q1 reported that the NSPR implementation of sprintf-style string formatting function miscomputed memory allocation sizes, potentially leading to...

[SECURITY] [DSA 3688-1] nss security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3688-1 [email protected] https://www.debian.org/security/ Florian Weimer October 05, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3687-1] nspr security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3687-1 [email protected] https://www.debian.org/security/ Florian Weimer October 05, 2016 https://www.debian.org/security/faq -...

DSA-3688-1 nss - security update

Bulletin has no description...

Debian Security Advisory DSA 3688-1 (nss - security update)

Several vulnerabilities were discovered in NSS, the cryptography library developed by the Mozilla project. CVE-2015-4000 David Adrian et al. reported that it may be feasible to attack Diffie-Hellman-based cipher suites in certain circumstances, compromising the confidentiality and integrity of da...

PT-2018-3823 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: Linux kernel versions through 3.16 Description: The issue is related to insecure privilege management in the inode init owner function of the Linux kernel. This allows an attacker to access confidential data, compromise its integrity, and cau...

Digital UNIX 4.0/4.0 B/4.0 D SUID/SGID Core File Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/74/info Digital UNIX 4.0 will follow symlinks while writting core files if two setuid programs dump core in sucession. The core file is owned by root but with the user's groud id. The core file permissions are 0600. This...

Stanley T. Shebs Xconq 7.2.2 - Buffer Overflow Vulnerabilities in xconq

No description provided by source. source: http://www.securityfocus.com/bid/1495/info Xconq is a multiple player strategy game available for many unix platforms. It contains a number of buffer overflow vulnerabilities including the ability to overflow stack buffers with either the DISPLAY or the...

Linux Kernel < 2.6.22 ftruncate()/open() Local Exploit

No description provided by source. / gw-ftrex.c: Linux kernel 2.6.22 open/ftruncate local exploit by gat3way at gat3way dot eu bug information: http://osvdb.org/49081 !!!This is for educational purposes only!!! To use it, you've got to find a sgid directory you've got permissions to write into...

Windowmaker wmmon 1.0 b2 Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/885/info WMMon is a multiple platform Window Maker docking application. It monitors useful system information such as CPU load and disk activity. The application also allows the user to define commands that can be launche...

SCO Unixware 7.0/7.0.1/7.1/7.1.1 'coredump' Symlink Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/851/info Under certain versions of SCO UnixWare if a user can force a program with SGID Set Group ID to dump core they may launch a symlink attack by guessing the PID Process ID of the SGID process which they are calling...

KDE 1.1/1.1.1/1.2/2.0 kscd SHELL Environmental Variable Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1206/info Some linux distributions S.u.S.E. 6.4 reported ship with kscd a CD player for the KDE Desktop sgid disk. kscd uses the contents of the 'SHELL' environment variable to execute a browser. This makes it possible to...

Linux Kernel 3.13 - SGID Privilege Escalation

Linux Kernel 3.13 - SGID Privilege Escalation / CVE-2014-4014 Linux Kernel Local Privilege Escalation PoC Vitaly Nikolenko http://hashcrack.org Usage: ./poc filepath where filepath is the file on which you want to set the sgid bit / define GNUSOURCE include include include include include include...

Mandrake Linux Security Advisory : glibc (MDKSA-2001:012)

The LDPRELOAD variable in the GNU C Library is honoured normally even for SUID/SGID applications but removed afterwards from the environment if it does not contain '/' characters. There is a special check which only preloads found libraries if they have the SUID bit set. However, if a library has...

SuSE 11.1 Security Update : rpm (SAT Patch Number 3678)

This is a re-release of the previous rpm security update with corrected %version-%release information. This update fixes a security problem where RPM misses to clear the SUID/SGID bit of old files during package updates. CVE-2010-2059 Additionally, a bug verifying RSAv4 signatures which marked al...