Red Hat shadow utils unauthorized mail access

User's mailbox created with adduser has rw permissions for primary group...

CVE-2002-2219

chetcpasswd.cgi in Pedro Lineu Orso chetcpasswd before 2.1 allows remote attackers to read the last line of the shadow file via a long user userid field...

CHETCPASSWD 1.12 - Shadow File Disclosure

CHETCPASSWD 1.12 - Shadow File Disclosure source: https://www.securityfocus.com/bid/6472/info CHETCPASSWD is prone to a vulnerability that may potentially cause the tail end of the local shadow file to be disclosed to a remote attacker. It is possible to exploit this issue by sending an overly lo...

CHETCPASSWD 1.12 - Shadow File Disclosure

source: https://www.securityfocus.com/bid/6472/info CHETCPASSWD is prone to a vulnerability that may potentially cause the tail end of the local shadow file to be disclosed to a remote attacker. It is possible to exploit this issue by sending an overly long string as a value for the 'user' URI...

CVE-2002-0762

shadow package in SuSE 8.0 allows local users to destroy the /etc/passwd and /etc/shadow files or assign extra group privileges to some users by changing filesize limits before calling programs that modify the files...

Perl 5.6.0 (on Linux) getpwuid() leave /etc/shadow opened

I'm not sure how serious this issue is, but I think it may cause problems in some environments. The system is Linux, RedHat 7.0, Perl 5.6.0, glibc 2.2.4, latest updates. Recently I run 'lsof' on unprivileged Apache httpd process running modperl application and was pretty surprised to see...

CVE-2001-1175

vipw in the util-linux package before 2.10 causes /etc/shadow to be world-readable in some cases, which would make it easier for local users to perform brute force password guessing...

CVE-2001-1175

CVE-2001-1175 : In vipw from the util-linux package, before version 2.10, editing /etc/shadow could leave the file world-readable in some cases, enabling local users to more easily perform brute-force password guessing. Supported details in connected docs show Red Hat advisories (RHSA-2001:95, 13...

Privelege escalation via SuSE shadow/pam-modules

No description provided...

SuSE Security Announcement: shadow (SuSE-SA:2002:017)

-----BEGIN PGP SIGNED MESSAGE----- SuSE Security Announcement Package: shadow/pam-modules Announcement-ID: SuSE-SA:2002:017 Date: Thu May 16 12:00:00 MEST 2002 Affected products: 8.0 Vulnerability Type: local privilege escalation Severity 1-10: 5 SuSE default package: yes Other affected systems:...

eSecurityOnline Security Advisory 2408 - CIDER SHADOW CGI

eSO Security Advisory: 2408 Discovery Date: April 3, 2000 ID: eSO:2408 Title: CIDER SHADOW CGI arbitrary command execution vulnerabilities Impact: Remote attackers can execute commands with the privileges of the running web server process Affected Technology: CIDER SHADOW 1.5, 1.6 Vendor Status:...

eSecurityOnline Security Advisory 2408 - CIDER SHADOW CGI

eSO Security Advisory: 2408 Discovery Date: April 3, 2000 ID: eSO:2408 Title: CIDER SHADOW CGI arbitrary command execution vulnerabilities Impact: Remote attackers can execute commands with the privileges of the running web server process Affected Technology: CIDER SHADOW 1.5, 1.6 Vendor Status:...

CVE-2002-0091

Multiple CGI scripts in CIDER SHADOW 1.5 and 1.6 allows remote attackers to execute arbitrary commands via certain form fields...

CVE-2002-0091

Multiple CGI scripts in CIDER SHADOW 1.5 and 1.6 allows remote attackers to execute arbitrary commands via certain form fields...

CVE-2002-0091

CVE-2002-0091 affects CIDER SHADOW 1.5 and 1.6. The vulnerability consists of CGI scripts that allow remote execution of arbitrary commands through certain form fields due to insufficient input verification. Impact is remote code execution with the privileges of the web server process; exploitati...

shadow-utils useradd creates temporary files insecurely

Overview Shadow-utils is an encryption and account management package freely distributed for many Linux implementations. The useradd program in this package creates insecure temporary files with predictable names in a write-protected directory. If this directory is changed to be writable, an...

JWSDK *add-on

Javaserver Web Dev Kit version 1.0 JWSDK JWSDK directory traversal vulnerability is found by CHINANSL Security AdvisoryCSA-200106, i want to add another thing, it's also vulnerable to other operating system like redhat 6.1 and this nasty bug allows you to browse and read any file with ROOT...

Проблемы с vipw (weak permissons)

После редактирования /etc/shadow файл становится открытым на чтение...

[RHSA-2001:095-04] New util-linux packages available to fix vipw permissions problems

--------------------------------------------------------------------- Red Hat, Inc. Red Hat Security Advisory Synopsis: New util-linux packages available to fix vipw permissions problems Advisory ID: RHSA-2001:095-04 Issue date: 2001-07-12 Updated on: 2001-07-16 Product: Red Hat Linux Keywords:...

Moderate: Red Hat Security Advisory: : New util-linux packages available to fix vipw permissions problems

New util-linux packages are available for Red Hat Linux 7.1. These packages fix a problem where vipw would leave the /etc/shadow file world-readable after editing it. It is recommended that all users update to the fixed packages. Also, if you have used vipw on Red Hat Linux 7.1 before, make sure ...