153 matches found
CentOS Update for postfix CESA-2008:0839 centos3 i386
Check for the Version of postfix OpenVAS Vulnerability Test CentOS Update for postfix CESA-2008:0839 centos3 i386 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...
PoCfix (PoC for Postfix local root vuln - CVE-2008-2936)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, The recent vulnerability in Postfix discovered by Sebastian Krahmer is trivially exploitable when certain preconditions are met. Nevertheless, it's very difficult to find such conditions in a real-world scenario. I wrote this exploit for fun an...
USN-636-1: Postfix vulnerability
Sebastian Krahmer discovered that Postfix was not correctly handling mailbox ownership when dealing with Linux's implementation of hardlinking to symlinks. In certain mail spool configurations, a local attacker could exploit this to append data to arbitrary files as the root user. The default...
DSA-1629-1 postfix - privilege escalation
Bulletin has no description...
GLSA-200808-12 : Postfix: Local privilege escalation vulnerability
The remote host is affected by the vulnerability described in GLSA-200808-12 Postfix: Local privilege escalation vulnerability Sebastian Krahmer of SuSE has found that Postfix allows to deliver mail to root-owned symlinks in an insecure manner under certain conditions. Normally, Postfix does not...
Moderate: Red Hat Security Advisory: postfix security update
Updated postfix packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Postfix is a Mail Transport Agent MTA, supporting LDAP, SMTP AUTH SASL, and TLS. A fl...
Postfix: Local privilege escalation vulnerability
Background Postfix is Wietse Venema's mailer that attempts to be fast, easy to administer, and secure, as an alternative to the widely-used Sendmail program. Description Sebastian Krahmer of SuSE has found that Postfix allows to deliver mail to root-owned symlinks in an insecure manner under...
postfix security update
2.3.3-2.1 - fixed postfix privilege problem with symlinks in the mail spool directory CVE-2008-2936 Resolves: rhbz456717...
GLSA-200611-14 : TORQUE: Insecure temporary file creation
The remote host is affected by the vulnerability described in GLSA-200611-14 TORQUE: Insecure temporary file creation TORQUE creates temporary files with predictable names. Please note that the TORQUE package shipped in Gentoo Portage is not vulnerable in the default configuration. Only systems...
TORQUE: Insecure temporary file creation
Background TORQUE is a resource manager providing control over batch jobs and distributed compute nodes. Description TORQUE creates temporary files with predictable names. Please note that the TORQUE package shipped in Gentoo Portage is not vulnerable in the default configuration. Only systems wi...
Cisco Secure Desktop SSL VPN会话多个信息泄露漏洞
Cisco Secure Desktop CSD可以通过加密降低远程用户注销或SSL VPN会话超时后cookies、浏览器历史记录、临时文件和下载内容在系统上所遗留的风险。 CSD的实现上存在如下一些问题，可能导致在SSL VPN会话相关的敏感信息泄露。 1. Windows页面文件信息泄露 由于Windows虚拟内存子系统运行的方式，任何应用程序所使用的虚拟物理内存，包括在Secure...
WorldMail IMAP Server Directory Traversal Arbitrary Spool Access
Binary data 3299.prm...
HP-UX PHCO_16629 : s700_800 11.00 libc cumulative patch
s700800 11.00 libc cumulative patch : rpc.pcnfsd has an error in its use of the spool directory. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and patch checks in this plugin were extracted from HP patch PHCO16629. The text itself is copyright C Hewlett-Packard...
CVE-2002-1509
A patch for shadow-utils 20000902 causes the useradd command to create a mail spool files with read/write privileges of the new user's group mode 660, which allows other users in the same group to read or modify the new user's incoming email...
CVE-2002-1509
CVE-2002-1509 concerns a bug in the shadow-utils useradd flow introduced by a patch in shadow-utils-20000902. The bug causes a new user’s mail spool to be created with group write/read permissions (mode 660) instead of being owned per the intended policy, enabling other users sharing the same pri...
CVE-2002-1509: Undefined Security Weakness
A patch for shadow-utils 20000902 causes the useradd command to create a mail spool files with read/write privileges of the new user's group mode 660, which allows other users in the same group to read or modify the new user's incoming email...
RHEL 2.1 : shadow-utils (RHSA-2003:058)
Updated shadow-utils packages are now available. These updated packages correct a bug that caused the useradd tool to create mail spools with incorrect permissions. The shadow-utils package includes programs for converting UNIX password files to the shadow password format, plus programs for...
Qualcomm Eudora 6.0.3 - MIME Message Nesting Denial of Service
Qualcomm Eudora 6.0.3 - MIME Message Nesting Denial of Service source: https://www.securityfocus.com/bid/10137/info It has been reported that Eudora is prone to a denial of service vulnerability when handling e-mail containing excessive MIME nesting. The problem is known to occur when the...
Linux groff utility pic contains format string vulnerability
Overview The pic component of the image processing package groff contains a format string vulnerability that could allow a remote attacker to execute arbitrary code. Description groff is an image processing package on Linux systems. A component of groff called pic contains a format-string...