Another Solaris 10 Patch Cluster Symlink Attack

Larry W. Cashdollar 8/6/2012 Here is another symlink attack with temp file creation using process id in Solaris 10 patch cluster. You can over write the contents of root owned files with the contents of inetd.conf. In patches/137097-01/SUNWcsr/reloc/lib/svc/method/inetd-upgrade lines : 72...

CVE-2012-3447

virt/disk/api.py in OpenStack Compute Nova 2012.1.x before 2012.1.2 and Folsom before Folsom-3 allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image that uses a symlink that is only readable by root. NOTE: this vulnerability exists because of an...

Solaris 10 Patch Cluster Symlink Attack

Larry W. Cashdollar 8/6/2012 Here is another symlink attack with temp file creation using process id in Solaris 10 patch cluster. You can over write the contents of root owned files with the contents of inetd.conf. In patches/137097-01/SUNWcsr/reloc/lib/svc/method/inetd-upgrade lines : 72...

CVE-2012-3440

A certain Red Hat script for sudo 1.7.2 on Red Hat Enterprise Linux RHEL 5 allows local users to overwrite arbitrary files via a symlink attack on the /var/tmp/nsswitch.conf.bak temporary file...

Arbitrary file deletion

A certain Red Hat script for sudo 1.7.2 on Red Hat Enterprise Linux RHEL 5 allows local users to overwrite arbitrary files via a symlink attack on the /var/tmp/nsswitch.conf.bak temporary file...

CVE-2012-3440

A certain Red Hat script for sudo 1.7.2 on Red Hat Enterprise Linux RHEL 5 allows local users to overwrite arbitrary files via a symlink attack on the /var/tmp/nsswitch.conf.bak temporary file...

CVE-2012-3440

A certain Red Hat script for sudo 1.7.2 on Red Hat Enterprise Linux RHEL 5 allows local users to overwrite arbitrary files via a symlink attack on the /var/tmp/nsswitch.conf.bak temporary file...

CVE-2012-3440

The CVE-2012-3440 entry concerns a race-condition in the sudo package (notably sudo 1.7.2 on Red Hat Enterprise Linux 5) that allows a local attacker to overwrite arbitrary files via a symlink attack on the /var/tmp/nsswitch.conf.bak temporary file. Connected advisories/plugins (MiracleLinux AXSA...

Solaris 10 Patch 137097-01 Symlink Attack Privilege Escalation

Exploit for solaris platform in category local exploits Larry W. Cashdollar 8/6/2012 Here is another symlink attack with temp file creation using process id in Solaris 10 patch cluster. You can over write the contents of root owned files with the contents of inetd.conf. In...

CVE-2012-2652

The bdrvopen function in Qemu 1.0 does not properly handle the failure of the mkstemp function, when in snapshot node, which allows local users to overwrite or read arbitrary files via a symlink attack on an unspecified temporary file...

DEBIAN-CVE-2012-2652

The bdrvopen function in Qemu 1.0 does not properly handle the failure of the mkstemp function, when in snapshot node, which allows local users to overwrite or read arbitrary files via a symlink attack on an unspecified temporary file...

CVE-2012-2652

The bdrvopen function in Qemu 1.0 does not properly handle the failure of the mkstemp function, when in snapshot node, which allows local users to overwrite or read arbitrary files via a symlink attack on an unspecified temporary file...

Hardcoded credentials

The bdrvopen function in Qemu 1.0 does not properly handle the failure of the mkstemp function, when in snapshot node, which allows local users to overwrite or read arbitrary files via a symlink attack on an unspecified temporary file...

CVE-2012-2652

The bdrvopen function in Qemu 1.0 does not properly handle the failure of the mkstemp function, when in snapshot node, which allows local users to overwrite or read arbitrary files via a symlink attack on an unspecified temporary file...

CVE-2012-2652

CVE-2012-2652 affects QEMU (bdrv_open in snapshot mode) where mkstemp failure handling allows a local attacker to race a symlink and overwrite/read arbitrary files. Affected context is QEMU 1.0 in snapshot mode; impact is local file read/write via symlink to an unnamed temporary file. Public advi...

sudo: insecure temporary file use in RPM %postun script

A certain Red Hat script for sudo 1.7.2 on Red Hat Enterprise Linux RHEL 5 allows local users to overwrite arbitrary files via a symlink attack on the /var/tmp/nsswitch.conf.bak temporary file...

PT-2012-4162 · Qemu · Qemu

Name of the Vulnerable Software and Affected Versions: Qemu version 1.0 Description: The issue arises from the bdrv open function in Qemu, which fails to properly handle the failure of the mkstemp function when in snapshot node. This allows local users to overwrite or read arbitrary files via a...

PT-2012-4713 · Red Hat +1 · Red Hat +1

Name of the Vulnerable Software and Affected Versions: Red Hat Enterprise Linux RHEL 5 with sudo version 1.7.2 Description: The issue allows local users to overwrite arbitrary files via a symlink attack on the /var/tmp/nsswitch.conf.bak temporary file. This is related to a certain Red Hat script...

Scientific Linux Security Update : coolkey on SL5.x i386/x86_64

Steve Grubb discovered a flaw in the way coolkey created a temporary directory. A local attacker could perform a symlink attack and cause arbitrary files to be overwritten. CVE-2007-4129 In addition, the updated packages contain fixes for the following bugs in the CAC Smart Card support : - CAC...

CVE-2012-3361

virt/disk/api.py in OpenStack Compute Nova Folsom 2012.2, Essex 2012.1, and Diablo 2011.3 allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image...