[Full-disclosure] [SECURITY] [DSA 907-1] New ipmenu packages fix insecure temporary file creation

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 907-1 [email protected] http://www.debian.org/security/ Martin Schulze November 23rd, 2005 http://www.debian.org/security/faq -...

DSA-907-1 ipmenu - insecure temporary file

Bulletin has no description...

CVE-2004-2569

CVE-2004-2569 affects ipmenu prior to 0.0.3-5 for Debian GNU/Linux; it allows a local user to overwrite arbitrary files by creating a symlink to ipmenu.log. Debian’s DSA-907-1 fixes this by upgrading ipmenu to a safe version (0.0.3-5). Impact is local, with no remote vector described; no exploita...

CVE-2004-2569

ipmenu 0.0.3 before Debian GNU/Linux ipmenu0.0.3-5 allows local users to overwrite arbitrary files via a symlink attack on the ipmenu.log temporary file...

CVE-2005-3349

GNU Gnump3d before 2.9.8 allows local users to modify or delete arbitrary files via a symlink attack on the index.lok temporary file...

CVE-2005-3349

GNU Gnump3d before 2.9.8 allows local users to modify or delete arbitrary files via a symlink attack on the index.lok temporary file...

CVE-2005-3349

CVE-2005-3349 affects gnump3d prior to 2.9.8, where insecure temporary-file handling (index.lok) enables local attackers to create symlink attacks and overwrite or delete files. Multiple advisories assess this as a local, path/temporary-file vulnerability in gnump3d and note related issues (CVE-2...

CVE-2005-3349

GNU Gnump3d before 2.9.8 allows local users to modify or delete arbitrary files via a symlink attack on the index.lok temporary file...

CVE-2003-1246

CVE-2003-1246 affects the Integrity Protection Driver (IPD) versions 1.2 and 1.3. The vulnerability is in NtCreateSymbolicLinkObject within ntdll.dll, allowing a local attacker to create and overwrite arbitrary files under boot/system path via a symlink attack on \winnt\system32\drivers using the...

CVE-2003-1281

cgihtml 1.69 is affected. Local users can overwrite arbitrary files via a symlink attack on certain temporary files, due to improper temporary file handling. Impact is local unauthorized file modification. Exploit details are not provided in the connected documents; remediation is not specified h...

CVE-2003-1279

S-PLUS 6.0 allows local users to overwrite arbitrary files and possibly elevate privileges via a symlink attack on 1 /tmp/F8499 by Sqpe, 2 /tmp/PRINT.$$.out by PRINT, 3 /tmp/SUBST$PID.TXT and /tmp/ed.cmds$PID by mustfix.hlinks, 4 /tmp/file.1 and /tmp/file.2 by sasget, 5 /tmp/file.1 by sasvars, an...

CVE-2003-1246

NtCreateSymbolicLinkObject in ntdll.dll in Integrity Protection Driver IPD 1.2 and 1.3 allows local users to create and overwrite arbitrary files via a symlink attack on \winnt\system32\drivers using the subst command...

CVE-2003-1281

cgihtml 1.69 allows local users to overwrite arbitrary files via a symlink attack on certain temporary files...

CVE-2003-1279

CVE-2003-1279 affects S-PLUS 6.0 and enables local users to overwrite arbitrary files via a symlink attack on multiple temporary files (e.g., /tmp/__F8499, /tmp/PRINT.$$.out, /tmp/SUBST$PID.TXT, /tmp/ed.cmds$PID, /tmp/file.1, /tmp/file.2, /tmp/sgml2html$$tmp, etc.). The underlying issue is a syml...

security flaw

pwmconfig in LMsensors before 2.9.1 creates temporary files insecurely, which allows local users to overwrite arbitrary files via a symlink attack on the fancontrol temporary file...

CVE-2005-3124

syslogtocern in Acme thttpd before 2.23 allows local users to write arbitrary files via a symlink attack on a temporary file...

CVE-2005-3124

syslogtocern in Acme thttpd before 2.23 allows local users to write arbitrary files via a symlink attack on a temporary file...

CVE-2005-3124

syslogtocern in Acme thttpd before 2.23 allows local users to write arbitrary files via a symlink attack on a temporary file...

CVE-2005-3124

CVE-2005-3124 affects the syslogtocern script in Acme thttpd prior to 2.23, enabling local attackers to overwrite arbitrary files via a symlink attack on a temporary file. Public advisories (Debian DSA-883-1, SUSE, Ubuntu, OpenVAS/Nessus entries) describe insecure temporary-file handling in thttp...

[SECURITY] [DSA 883-1] New thttpd packages fix insecure temporary file

-------------------------------------------------------------------------- Debian Security Advisory DSA 883-1 [email protected] http://www.debian.org/security/ Martin Schulze November 4th, 2005 http://www.debian.org/security/faq -...