CVE-2000-1137

GNU ed before 0.2-18.1 allows local users to overwrite the files of other users via a symlink attack...

CVE-2000-1162

ghostscript before 5.10-16 allows local users to overwrite files of other users via a symlink attack...

CVE-2000-1134

Multiple shell programs on various Unix systems, including 1 tcsh, 2 csh, 3 sh, and 4 bash, follow symlinks when processing redirects aka here-documents or in-here documents, which allows local users to overwrite files of other users via a symlink attack...

CVE-2000-1135

fshd fsh daemon in Debian GNU/Linux allows local users to overwrite files of other users via a symlink attack...

[SECURITY] [DSA-009-1] multiple stunnel vulnerabilities

Package : stunnel Problem type : insecure file handling, format string bug Debian-specific: no Lez discovered a format string problem in stunnel a tool to create Universal SSL tunnel for other network daemons. Brian Hatch responded by stating he was already preparing a new release with multiple...

[SECURITY] [DSA-008-1] dialog symlink attack

Package : dialog Problem type : insecure temporary files Debian-specific: no Matt Kraai reported that he found a problem in the way dialog creates lock-files: it did not create them safely which made it susceptible to a symlink attack. This has been fixed in version 0.9a-20000118-3bis. wget url...

catman-race.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Solaris 2.7/2.8 catman temp file vulnerability. Larry W. Cashdollar Vapid Labs Date Published: 12/18/2000 Advisory ID: 11242000-02 Risk: Low Title: catman temp file vulnerability. Class: Design Error Remotely Exploitable: no Locally Exploitable: Yes...

CVE-2000-0935

Samba Web Administration Tool SWAT in Samba 2.0.7 allows local users to overwrite arbitrary files via a symlink attack on the cgi.log file...

CVE-2000-0934

Glint in Red Hat Linux 5.2 allows local users to overwrite arbitrary files and cause a denial of service via a symlink attack...

CVE-2000-0948

GnoRPM before 0.95 allows local users to modify arbitrary files via a symlink attack...

CVE-2000-1134

CVE-2000-1134 concerns multiple shells (tcsh, csh, sh, bash) that follow symlinks when processing here-documents (<

CVE-2000-1134

Multiple shell programs on various Unix systems, including 1 tcsh, 2 csh, 3 sh, and 4 bash, follow symlinks when processing redirects aka here-documents or in-here documents, which allows local users to overwrite files of other users via a symlink attack...

CVE-2000-0959

glibc2 does not properly clear the LDDEBUGOUTPUT and LDDEBUG environmental variables when a program is spawned from a setuid program, which could allow local users to overwrite files via a symlink attack...

PT-2000-1882 · Hewlett Packard · Hp-Ux

Name of the Vulnerable Software and Affected Versions: HP-UX version 11.00 Description: The issue allows local users to read arbitrary files via the -e option by creating a symlink to the target file during the crontab session, quitting the session, and reading the error messages that crontab...

Solaris 2.72.8 Catman - Local Insecure tmp Symlink

Solaris 2.72.8 Catman - Local Insecure tmp Symlink !/usr/local/bin/perl -w The problem is catman creates files in /tmp insecurly. They are based on the PID of the catman process, catman will happily clobber any files that are symlinked to that file. The idea of this script is to create a block of...

Solaris 2.7/2.8 Catman - Local Insecure tmp Symlink

!/usr/local/bin/perl -w The problem is catman creates files in /tmp insecurly. They are based on the PID of the catman process, catman will happily clobber any files that are symlinked to that file. The idea of this script is to create a block of symlinks to the target file with the current PID a...

[SECURITY] [DSA-004-1] nano symlink attack

Package : nano Problem type : symlink attack Debian-specific: no The problem that was previously reported for joe also occurs with other editors. When nano a free pico clone unexpectedly dies it tries a warning message to a new file with a predictable name the name of the file being edited with...

Symlink attack in (all?) Samba. - Local root walkthrough by Tozz

Symlink attack in all? Samba. - Local root walkthrough by Tozz ================================================================= Requirements: Shell access or any other way to create symlinks A running samba deamon The username and/or password of a user named in the admin lists in one or more...

mon_pine.sh

Hacksware Bug Report 1. Name: Pine temporary file hijacking vulnerability 2. Release Date: 2000.12.11 3. Affected Application: Pine Version 4.30or maybe other versions 4. Author: [email protected] 5. Type: Local Race Condition 6. Explanation If pine setting is like following: x...

[SECURITY] [DSA-001-1] ed symlink attack

-----BEGIN PGP SIGNED MESSAGE----- - ------------------------------------------------------------------------ Debian Security Advisory 001-1 [email protected] http://www.debian.org/security/ Wichert Akkerman November 29, 2000 -...