DEBIAN-CVE-2005-0990

unshar unshar.c in sharutils 4.2.1 allows local users to overwrite arbitrary files via a symlink attack on the unsh.X temporary file...

Fedora Core 2 : krb5-1.3.6-1 (2004-563)

A heap based buffer overflow bug was found in the administration library of Kerberos 1.3.5 and earlier. This overflow in the password history handling code could allow an authenticated remote attacker to execute commands on a realm's master Kerberos KDC. The Common Vulnerabilities and Exposures...

Debian DSA-016-3 : wu-ftpd - temp file creation and format string

Security people at WireX have noticed a temp file creation bug and the WU-FTPD development team has found a possible format string bug in wu-ftpd. Both could be remotely exploited, though no such exploit exists currently. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text a...

GLSA-200407-01 : Esearch: Insecure temp file handling

The remote host is affected by the vulnerability described in GLSA-200407-01 Esearch: Insecure temp file handling The eupdatedb utility uses a temporary file /tmp/esearchdb.py.tmp to indicate that the eupdatedb process is running. When run, eupdatedb checks to see if this file exists, but it does...

gzip: Insecure creation of temporary files

Background gzip GNU zip is popular compression program. The included gzexe utility allows you to compress executables in place and have them automatically uncompress and execute when you run them. Description The script gzexe included with gzip contains a bug in the code that handles tempfile...

[SECURITY] [DSA 279-1] New metrics packages fix insecure temporary file creation

-------------------------------------------------------------------------- Debian Security Advisory DSA 279-1 [email protected] http://www.debian.org/security/ Martin Schulze April 7th, 2003 http://www.debian.org/security/faq -...

[SECURITY] [DSA-016-3] Correction: New version of wu-ftpd released

---------------------------------------------------------------------------- Debian Security Advisory DSA-016-3 [email protected] http://www.debian.org/security/ Martin Schulze January 24, 2001 - ---------------------------------------------------------------------------- Package : wu-ftpd...

[SECURITY] [DSA-016-2] Correction: New version of wu-ftpd released

---------------------------------------------------------------------------- Debian Security Advisory DSA-016-2 [email protected] http://www.debian.org/security/ Martin Schulze January 23, 2001 - ---------------------------------------------------------------------------- Package : wu-ftpd...

Immunix OS Security update for lots of temp file problems

----------------------------------------------------------------------- Immunix OS Security Advisory Summary Date: January 10, 2000 Advisory ID: IMNX-2000-70-028-01 Author: Greg Kroah-Hartman [email protected] ----------------------------------------------------------------------- In an internal aud...

catman-race.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Solaris 2.7/2.8 catman temp file vulnerability. Larry W. Cashdollar Vapid Labs Date Published: 12/18/2000 Advisory ID: 11242000-02 Risk: Low Title: catman temp file vulnerability. Class: Design Error Remotely Exploitable: no Locally Exploitable: Yes...

Catman file clobbering vulnerability Solaris 2.x

Solaris 2.7/2.8 catman temp file vulnerability. Larry W. Cashdollar Vapid Labs Date Published: 12/18/2000 Advisory ID: 11242000-02 Risk: Low Title: catman temp file vulnerability. Class: insecure temp file handling. Remotely Exploitable: no Locally Exploitable: Yes Vulnerability Description:...

[SECURITY] New version of xpdf released

Package : xpdf Problem type : local exploit Debian-specific: no xpdf as distributed in Debian GNU/Linux 2.2 suffered from two problems: 1. creation of temporary files was not done safely which made xpdf vulnerable to a symlink attack. 2. when handling URLs in documents no checking was done for...

Solaris 2.5.1 lp lpsched - Symlink

Solaris 2.5.1 lp lpsched - Symlink !/bin/sh lpNet & temp file exploit: break lp, then use lp priv to break root or bin, etc.... Written by: Chris Sheldon [email protected] Tested on Solaris-2.5.1: SunOS testhost 5.5.1 Generic sun4m sparc SUNW,SPARCstation-20 Caveat: This system is running...

Solaris 2.5.1 lp / lpsched - Symlink

!/bin/sh lpNet & temp file exploit: break lp, then use lp priv to break root or bin, etc.... Written by: Chris Sheldon [email protected] Tested on Solaris-2.5.1: SunOS testhost 5.5.1 Generic sun4m sparc SUNW,SPARCstation-20 Caveat: This system is running without patches. Sun released patch...