CVE-2000-0338

Summary: CVE-2000-0338 affects Concurrent Versions Software (CVS). The vulnerability arises from predictable temporary file names used for locking, enabling a local user to pre-create the lock directory before the legitimate CVS process, causing a denial of service. Impact (as described): local a...

CVE-2000-0579

IRIX crontab creates temporary files with predictable file names and with the umask of the user, which could allow local users to modify another user's crontab file as it is being edited...

CVE-2000-0338: Improper Locking

Concurrent Versions Software CVS uses predictable temporary file names for locking, which allows local users to cause a denial of service by creating the lock directory before it is created for use by a legitimate CVS user...

CVE-2000-0552: Incomplete Cleanup

ICQwebmail client for ICQ 2000A creates a world readable temporary file during login and does not delete it, which allows local users to obtain sensitive information...

Дырка в GNOrpm

Некорректная работа с временными файлами позволяет переписать любой файл...

Дырка в xpdf

Некорректная работа с временными файлами позволяют атаку через символьные линки?...

дырка в Helix GNOME Updater

Некорректная работа с временными файлами помещаются во временную директорию, не проверяется принадлежность директории...

HP Security vulnerability in the man command

Systems Affected: HPUX 10.20 and 11.00 and probably other revs. Short Description: The 'man' command potentially allows attackers to overwrite any arbitrary file on the system via symlink bugs. I notified HP on 5-8-2000 and I've been told that a patch is forthcoming soon. No HP advisory has come...

Проблема символьных линков в Netscape

При создании временого файла с предсказуемым именем для хранения сертификата сервера не проверяется наличие символьного линка. Таким образом может быть перезаписан файл принадлежащий пользователю...

Netscape Communicator 4.54.514.64.614.74.724.73 - tmp Symlink

Netscape Communicator 4.54.514.64.614.74.724.73 - tmp Symlink source: https://www.securityfocus.com/bid/1201/info Netscape Communicator version 4.73 and prior may be susceptible to a /tmp file race condition when importing certificates. Netscape creates a /tmp file which is world readable and...

CVE-2000-0270

The make-temp-name Lisp function in Emacs 20 creates temporary files with predictable names, which allows attackers to conduct a symlink attack...

Two Problems in IMP 2

Crimelabs, Inc. www.crimelabs.com Security Advisory Crimelabs Security Advisory CLABS200003 Title: IMP/MSWordView /tmp Problems Date: 22 April, 2000 Application: IMP with MSWordView Platform: Any supported by IMP, MSWordView Severity: Moderate -- anyone can view Word document attachments processe...

CVE-2000-0089

The rdisk utility in Microsoft Terminal Server Edition and Windows NT 4.0 stores registry hive information in a temporary file with permissions that allow local users to read it, aka the "RDISK Registry Enumeration File" vulnerability...

autobuse-angel.txt

Hi, This weekend I decided to play around with a couple of network management tools on securityfocus.com; Angel http://www.paganini.net/angel/, and Autobuse http://www.picante.com/gtaylor/download/. Unfortunately, upon review of the source, I noticed a bad trend. Both tools handle temporary files...

FreeBSD-SA-00:01.make

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:01 Security Advisory FreeBSD, Inc. Topic: Insecure temporary file handling in make1 Category: core Module: make Announced: 2000-01-19 Affects: All versions before the...

CVE-1999-1332

gzexe in the gzip package on Red Hat Linux 5.0 and earlier allows local users to overwrite files of other users via a symlink attack on a temporary file...

CVE-1999-1332

gzexe in the gzip package on Red Hat Linux 5.0 and earlier allows local users to overwrite files of other users via a symlink attack on a temporary file...

[SECURITY] New versions of trn fixes /tmp race

All former versions of trn used a hardcoded filename in /tmp as temporary storage. If the file already exists as symbolic link to users files they will be overwritten. We recommend you upgrade your man2html package as soon as possible. wget url will fetch the file for you dpkg -i file.deb will...

[SECURITY] New versions of trn fixes /tmp race

All former versions of trn used a hardcoded filename in /tmp as temporary storage. If the file already exists as symbolic link to users files they will be overwritten. We recommend you upgrade your man2html package as soon as possible. wget url will fetch the file for you dpkg -i file.deb will...

oss-sound-tmp.txt

Date: Thu, 17 Dec 1998 02:12:38 +0200 From: Stefan Laudat Reply-To: Bugtraq List To: [email protected] Subject: OSS nice tmp race Hello all, While digging in the "soundon" script delivered with the OSS package the commercial one, of course, I have discovered something very unusual on line 26...