CVE-2000-1096

crontab by Paul Vixie uses predictable file names for a temporary file and does not properly ensure that the file is owned by the user executing the crontab -e command, which allows local users with write access to the crontab spool directory to execute arbitrary commands by creating...

Дырка в ksh

Проблема при создании временных файлов при перенаправлении ввода аналогична sh, tcsh bash и др...

Solaris patchadd(1) (3) symlink vulnerabilty

Greetings Bugtraq, I was playing around with patchadd and the bug was found when I issued a "truss -f -o patch.log patchadd patch" where patch was a tarball and then patchadd omitted an error because of it being a tarball, so then when I went through the debug output, i found out that there was a...

Дырка в patchadd под Solaris

Уязвимость символьных линков + некорректные разрешения на временные файлы...

Pine (Local Message Grabber) - Local Message Read

!/bin/sh Grab local pine messages Usage: ./monpine.sh victim pine must use following settings [email protected] http://hacksware.com x enable-alternate-editor-cmd x enable-alternate-editor-implicitly editor = /usr/bin/vi PID=$1 PICOFILE=printf "/tmp/pico.%.6d" $PID TRASHCAN=/tmp/.trashcan.date|se...

Pine (Local Message Grabber) Exploit

Exploit for linux platform in category local exploits ==================================== Pine Local Message Grabber Exploit ==================================== !/bin/sh Grab local pine messages Usage: ./monpine.sh victim pine must use following settings email protected http://hacksware.com x...

Pine (Local Message Grabber) - Local Message Read

Pine Local Message Grabber - Local Message Read !/bin/sh Grab local pine messages Usage: ./monpine.sh victim pine must use following settings [email protected] http://hacksware.com x enable-alternate-editor-cmd x enable-alternate-editor-implicitly editor = /usr/bin/vi PID=$1 PICOFILE=printf...

[hacksware]Pine temporary file hijacking vulnerability

Hacksware Bug Report 1. Name: Pine temporary file hijacking vulnerability 2. Release Date: 2000.12.11 3. Affected Application: Pine Version 4.30or maybe other versions 4. Author: [email protected] 5. Type: Local Race Condition 6. Explanation If pine setting is like following: x...

mon_pine.sh

Hacksware Bug Report 1. Name: Pine temporary file hijacking vulnerability 2. Release Date: 2000.12.11 3. Affected Application: Pine Version 4.30or maybe other versions 4. Author: [email protected] 5. Type: Local Race Condition 6. Explanation If pine setting is like following: x...

[SECURITY] New version of ghostscript released

------------------------------------------------------------------------ Debian Security Advisory [email protected] http://www.debian.org/security/ Wichert Akkerman November 23, 2000 - ------------------------------------------------------------------------ Package : gs Problem type : symlink...

Solaris 2.x/7.0/8 - 'Catman' Race Condition (2)

source: https://www.securityfocus.com/bid/2149/info catman is a utility for creating preformatted man pages, distributed as part of the Solaris Operating Environment. A problem exists which could allow local users to overwrite or corrupt files owned by other users. The problem occurs in the...

Solaris 2.x7.08 - Catman Race Condition (2)

Solaris 2.x7.08 - Catman Race Condition 2 source: https://www.securityfocus.com/bid/2149/info catman is a utility for creating preformatted man pages, distributed as part of the Solaris Operating Environment. A problem exists which could allow local users to overwrite or corrupt files owned by...

FreeBSD-SA-00:76.tcsh-csh

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:76 Security Advisory FreeBSD, Inc. Topic: tcsh/csh creates insecure temporary file Category: core, ports Module: tcsh, 44bsd-csh Announced: 2000-11-20 Affects: FreeBSD...

[ Hackerslab bug_paper ] HP-UX crontab temporary file symbolic link vulnerability

============================================================================ ==== Hackerslab bugpaper HP-UX crontab temporary file symbolic link vulnerability ============================================================================ ==== File : /usr/bin/crontab SYSTEM : HP-UX Tested in HP-UX...

CVE-2000-0781

uagentsetup in ARCServeIT Client Agent 6.62 does not properly check for the existence or ownership of a temporary file which is moved to the agent.cfg configuration file, which allows local users to execute arbitrary commands by modifying the temporary file before it is moved...

CVE-2000-0338

Concurrent Versions Software CVS uses predictable temporary file names for locking, which allows local users to cause a denial of service by creating the lock directory before it is created for use by a legitimate CVS user...

CVE-2000-0552

CVE-2000-0552 affects the ICQwebmail client for ICQ 2000A. The vulnerability arises because a temporary file created during login is world-readable and not deleted, enabling local users to access sensitive information. Documents confirm the affected software and the insecure temp-file handling; r...

CVE-2000-0552

ICQwebmail client for ICQ 2000A creates a world readable temporary file during login and does not delete it, which allows local users to obtain sensitive information...

CVE-2000-0579

IRIX crontab creates temporary files with predictable file names and with the umask of the user, which could allow local users to modify another user's crontab file as it is being edited...

CVE-2000-0338

Summary: CVE-2000-0338 affects Concurrent Versions Software (CVS). The vulnerability arises from predictable temporary file names used for locking, enabling a local user to pre-create the lock directory before the legitimate CVS process, causing a denial of service. Impact (as described): local a...