Дырка в GNOrpm

Некорректная работа с временными файлами позволяет переписать любой файл...

Дырка в xpdf

Некорректная работа с временными файлами позволяют атаку через символьные линки?...

дырка в Helix GNOME Updater

Некорректная работа с временными файлами помещаются во временную директорию, не проверяется принадлежность директории...

HP Security vulnerability in the man command

Systems Affected: HPUX 10.20 and 11.00 and probably other revs. Short Description: The 'man' command potentially allows attackers to overwrite any arbitrary file on the system via symlink bugs. I notified HP on 5-8-2000 and I've been told that a patch is forthcoming soon. No HP advisory has come...

Проблема символьных линков в Netscape

При создании временого файла с предсказуемым именем для хранения сертификата сервера не проверяется наличие символьного линка. Таким образом может быть перезаписан файл принадлежащий пользователю...

Netscape Communicator 4.54.514.64.614.74.724.73 - tmp Symlink

Netscape Communicator 4.54.514.64.614.74.724.73 - tmp Symlink source: https://www.securityfocus.com/bid/1201/info Netscape Communicator version 4.73 and prior may be susceptible to a /tmp file race condition when importing certificates. Netscape creates a /tmp file which is world readable and...

CVE-2000-0270

The make-temp-name Lisp function in Emacs 20 creates temporary files with predictable names, which allows attackers to conduct a symlink attack...

Two Problems in IMP 2

Crimelabs, Inc. www.crimelabs.com Security Advisory Crimelabs Security Advisory CLABS200003 Title: IMP/MSWordView /tmp Problems Date: 22 April, 2000 Application: IMP with MSWordView Platform: Any supported by IMP, MSWordView Severity: Moderate -- anyone can view Word document attachments processe...

CVE-2000-0089

The rdisk utility in Microsoft Terminal Server Edition and Windows NT 4.0 stores registry hive information in a temporary file with permissions that allow local users to read it, aka the "RDISK Registry Enumeration File" vulnerability...

autobuse-angel.txt

Hi, This weekend I decided to play around with a couple of network management tools on securityfocus.com; Angel http://www.paganini.net/angel/, and Autobuse http://www.picante.com/gtaylor/download/. Unfortunately, upon review of the source, I noticed a bad trend. Both tools handle temporary files...

FreeBSD-SA-00:01.make

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:01 Security Advisory FreeBSD, Inc. Topic: Insecure temporary file handling in make1 Category: core Module: make Announced: 2000-01-19 Affects: All versions before the...

CVE-1999-1332

gzexe in the gzip package on Red Hat Linux 5.0 and earlier allows local users to overwrite files of other users via a symlink attack on a temporary file...

CVE-1999-1332

gzexe in the gzip package on Red Hat Linux 5.0 and earlier allows local users to overwrite files of other users via a symlink attack on a temporary file...

[SECURITY] New versions of trn fixes /tmp race

All former versions of trn used a hardcoded filename in /tmp as temporary storage. If the file already exists as symbolic link to users files they will be overwritten. We recommend you upgrade your man2html package as soon as possible. wget url will fetch the file for you dpkg -i file.deb will...

[SECURITY] New versions of trn fixes /tmp race

All former versions of trn used a hardcoded filename in /tmp as temporary storage. If the file already exists as symbolic link to users files they will be overwritten. We recommend you upgrade your man2html package as soon as possible. wget url will fetch the file for you dpkg -i file.deb will...

tmp-advisory.txt

L0pht Security Tool and miniAdvisory Advisory released Jan 8 1999 Application: A tool designed to monitor directory activity, copy transient files based upon regular expression matching, syslog upon seeing links created, etc. etc. Severity: Just about every OS out there is replete with programs...

oss-sound-tmp.txt

Date: Thu, 17 Dec 1998 02:12:38 +0200 From: Stefan Laudat Reply-To: Bugtraq List To: [email protected] Subject: OSS nice tmp race Hello all, While digging in the "soundon" script delivered with the OSS package the commercial one, of course, I have discovered something very unusual on line 26...

dip-exploit.sh

justa note.. dont forget to erase the temp.dip file when you run this exploit. / dip-exploit.c - overruns the buffer in dochatkey to give a shell / include include include include include define PATHDIP "/usr/sbin/dip" uchar shell = / courtesy of avalon ; /...

Caldera kdenetwork 1.1.1-1 Caldera OpenLinux 1.32.2 KDE KDE 1.11.1. RedHat Linux 6.0 - K-Mail File Creation

Caldera kdenetwork 1.1.1-1 Caldera OpenLinux 1.32.2 KDE KDE 1.11.1. RedHat Linux 6.0 - K-Mail File Creation // source: https://www.securityfocus.com/bid/300/info KMail is a mail user agent that comes with the kdenetwork package, part of the K Desktop Environment. A vulnerability in the way KMail...

G. Wilford man 2.3.10 - Symlink

G. Wilford man 2.3.10 - Symlink source: https://www.securityfocus.com/bid/305/info The man command created a temporary file under /tmp with a predictable name and is willing to follow symbolic links. This may allow malicious local users to create arbitrarily named files. zsoelim1 is a utility par...