CVE-2001-1012

CVE-2001-1012 affects the screen utility prior to version 3.9.10. The issue is described as a multi-attach error that allows local users to gain root privileges when there is a subdirectory under /tmp/screens/. The connected sources confirm the affected component and the local-privilege escalatio...

Некорректная работа с идентификаторами сеансов в PHP4 (session spoofing)

Идентификаторы сеансов хранятся в директории /tmp...

Mozilla personal security manager /tmp issues

Playing with /tmp a bit this morning I ran into the following issue in mozilla... with mozilla open root@linuxppc root fuser -n file /tmp/.nsmc-0-lock /tmp/.nsmc-0-lock: 3220 3223 3224 3226 3227 3228 3229 root@linuxppc root ps -ef | grep 3220 root 3220 1 0 12:42 ? 00:00:00 ./psm sh-2.05$ id...

CVE-1999-1091

UNIX news readers tin and rtin create the /tmp/.tinlog file with insecure permissions and follow symlinks, which allows attackers to modify the permissions of files writable by the user via a symlink attack...

CVE-1999-1345: Undefined Security Weakness

AutoFTP.pl script in AutoFTP 0.2 uses the /tmp/ftptmp as a shared directory with insecure permissions, which allows local users to 1 send arbitrary files to the remote server by placing them in the directory, and 2 view files that are being transferred...

rcs2log

I have been sitting on this one for half a year. Time to disclose it. rcs2log uses files in /tmp insecurely. This was reported to the Emacs maintainers an aeon or two ago. Current preleases have a fix. And have had it for at least half a year. NOTE NOTE NOTE: there seem to be quite a few sources...

ml85p - driver for Samsung ML-85G and /tmp

ml85p - driver for Samsung ML-85G GDI printers seems to use /tmp unsecurely. it seems to use the time function to determine the /tmp files name. root@linux exp strings /usr/bin/ml85p | grep tmp /tmp/ml85gd 401070dd iopl0x3 = 0 400cf2bd timeNULL = 994462668 40100cbf brk0 = 0x8064544 40100cbf...

RH 7.0 Crontab exploit - apparently fixed

/ Crontab tmp file race condition http://bugzilla.redhat.com/bugzilla/showbug.cgi?id=37771 Apparently this is fixed. Wonder why it still works. Local exploit Quick and dirty exploit for crontab insecure tmp files Redhat 7.0 - kept up2date with up2date Checked Tue Jun 26 00:15:32 NZST 2001...

FreeBSD-SA-01:36.samba

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:36 Security Advisory FreeBSD, Inc. Topic: samba ports contain locally exploitable /tmp races Category: ports Module: samba Announced: 2001-04-23 Credits: Marcus Meissner...

Samba 2.0.x - Insecure TMP File Symbolic Link

Samba 2.0.x - Insecure TMP File Symbolic Link // source: https://www.securityfocus.com/bid/2617/info Samba is a flexible file sharing packaged maintained by the Samba development group. It provides interoperatability between UNIX and Microsoft Windows systems, permitting the sharing of files and...

SuSE 6.x7.0 - MkDir Error Handling rctab Race Condition (1)

SuSE 6.x7.0 - MkDir Error Handling rctab Race Condition 1 source: https://www.securityfocus.com/bid/2207/info rctab is the Run Control Tab script included with the SuSE distribution of the Linux Operating System. SuSE is a freely available, Open Source Operating system maintained by SuSE...

SuSE 6.x/7.0 - MkDir Error Handling rctab Race Condition (2)

source: https://www.securityfocus.com/bid/2207/info rctab is the Run Control Tab script included with the SuSE distribution of the Linux Operating System. SuSE is a freely available, Open Source Operating system maintained by SuSE Incorporated. A race condition in the rctab script could allow an...

SuSE 6.x/7.0 - MkDir Error Handling rctab Race Condition (1)

source: https://www.securityfocus.com/bid/2207/info rctab is the Run Control Tab script included with the SuSE distribution of the Linux Operating System. SuSE is a freely available, Open Source Operating system maintained by SuSE Incorporated. A race condition in the rctab script could allow an...

/bin/ksh creates insecure tmp files

Recently I reported that, similarly to the recently discussed tcsh vulnerability, the Bourne shell /bin/sh creates temporary files in an insecure way: http://www.securityfocus.com/templates/archive.pike?list=1&[email protected] At the time I also tested the Korn...

SunOS 5.7 Catman - Local Insecure tmp Symlink Clobber

!/usr/local/bin/perl -w The problem is catman creates files in /tmp insecurly. They are based on the PID of the catman process, catman will happily clobber any files that are symlinked to that file. The idea of this script is to watch the process list for the catman process, get the pid and Creat...

Solaris 2.72.8 Catman - Local Insecure tmp Symlink

Solaris 2.72.8 Catman - Local Insecure tmp Symlink !/usr/local/bin/perl -w The problem is catman creates files in /tmp insecurly. They are based on the PID of the catman process, catman will happily clobber any files that are symlinked to that file. The idea of this script is to create a block of...

KTH Kerberos filesystem race condition on tickets stored in /tmp

Overview There may be a race condition during the creation of Kerberos ticket files in the /tmp directory. This race condition may allow intruders with local access to the system to gain root privileges. Description During the creation of ticket files in the /tmp directory, a sequence of calls...

CVE-2000-1156: Undefined Security Weakness

StarOffice 5.2 follows symlinks and sets world-readable permissions for the /tmp/soffice.tmp directory, which allows a local user to read files of the user who is using StarOffice...

Slackware Linux - usrbinppp-off Insecure tmp Call

Slackware Linux - usrbinppp-off Insecure tmp Call !/bin/sh In SlackWare Linux the script /usr/bin/ppp-off writes the output of 'ps x' to /tmp/grep.tmp. Since root is the user that runs ppp-off, a non-privileged user could create a link from /tmp/grep.tmp to any fileie: /etc/issue, thus when root...

Slackware Linux - '/usr/bin/ppp-off' Insecure /tmp Call

!/bin/sh In SlackWare Linux the script /usr/bin/ppp-off writes the output of 'ps x' to /tmp/grep.tmp. Since root is the user that runs ppp-off, a non-privileged user could create a link from /tmp/grep.tmp to any fileie: /etc/issue, thus when root runs the ppp-off script, the output of 'ps x' woul...