CVE-2004-0530: Undefined Security Weakness

The PHP package in Slackware 8.1, 9.0, and 9.1, when linked against a static library, includes /tmp in the search path, which allows local users to execute arbitrary code as the PHP user by inserting shared libraries into the appropriate path...

PT-2004-1421 · Ca · Etrust Inoculateit

Name of the Vulnerable Software and Affected Versions: eTrust InoculateIT for Linux version 6.0 Description: The issue allows local users to overwrite arbitrary files via a symlink attack on files in /tmp, specifically through the inoregupdate, uniftest, or unimove scripts. Recommendations: For...

HP-UX shar utility creates files with predictable names in "/tmp" directory

Overview The shar program distributed with some versions of the HP-UX operating system creates files insecurely. This vulnerability could allow local users to gain escalated privilege on the system. Description shar is a program commonly available on UNIX systems to create a shell script that wil...

OpenServer 5.0.5 : Insecure creation of files in /tmp

To: [email protected] [email protected] [email protected] etsys.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SCO Security Advisory Subject: OpenServer 5.0.5 : Insecure creation of files in /tmp Advisory number: CSSA-2003-SCO.27 Issue date: 2003 October 20 Cross...

DEBIAN-CVE-2003-0136

psbanner in the LPRng package allows local users to overwrite arbitrary files via a symbolic link attack on the /tmp/before file...

CVE-2002-0377

Gaim 0.57 stores sensitive information in world-readable and group-writable files in the /tmp directory, which allows local users to access MSN web email accounts of other users who run Gaim by reading authentication information from the files...

CVE-2002-0377: Undefined Security Weakness

Gaim 0.57 stores sensitive information in world-readable and group-writable files in the /tmp directory, which allows local users to access MSN web email accounts of other users who run Gaim by reading authentication information from the files...

Matlab /tmp usage

INTRODUCTION MATLAB is "The Language of Technical Computing" http://www.mathworks.com/ PROBLEM As installed on UNIX machines, matlab uses shell scripts to launch; these scripts use files in /tmp in an unsafe way. DETAILS The matlab script uses /tmp/$$a and may clobber it, allowing an attacker to...

CVE-2002-0141

Maelstrom GPL 3.0.1 is affected by CVE-2002-0141: a local user can overwrite arbitrary files of other Maelstrom users via a symlink attack on the /tmp/f file. Root cause is a symlink race condition. The provided documents describe the vulnerability but do not include a remediation or patched vers...

cvs recompiled against updated zlib + /tmp fix

New cvs packages are available to fix security problems. Here's the information from the Slackware 8.0 ChangeLog: ---------------------------- Mon Mar 11 17:54:12 PST 2002 patches/packages/cvs.tgz: Patched to link to the shared zlib on the system instead of statically linking to the included zlib...

CVE-1999-1386: Improper Link Resolution Before File Access

Perl 5.00404 and earlier follows symbolic links when running with the -e option, which allows local users to overwrite arbitrary files via a symlink attack on the /tmp/perl-eaXXXXX file...

CVE-2001-0625: Undefined Security Weakness

ftpdownload in Computer Associates InoculateIT 6.0 allows a local attacker to overwrite arbitrary files via a symlink attack on /tmp/ftpdownload.log...

CVE-2001-1012

CVE-2001-1012 affects the screen utility prior to version 3.9.10. The issue is described as a multi-attach error that allows local users to gain root privileges when there is a subdirectory under /tmp/screens/. The connected sources confirm the affected component and the local-privilege escalatio...

Некорректная работа с идентификаторами сеансов в PHP4 (session spoofing)

Идентификаторы сеансов хранятся в директории /tmp...

Mozilla personal security manager /tmp issues

Playing with /tmp a bit this morning I ran into the following issue in mozilla... with mozilla open root@linuxppc root fuser -n file /tmp/.nsmc-0-lock /tmp/.nsmc-0-lock: 3220 3223 3224 3226 3227 3228 3229 root@linuxppc root ps -ef | grep 3220 root 3220 1 0 12:42 ? 00:00:00 ./psm sh-2.05$ id...

CVE-1999-1091

UNIX news readers tin and rtin create the /tmp/.tinlog file with insecure permissions and follow symlinks, which allows attackers to modify the permissions of files writable by the user via a symlink attack...

CVE-1999-1345: Undefined Security Weakness

AutoFTP.pl script in AutoFTP 0.2 uses the /tmp/ftptmp as a shared directory with insecure permissions, which allows local users to 1 send arbitrary files to the remote server by placing them in the directory, and 2 view files that are being transferred...

rcs2log

I have been sitting on this one for half a year. Time to disclose it. rcs2log uses files in /tmp insecurely. This was reported to the Emacs maintainers an aeon or two ago. Current preleases have a fix. And have had it for at least half a year. NOTE NOTE NOTE: there seem to be quite a few sources...

ml85p - driver for Samsung ML-85G and /tmp

ml85p - driver for Samsung ML-85G GDI printers seems to use /tmp unsecurely. it seems to use the time function to determine the /tmp files name. root@linux exp strings /usr/bin/ml85p | grep tmp /tmp/ml85gd 401070dd iopl0x3 = 0 400cf2bd timeNULL = 994462668 40100cbf brk0 = 0x8064544 40100cbf...

RH 7.0 Crontab exploit - apparently fixed

/ Crontab tmp file race condition http://bugzilla.redhat.com/bugzilla/showbug.cgi?id=37771 Apparently this is fixed. Wonder why it still works. Local exploit Quick and dirty exploit for crontab insecure tmp files Redhat 7.0 - kept up2date with up2date Checked Tue Jun 26 00:15:32 NZST 2001...