kernel: open() call allows setgid bit when user is not in new file's group

fs/open.c in the Linux kernel before 2.6.22 does not properly strip setuid and setgid bits when there is a write to a file, which allows local users to gain the privileges of a different group, and obtain sensitive information or possibly have unspecified other impact, by creating an executable...

kernel: open() call allows setgid bit when user is not in new file's group

fs/open.c in the Linux kernel before 2.6.22 does not properly strip setuid and setgid bits when there is a write to a file, which allows local users to gain the privileges of a different group, and obtain sensitive information or possibly have unspecified other impact, by creating an executable...

Linux Kernel 'truncate()'本地特权提升漏洞

BUGTRAQ ID: 31368 CVE ID：CVE-2008-4210 CNCVE ID：CNCVE-20084210 Linux是一款开放源代码的操作系统。 Linux内核'truncate'和'ftruncate'函数存在设计错误，本地攻击者可以利用漏洞提升特权。 当建立文件时，open/creat允许通过模式参数设置setgid位，由于bsdgroups mount选项或在setgid目录中建立文件，用户不属于新文件的组的成员。用户可以使用ftruncate和memory-mapped I/O使新文件成为任意两进制，获得此组的特权，原因是这些操作没有清除setgid位。...

xen xenmon.py / xenbaked insecure temporary file accesss

1 xenbaked and 2 xenmon.py in Xen 3.1 and earlier allow local users to truncate arbitrary files via a symlink attack on /tmp/xenq-shm...

Debian Security Advisory DSA 1402-1 (gforge)

The remote host is missing an update to gforge announced via advisory DSA 1402-1. OpenVAS Vulnerability Test $Id: deb14021.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1402-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Debian: Security Advisory (DSA-1395-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 1395-1 (xen-utils)

The remote host is missing an update to xen-utils announced via advisory DSA 1395-1. OpenVAS Vulnerability Test $Id: deb13951.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1395-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Code injection

gforge 3.1 and 4.5.14 allows local users to truncate arbitrary files via a symlink attack on temporary files...

CVE-2007-3919

1 xenbaked and 2 xenmon.py in Xen 3.1 and earlier allow local users to truncate arbitrary files via a symlink attack on /tmp/xenq-shm...

Debian DSA-1327-1 : gsambad - insecure temporary files

Steve Kemp from the Debian Security Audit project discovered that gsambad, a GTK+ configuration tool for samba, uses temporary files in an unsafe manner which may be exploited to truncate arbitrary files from the local system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

CVE-2007-3337

wakeup in Ingres database server 2006 9.0.4, r3, 2.6, and 2.5, as used in multiple CA Computer Associates products, allows local users to truncate arbitrary files via a symlink attack on the alarmwkp.def file...

CVE-2007-2109

Multiple unspecified vulnerabilities in Oracle Database 10.2.0.3 have unknown impact and remote authenticated attack vectors related to 1 Rules Manager and Expression Filter components DB02 and 2 Oracle Streams DB06. Note: as of 20070424, Oracle has not disputed reliable claims that DB02 is for a...

CVE-2000-0798

The truncate function in IRIX 6.x does not properly check for privileges when the file is in the xfs file system, which allows local users to delete the contents of arbitrary files...

CVE-2000-0798

CVE-2000-0798 affects IRIX 6.x when files reside on the xfs filesystem. The vulnerability arises because the truncate function does not properly check privileges, enabling local users to delete contents of arbitrary files. Public sources (NVD/NVD-linked entries) confirm the affected component as ...

IRIX 6.2/6.3/6.4 - xfs truncate() Privilege Check

/ source: https://www.securityfocus.com/bid/1540/info The truncate system call on a number of versions of the IRIX operating system with the xfs file system does not properly check permissions before truncating a file, making it possible for unprivileged users to damage files to which they would...