CVE-2003-0247

CVE-2003-0247: Affects the Linux kernel 2.4 series in the TTY layer, enabling a denial-of-service via a kernel oops. Public docs reference Debian/Red Hat advisories and OpenVAS entries noting missing updates to kernel patches (e.g., 2.4.18-powerpc, 2.4.17-mips) as remediation. The connected docs ...

CVE-2003-0247: Undefined Security Weakness

Unknown vulnerability in the TTY layer of the Linux kernel 2.4 allows attackers to cause a denial of service "kernel oops"...

CVE-2002-0824

CVE-2002-0824 affects BSD pppd, where a symlink attack on a file specified as a tty device allows local users to change permissions of arbitrary files. The description states this is a local privilege/subversion of permissions vulnerability, but the connected documents do not provide additional t...

CVE-2002-0824: Improper Link Resolution Before File Access

BSD pppd allows local users to change the permissions of arbitrary files via a symlink attack on a file that is specified as a tty device...

Solaris 2.x /usr/sbin/wall Advisory

Affected Operating Systems: Solaris 2.x-9 Possibly others derived from AT&T source code. Affected Program: /usr/sbin/wall Synopsis: Wall is a setgid tty program that broadcasts a message to every user currently logged into the system. It can also receive messages from remote hosts, via RPC...

Symbolic link problem in pppd

It's possible to change file permisions via symbolic link by using it as a tty device...

CVE-2002-0333

Directory traversal vulnerability in xtell xtelld 1.91.1 and earlier, and 2.x before 2.7, allows remote attackers to read files with short names, and local users to read more files using a symlink with a short name, via a .. in the TTY argument...

CVE-2002-0327

Buffer overflow in Century Software TERM allows local users to gain root privileges via a long tty argument to the callin program...

CVE-2002-0333

Directory traversal vulnerability in xtell xtelld 1.91.1 and earlier, and 2.x before 2.7, allows remote attackers to read files with short names, and local users to read more files using a symlink with a short name, via a .. in the TTY argument...

CVE-2002-0327: Undefined Security Weakness

Buffer overflow in Century Software TERM allows local users to gain root privileges via a long tty argument to the callin program...

CVE-2002-0333: Undefined Security Weakness

Directory traversal vulnerability in xtell xtelld 1.91.1 and earlier, and 2.x before 2.7, allows remote attackers to read files with short names, and local users to read more files using a symlink with a short name, via a .. in the TTY argument...

CVE-1999-1341

Linux kernel before 2.3.18 or 2.2.13pre15, with SLIP and PPP options, allows local unprivileged users to forge IP packets via the TIOCSETD option on tty devices...

CVE-1999-1341: Undefined Security Weakness

Linux kernel before 2.3.18 or 2.2.13pre15, with SLIP and PPP options, allows local unprivileged users to forge IP packets via the TIOCSETD option on tty devices...

CVE-2001-1555

ptchmod in Solaris 8 does not call fdetach to reset terminal privileges when users log out of terminals, which allows local users to write to other users' terminals by modifying the ACL of a TTY...

Проблема с dump в NetBSD (privelege escalation)

При вызове внешней программы указанной пользователем не сбрасывается egid tty...

Security Advisory 2001-014: dump(8) exposes 'tty' group

-----BEGIN PGP SIGNED MESSAGE----- NetBSD Security Advisory 2001-014 ================================= Topic: dump8 exposes 'tty' group Version: NetBSD-current: source prior to August 8, 2001 NetBSD 1.5.1: affected NetBSD 1.5: affected NetBSD 1.4.x: all affected Severity: local users can gain tty...

CVE-2000-1108: Undefined Security Weakness

cons.saver in Midnight Commander mc 4.5.42 and earlier does not properly verify if an output file descriptor is a TTY, which allows local users to corrupt files by creating a symbolic link to the target file, calling mc, and specifying that link as a TTY argument...

Дырка в write в Solaris

Переполнение буфера в аргументе командной строки дает возможность получить egid tty...

CVE-2000-1108

cons.saver in Midnight Commander mc 4.5.42 and earlier does not properly verify if an output file descriptor is a TTY, which allows local users to corrupt files by creating a symbolic link to the target file, calling mc, and specifying that link as a TTY argument...

Redhat 6.1 / 6.2 TTY Flood Users Exploit

Exploit for linux platform in category dos / poc ======================================== Redhat 6.1 / 6.2 TTY Flood Users Exploit ======================================== !/bin/bash by teleh0r TTYDIR=/dev/pts NONSENSE=/bin/nice MYTTY=tty To prevent flooding of one's own TTY while /bin/true ; do...