712 matches found
CVE-2005-1152
popauth.c in qpopper 4.0.5 and earlier does not properly set the umask, which may cause qpopper to create files with group or world-writable permissions...
security flaw
cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O archive or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files...
RHEL 3 : cpio (RHSA-2005:080)
An updated cpio package that fixes a umask bug and supports large files 2GB is now available. This update has been rated as having low security impact by the Red Hat Security Response Team GNU cpio copies files into or out of a cpio or tar archive. It was discovered that cpio uses a 0 umask when...
security flaw
cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O archive or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files...
USN-75-1: cpio vulnerability
Recently it was discovered that cpio created world-writeable files when used in -o/--create mode with giving an output file with -O. This allowed any user to modify the created cpio archives. Now cpio respects the current umask setting of the user. Note: This vulnerability has already been fixed ...
CVE-1999-1572
CVE-1999-1572 is a local vulnerability affecting GNU cpio where a 0 umask is used when creating files with -O/-F, causing output files to have mode 0666 and enabling local users to read or overwrite them. Connected advisories (RHSA-2005:806, RHSA-2005:073, DSA-664-1, USN-75-1, Ubuntu USN-80-1, Ce...
CVE-1999-1572
cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O archive or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files...
Fedora Core 3 : php-4.3.10-3.2 (2004-568)
Tue Dec 21 2004 Joe Orton 4.3.10-3.2 - fix umask patch 143286 - Wed Dec 15 2004 Joe Orton 4.3.10-3.1 - update to 4.3.10, including security fixes 141135 : - unserializer integer overflows, CVE-2004-1019 - exif image parsing overflow, CVE-2004-1065 Note that Tenable Network Security has extracted...
Debian DSA-063-1 : xinetd - change default umask
zen-parse reported on bugtraq that there is a possible buffer overflow in the logging code from xinetd. This could be triggered by using a fake identd that returns special replies when xinetd does an ident request. Another problem is that xinetd sets it umask to 0. As a result any programs that...
GLSA-200409-08 : Ruby: CGI::Session creates files insecurely
The remote host is affected by the vulnerability described in GLSA-200409-08 Ruby: CGI::Session creates files insecurely The CGI::Session::FileStore implementation and presumably CGI::Session::PStore, which allow data associated with a particular Session instance to be written to a file, writes t...
Ruby: CGI::Session creates files insecurely
Background Ruby is an Object Oriented, interpreted scripting language used for many system scripting tasks. It can also be used for CGI web applications. Description The CGI::Session::FileStore implementation and presumably CGI::Session::PStore, which allow data associated with a particular Sessi...
Mandrake Linux Security Advisory : xinetd (MDKSA-2001:055-1)
A bug exists in xinetd as shipped with Mandrake Linux 8.0 dealing with TCP connections with the WAIT state that prevents linuxconf-web from working properly. As well, xinetd contains a security flaw in which it defaults to a umask of 0. This means that applications using the xinetd umask that do...
CVE-2002-1786
SGI IRIX 6.5 through 6.5.14 applies a umask of 022 to root core dumps, which allows local users to read the core dumps and possibly obtain sensitive information...
CVE-2001-1322
The CVE-2001-1322 issue concerns xinetd up to version 2.1.8 (and earlier) running with a default umask of 0, allowing local users to read or modify files created by processes started by xinetd that don’t set a safe umask. Public sources in the connected docs identify this as a local-privilege ris...
CVE-2001-1322
xinetd 2.1.8 and earlier runs with a default umask of 0, which could allow local users to read or modify files that are created by an application that runs under xinetd but does not set its own safe umask...
CVE-2001-0859
The CVE-2001-0859 entry concerns Red Hat Linux 7.1 (Korean installation) using kernel version 2.4.3-12, where the init default umask is set to 000. This causes installers to create files with world-writable permissions. The vulnerability details indicate the impact is limited to exposure via worl...
CVE-2001-0859
2.4.3-12 kernel in Red Hat Linux 7.1 Korean installation program sets the setting default umask for init to 000, which installs files with world-writeable permissions...
Palm Desktop 4.0b76-77 for Mac OS X
Hotsyncing via Palm Desktop 4.0b76-77 for Mac OS X creates backup folders and files that are world readable...even if umask is set to 077. Chat with friends online, try MSN Messenger: http://messenger.msn.com...
slackware.init.txt
I posted this to the linux kernel mailing last Friday, July 13th 2001: Submitted by : Josh [email protected], lockdown [email protected] on July 16th, 2001 Vulnerability : /lib/modules/2.4.5/modules.dep Tested On : Slackware 8.0. 2.4.5 Local : Yes Remote : No Temporary Fix : umask 022 at...