2.4.x/Slackware Init script vulnerability

I posted this to the linux kernel mailing last Friday, July 13th 2001: Submitted by : Josh [email protected], lockdown [email protected] on July 16th, 2001 Vulnerability : /lib/modules/2.4.5/modules.dep Tested On : Slackware 8.0. 2.4.5 Local : Yes Remote : No Temporary Fix : umask 022 at...

CVE-2001-1322

xinetd 2.1.8 and earlier runs with a default umask of 0, which could allow local users to read or modify files that are created by an application that runs under xinetd but does not set its own safe umask...

[SECURITY] [DSA-063-1] two xinetd problems

Package : xinetd Problem type : change default umask buffer overflow Debian-specific: no zen-parse reported on bugtraq that there is a possible buffer overflow in the logging code from xinetd. This could be triggered by using a fake identd that returns special replies when xinetd does an ident...

CVE-2001-0067

The installation of J-Pilot creates the .jpilot directory with the user's umask, which could allow local attackers to read other users' PalmOS backup information if their umasks are not securely set...

CVE-2001-0067

CVE-2001-0067 concerns the jpilot program, which creates a .jpilot directory in the user’s home with world-writable permissions (777). This insecure default enables local attackers to read other users’ PalmOS backups if umasks are not strictly set. Root cause is directory creation with permissive...

CVE-2001-0067

The installation of J-Pilot creates the .jpilot directory with the user's umask, which could allow local attackers to read other users' PalmOS backup information if their umasks are not securely set...

vixie-cron.sh

Attached shell-script exploits fopen + preserved umask vulnerability in Paul Vixie's cron code. It will work on systems where /var/spool/cron is user-readable eg. 0755 - AFAIR Debian does so. RedHat at least 6.1 and previous have mode 0700 on /var/spool/cron, and thus it isn't exploitable in its...

CVE-2000-0579

IRIX crontab is affected: it creates temporary files with predictable names and the user’s umask, enabling local users to modify another user’s crontab while it is being edited. The CVSS data indicates local access with partial confidentiality/integrity/availability impact. No remediation details...

Veritas Volume Manager 3.0.x hole

Veritas Volume Manager 3.0.x for Solaris contains a security hole which can, under specific circumstances, allow local users to gain root access. Details ------- When a system with Veritas Volume Manger 3.0.x installed boots, the initialization script for the Storage Administrator Server...

BMC Software Patrol 3.2.5 - Patrol SNMP Agent File CreationPermission

BMC Software Patrol 3.2.5 - Patrol SNMP Agent File CreationPermission source: https://www.securityfocus.com/bid/525/info Patrol 3.2, installed out of the box, allows for a local root compromise or denial of service. The vulnerability lies in the creation of a file by snmpagnt that is owned by the...

DEBIAN-CVE-1999-1572

cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O archive or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files...

CVE-1999-1572

cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O archive or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files...