CVE-2000-0949

Heap overflow in savestr function in LBNL traceroute 1.4a5 and earlier allows a local user to execute arbitrary commands via the -g option...

CVE-2000-0296

fcheck allows local users to gain privileges by embedding shell metacharacters into file names that are processed by fcheck...

CVE-2000-1096

crontab by Paul Vixie uses predictable file names for a temporary file and does not properly ensure that the file is owned by the user executing the crontab -e command, which allows local users with write access to the crontab spool directory to execute arbitrary commands by creating...

Serious security flaw in SuSE rctab

Hi @ll, it seems that the problem described below has not been discussed on Bugtraq. Problem description ------------------- Due to a various race conditions in the init level editing script /sbin/rctab it is possible for any local user to overwrite any system's file with arbitrary data. This may...

CVE-2000-1136

elvis-tiny before 1.4-10 in Debian GNU/Linux, and possibly other Linux operating systems, allows local users to overwrite files of other users via a symlink attack...

CVE-2000-1127

registrar in the HP resource monitor service allows local users to read and modify arbitrary files by renaming the original registrar.log log file and creating a symbolic link to the target file, to which registrar appends log information and sets the permissions to be world readable...

CVE-2000-1135

fshd fsh daemon in Debian GNU/Linux allows local users to overwrite files of other users via a symlink attack...

CVE-2000-1162

ghostscript before 5.10-16 allows local users to overwrite files of other users via a symlink attack...

CHINANSL Security Advisory(CSA200013)

CHINANSL Security AdvisoryCSA200013 Topic: IBM WCS local user exceed his authority to access another file Release Dateёє Dec 25, 2000 Affected system: ============ IBM WCSWebsphere Commerce Suite ЎЎЎЎ+ Sun OS ЎЎЎЎ+ Sun Solaris ЎЎЎЎ+ Microsoft Windows NT ЎЎЎЎ+ Microsoft Windows 2000 ЎЎЎЎ+ HP HP-UX...

CVE-2000-1128

The default configuration of McAfee VirusScan 4.5 does not quote the ImagePath variable, which improperly sets the search path and allows local users to place a Trojan horse "common.exe" program in the C:\Program Files directory...

STM symlink Vulnerability

Support Tool Manager Symlink Vulnerability From the STM manual page : The Support Tools Manager STM provides three interfaces that allow a user access to an underlying toolset, consisting of information modules, firmware update tools, verifiers, diagnostics, exercisers, expert tools, and utilitie...

alex heiphetz Group eZshopper 2.03.0 - Directory Traversal

alex heiphetz Group eZshopper 2.03.0 - Directory Traversal source: https://www.securityfocus.com/bid/2109/info It is possible for a remote user to gain read access to various files that reside within the EZShopper directory. By requesting a specially crafted URL utilizing loadpage.cgi' applicatio...

CVE-2000-1072

iCal 2.1 Patch 2 installs many files with world-writeable permissions, which allows local users to modify the iCal configuration and execute arbitrary commands by replacing the iplncal.sh program with a Trojan horse...

CVE-2000-1009

dump in Red Hat Linux 6.2 trusts the pathname specified by the RSH environmental variable, which allows local users to obtain root privileges by modifying the RSH variable to point to a Trojan horse program...

Apache 1.3 + PHP 3 - File Disclosure

source: https://www.securityfocus.com/bid/2060/info Apache Web Server is subject to disclose files to unauthorized users when used in conjunction with the PHP3 script language. By requesting a specially crafted URL by way of php, it is possible for a remote user to gain read access to a known fil...

CVE-2000-1012

The catopen function in FreeBSD 5.0 and earlier, and possibly other OSes, allows local users to read arbitrary files via the LANG environmental variable...

CVE-2000-1009

dump in Red Hat Linux 6.2 trusts the pathname specified by the RSH environmental variable, which allows local users to obtain root privileges by modifying the RSH variable to point to a Trojan horse program...

Solaris 2.x/7.0/8 - 'Catman' Race Condition (2)

source: https://www.securityfocus.com/bid/2149/info catman is a utility for creating preformatted man pages, distributed as part of the Solaris Operating Environment. A problem exists which could allow local users to overwrite or corrupt files owned by other users. The problem occurs in the...

Solaris 2.x7.08 - Catman Race Condition (2)

Solaris 2.x7.08 - Catman Race Condition 2 source: https://www.securityfocus.com/bid/2149/info catman is a utility for creating preformatted man pages, distributed as part of the Solaris Operating Environment. A problem exists which could allow local users to overwrite or corrupt files owned by...

vulnerability in mail.local

hi, mail.local is a little setuid root prog designed, like its name suggest, for local mail delivering. Used with the -l option, we have an interactive mode in lmtp protocol simplified smtp for local mail delivery only A weakness exists in the 'mail from' field that allow any local user to insert...