Linux news 13.04.00

Linux Kernel 2.2.15pre18 Сегодня вышел очередной, восемнадцатый по счету, пререлиз нового стабильного ядра Linux - Linux Kernel 2.2.15. Подробнее: http://kernelnotes.org/lnxlists/linux-kernel/lk000402/ Linux Kernel 2.3.99-pre5 Сегодня выпустили очередной пререлиз нового ядра Linux - Linux Kernel...

CNC Technology BizDB 1.0 - bizdb-search.cgi Remote Command Execution

CNC Technology BizDB 1.0 - bizdb-search.cgi Remote Command Execution source: https://www.securityfocus.com/bid/1104/info BizDB is a web databse integration product using perl CGI scripts. One of the scripts, bizdb-search.cgi, passes a variable's contents to an unchecked open call and can therefor...

Переполнение буфера в healthd

Тривиальное переполнение буфера в суид-утилите позволяет локальному пользователю получить привилегии root...

CVE-2000-0186

Buffer overflow in the dump utility in the Linux ext2fs backup package allows local users to gain privileges via a long command line argument...

FreeBSD-SA-00:12.healthd

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:12 Security Advisory FreeBSD, Inc. Topic: healthd allows a local root compromise Category: ports Module: healthd Announced: 2000-04-10 Credits: Discovered during FreeBSD...

beos.dos.txt

Problem: It is possible to crash the BeOS networking process. Discussion: The BeOS networking stack crashes when certain malformed packets are sent to it. This document explains two such packets. The first is an IP packet with the protocol field set to TCP. If the IP length field is set to be...

Уязвимость IBMHSSSB из Solaris

Суидная утилита /usr/bin/ikeyman запускает JAVA-приложение из пути, который может быть сконфигурирован пользователем...

icadecrypt.c.txt

/ icadecrypt.c Decrypt stored Citrix ICA passwords in appsrv.ini. Dug Song / include include include include include int hexdecodechar src, uchar dst, int outsize char p, pe; uchar q, qe, ch, cl; pe = src + strlensrc; qe = dst + outsize; for p = src, q = dst; p = '0' && ch = 'a' && ch = '0' && cl...

CVE-2000-0089

The rdisk utility in Microsoft Terminal Server Edition and Windows NT 4.0 stores registry hive information in a temporary file with permissions that allow local users to read it, aka the "RDISK Registry Enumeration File" vulnerability...

Corel Linux OS 1.0 - 'setxconf' Local Privilege Escalation

source: https://www.securityfocus.com/bid/1008/info A vulnerability exists in the setxconf utility, as shipped with Corel Linux 1.0. The -T option to setxconf will run xinit, which euid root. xinit, when executed, will invoke the contents on /.xserverrc. A malicious user could therefore execute...

CVE-2000-0089

The rdisk utility in Microsoft Terminal Server Edition and Windows NT 4.0 stores registry hive information in a temporary file with permissions that allow local users to read it, aka the "RDISK Registry Enumeration File" vulnerability...

CVE-1999-0381

super 3.11.6 and other versions have a buffer overflow in the syslog utility which allows a local user to gain root access...

CVE-1999-0677

The WebRamp web administration utility has a default password...

CVE-2000-0127

The Webspeed configuration program does not properly disable access to the WSMadmin utility, which allows remote attackers to gain privileges via wsisa.dll...

Corel Linux OS 1.0 - get_it PATH

Corel Linux OS 1.0 - getit PATH source: https://www.securityfocus.com/bid/928/info A component of the "Corel Update" utility distributed with Corel's Linux OS is vulnerable to a local PATH vulnerability. The binary "getit", which is stored in /usr/X11R6/bin, is setuid root installed by default on...

CVE-1999-0771

CVE-1999-0771 affects the web components of Compaq Management Agents and the Compaq Survey Utility , enabling a remote attacker to read arbitrary files via a .. (dot dot) path traversal in the web interface. The root cause is insufficient validation of file paths in the affected web components, r...

CVE-1999-0716

CVE-1999-0716 is a historical vulnerability described across multiple sources as a buffer overflow in Windows NT 4.0’s help file utility triggered by a malformed help file. The Red Hat advisory and CVE entries confirm the issue but do not provide concrete exploit details beyond the basic descript...

CVE-1999-0716

Buffer overflow in Windows NT 4.0 help file utility via a malformed help file...

CVE-1999-1444

genkey utility in Alibaba 2.0 generates RSA key pairs with an exponent of 1, which results in transactions that are sent in cleartext...

Linuxconf 1.1.6 r10 - Remote Buffer Overflow

// source: https://www.securityfocus.com/bid/2352/info Linuxconf is a Linux configuration utility from Solucorp. An attacker supplying excess data to the USERAGENT field in vulnerable versions of Linuxconf. This data can overflow the relevant buffer, creating a stack overflow and, properly...