CVE-2006-1376

The installation of Debian GNU/Linux 3.1r1 from the network install CD creates /var/log/debian-installer/cdebconf with world writable permissions, which allows local users to cause a denial of service disk consumption...

DEBIAN-CVE-2006-1376

The installation of Debian GNU/Linux 3.1r1 from the network install CD creates /var/log/debian-installer/cdebconf with world writable permissions, which allows local users to cause a denial of service disk consumption...

CVE-2006-1376

The installation of Debian GNU/Linux 3.1r1 from the network install CD creates /var/log/debian-installer/cdebconf with world writable permissions, which allows local users to cause a denial of service disk consumption...

Code injection

The Ubuntu 5.10 installer does not properly clear passwords from the installer log file questions.dat, and leaves the log file with world-readable permissions, which allows local users to gain privileges...

CVE-2006-1183

The Ubuntu 5.10 installer does not properly clear passwords from the installer log file questions.dat, and leaves the log file with world-readable permissions, which allows local users to gain privileges...

CVE-2006-1183

Summary (CVE-2006-1183) : The Ubuntu 5.10 installer leaves passwords in the installer log (questions.dat) and creates world-readable logs, enabling local privilege escalation. Affected component: the Ubuntu 5.10 installer’s logging mechanism. Root cause: passwords are not cleared from logs and lo...

CVE-2006-1183

The Ubuntu 5.10 installer does not properly clear passwords from the installer log file questions.dat, and leaves the log file with world-readable permissions, which allows local users to gain privileges...

CVE-2006-1183

The Ubuntu 5.10 installer does not properly clear passwords from the installer log file questions.dat, and leaves the log file with world-readable permissions, which allows local users to gain privileges...

[USN-262-1] Ubuntu 5.10 installer password disclosure

=========================================================== Ubuntu Security Notice USN-262-1 March 12, 2006 Ubuntu 5.10 installer vulnerability https://launchpad.net/bugs/34606 =========================================================== A security issue affects the following Ubuntu releases: Ubun...

CVE-2005-2713

CVE-2005-2713 concerns local privilege escalation in Mac OS X. The iDefense advisory details two related issues in the /usr/bin/passwd binary on affected builds (Mac OS X 10.3.9 and 10.4.5; server variants also mentioned): first, passwd accepts a password database option and does not verify write...

Code injection

IBM Tivoli Micromuse Netcool/NeuSecure 3.0.236 has world-readable permissions for 1 /etc/neusecure.conf, 2 /opt/NeuSecure/etc/cms-3.0.236.buildconf, and 3 /opt/NeuSecure/bin/nsarchiver.log, which allows local users to read sensitive information such as passwords. NOTE: IBM has privately confirmed...

CVE-2006-0837

Affected product: IBM Tivoli Netcool/NeuSecure 3.0.236. Issue: world-readable permissions on (1) /etc/neusecure.conf, (2) /opt/NeuSecure/etc/cms-3.0.236.buildconf, and (3) /opt/NeuSecure/bin/ns_archiver.log, enabling local users to read sensitive information such as passwords. Impact: local infor...

CVE-2006-0837

IBM Tivoli Micromuse Netcool/NeuSecure 3.0.236 has world-readable permissions for 1 /etc/neusecure.conf, 2 /opt/NeuSecure/etc/cms-3.0.236.buildconf, and 3 /opt/NeuSecure/bin/nsarchiver.log, which allows local users to read sensitive information such as passwords. NOTE: IBM has privately confirmed...

CVE-2006-0623

QNX Neutrino RTOS 6.3.0 ships /etc/rc.d/rc.local with world-writable permissions, which allows local users to modify the file and execute arbitrary code at system startup...

Code injection

QNX Neutrino RTOS 6.3.0 ships /etc/rc.d/rc.local with world-writable permissions, which allows local users to modify the file and execute arbitrary code at system startup...

CVE-2006-0623

CVE-2006-0623 is associated with QNX Neutrino RTOS 6.3.0. The vulnerability arises because /etc/rc.d/rc.local is shipped with world-writable permissions, allowing local users to modify the file and thereby execute arbitrary code at system startup. The connected records confirm the affected softwa...

CVE-2006-0623

QNX Neutrino RTOS 6.3.0 ships /etc/rc.d/rc.local with world-writable permissions, which allows local users to modify the file and execute arbitrary code at system startup...

CVE-2005-4683

PADL MigrationTools 46, when a failure occurs, stores contents of /etc/shadow in a world-readable /tmp/nis.$$.ldif file, and possibly other sensitive information in other temporary files, which are not properly managed by 1 migrateallonline.sh, 2 migratealloffline.sh, 3 migrateallnetinfoonline.sh...

Ubuntu 4.10 : cpio vulnerability (USN-75-1)

Recently it was discovered that cpio created world-writeable files when used in -o/--create mode with giving an output file with -O. This allowed any user to modify the created cpio archives. Now cpio respects the current umask setting of the user. Note: This vulnerability has already been fixed ...

Ubuntu 4.10 / 5.04 / 5.10 : fetchmail vulnerability (USN-215-1)

Thomas Wolff and Miloslav Trmac discovered a race condition in the fetchmailconf program. The output configuration file was initially created with insecure permissions, and secure permissions were applied after writing the configuration into the file. During this time, the file was world readable...