rpcbind/fsr_efs/mv/errhook/uux vulnerabilities update

-----BEGIN PGP SIGNED MESSAGE----- SGI Security Advisory Title: rpcbind/fsrefs/mv/errhook/uux vulnerabilities update Number: 20020903-02-P Date: October 14, 2002 - -------------- - --- Update --- - -------------- The patches in the original advisory are incompatible with R4000-class hardware...

Important: Red Hat Security Advisory: tetex security update

Updated packages for dvips are available which fix a vulnerability allowing print users to execute arbitrary commands. Updated 13 Aug 2003 Added tetex-doc package that was originally left out of the errata. The dvips utility converts DVI format into PostScriptTM, and is used in Red Hat Linux as a...

CVE-2002-0529

HP Photosmart printer driver for Mac OS X installs the hpimagingconnectivity program and the hpimagingconnectivity.app directory with world-writable permissions, which allows local users to gain privileges of other Photosmart users by replacing hpimagingconnectivity with a Trojan horse...

CVE-2002-0805

Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, 1 creates new directories with world-writable permissions, and 2 creates the params file with world-writable permissions, which allows local users to modify the files and execute code...

CVE-2002-0849

Linux-iSCSI iSCSI implementation installs the iscsi.conf file with world-readable permissions on some operating systems, including Red Hat Linux Limbo Beta 1, which could allow local users to gain privileges by reading the cleartext CHAP password...

iDEFENSE Security Advisory: iSCSI Default Configuration File Settings

iDEFENSE Security Advisory 08.08.2002 iSCSI Default Configuration File Settings DESCRIPTION iSCSI is a popular new protocol that allows the SCSI protocol to be used over traditional IP networks. This allows for SAN like storage arrays without requiring new network infrastructure. iSCSI’s primary...

Mac OS X Finder creates world-readable ".FBCIndex" file thereby disclosing sensitive information

Overview Mac OS X's Find-By-Content indexing may store file data where it can be served to remote users by Apache. Description The Find-By-Content feature of Mac OS X generates indexing data from the contents of files in each directory. It then stores the indexing data for each directory in a...

CVE-2002-0565

Oracle 9iAS 1.0.2.x compiles JSP files in the pages directory with world-readable permissions under the web root, which allows remote attackers to obtain sensitive information derived from the JSP code, including usernames and passwords, via a direct HTTP request to pages...

Sun Cobalt RaQ 4.0 - Predictable Temporary Filename Symbolic Link Attack

Sun Cobalt RaQ 4.0 - Predictable Temporary Filename Symbolic Link Attack source: https://www.securityfocus.com/bid/5529/info A vulnerability has been reported in Cobalt RaQ that may allow attackers to obtain elevated privileges. The vulnerability exists in the /usr/lib/authenticate utility which ...

CVE-2001-1175

vipw in the util-linux package before 2.10 causes /etc/shadow to be world-readable in some cases, which would make it easier for local users to perform brute force password guessing...

CVE-2001-1079

CVE-2001-1079 concerns the creation of keyfile directories with world-writable permissions in PSSP 3.2 with DCE 3.1 authentication on AIX. The underlying issue is that a local user can exploit these permissions to delete key files, leading to a denial of service. The description specifies the aff...

CVE-2001-1175

CVE-2001-1175 : In vipw from the util-linux package, before version 2.10, editing /etc/shadow could leave the file world-readable in some cases, enabling local users to more easily perform brute-force password guessing. Supported details in connected docs show Red Hat advisories (RHSA-2001:95, 13...

CVE-2001-1175: Undefined Security Weakness

vipw in the util-linux package before 2.10 causes /etc/shadow to be world-readable in some cases, which would make it easier for local users to perform brute force password guessing...

CVE-2001-1079: Undefined Security Weakness

createkeyfiles in PSSP 3.2 with DCE 3.1 authentication on AIX creates keyfile directories with world-writable permissions, which could allow a local user to delete key files and cause a denial of service...

CVE-2002-0265: Undefined Security Weakness

Sawmill for Solaris 6.2.14 and earlier creates the AdminPassword file with world-writable permissions, which allows local users to gain privileges by modifying the file...

nCipher Advisory #3: MSCAPI keys erroneously module-protected - update

nCipher Security Advisory No. 3 | Windows 2000 keys unexpectedly only module-protected | ==================================================== | | UPDATED - VERSION 2 | Changes are marked with |' at the right. | | | SUMMARY ======= In certain circumstances, the nCipher MSCAPI CSP Install Wizard...

Xinet K-Talk Appletalk(tm) xkas vulnerability on IRIX

-----BEGIN PGP SIGNED MESSAGE----- SGI Security Advisory Title: Xinet K-Talk Appletalktm xkas vulnerability Number: 20020604-01-I Date: June 10, 2002 Reference: CAN-2002-0213 - ----------------------- - --- Issue Specifics --- - ----------------------- It's been reported that the Appletalktm...

Xinet K-Talk Appletalk(tm) xkas vulnerability on IRIX

-----BEGIN PGP SIGNED MESSAGE----- SGI Security Advisory Title: Xinet K-Talk Appletalktm xkas vulnerability Number: 20020604-01-I Date: June 10, 2002 Reference: CAN-2002-0213 - ----------------------- - --- Issue Specifics --- - ----------------------- It's been reported that the Appletalktm...

CVE-2002-0529

HP Photosmart printer driver for Mac OS X installs the hpimagingconnectivity program and the hpimagingconnectivity.app directory with world-writable permissions, which allows local users to gain privileges of other Photosmart users by replacing hpimagingconnectivity with a Trojan horse...

CVE-2002-0565

The CVE-2002-0565 incident concerns Oracle 9iAS 1.0.2.x, where JSP files compiled under the web root in the _pages directory are world-readable. This enables remote attackers to read JSP source and derive sensitive information (e.g., usernames and passwords) via a direct HTTP request to _pages. T...