Important: Red Hat Security Advisory: : Updated mount package available

Updated mount packages fixing a potential security problem are available. If any swap files were created during installation of Red Hat Linux 7.1 they were created during updates if the user requested it, they were world-readable, meaning every user could read data in the swap files, possibly...

iplanet calendar server 5.0p2 exposes Netscape Admin Server master password

at the time of writing, 5.0p2 is the currently available revision on iplanet's download site. the problem: the standard install of iPlanet Calendar server stores the NAS LDAP admin username and password in plaintext in the world readable file: -rw-r--r-- 1 icsuser icsgroup 37882 Feb 20 10:18...

CVE-2001-0300

oidldapd 2.1.1.1 in Oracle 8.1.7 records log files in a directory ldaplog that has world-writable permissions, which may allow local users to delete logs and/or overwrite other files via a symlink attack...

CVE-2001-0300

The CVE-2001-0300 issue pertains to the Oracle Internet Directory LDAP Daemon (oidldapd) version 2.1.1.1 included with Oracle 8i/8.1.7. The daemon writes logs to a directory (ldaplog) that has world‑writable permissions, enabling a local user to delete logs and, via a symlink attack, overwrite ot...

CVE-2001-0300: Undefined Security Weakness

oidldapd 2.1.1.1 in Oracle 8.1.7 records log files in a directory ldaplog that has world-writable permissions, which may allow local users to delete logs and/or overwrite other files via a symlink attack...

CVE-2001-0195

sash before 3.4-4 in Debian GNU/Linux does not properly clone /etc/shadow, which makes it world-readable and could allow local users to gain privileges via password cracking...

CVE-2001-0135

The default installation of Ultraboard 2000 2.11 creates the Skins, Database, and Backups directories with world-writeable permissions, which could allow local users to modify sensitive information or possibly insert and execute CGI programs...

Joe's Own Editor File Handling Error

WKIT SECURITY AB www.wkit.com TITLE: Joe's Own Editor File Handling Error ADVISORY ID: WSIR-01/02-02 REFERENCE: http://www.wkit.com/advisories CVE: GENERIC-MAP-NOMATCH CREDIT: Christer Цberg, Wkit Security AB CONTACT: [email protected] CLASS: File Handling Error OBJECT: joe1 exec VENDOR: Josef ...

Joe Text Editor 2.8 - '.joerc' Arbitrary Command Execution

source: https://www.securityfocus.com/bid/2437/info Joe is a text editor originally written by Joseph Allen. Joe offers a user-friendly interface, with key binding and configuration familiar to many users of Microsoft Word Processing tools. A problem in the sourcing of the .joerc file could lead ...

Joe Text Editor 2.8 - .joerc Arbitrary Command Execution

Joe Text Editor 2.8 - .joerc Arbitrary Command Execution source: https://www.securityfocus.com/bid/2437/info Joe is a text editor originally written by Joseph Allen. Joe offers a user-friendly interface, with key binding and configuration familiar to many users of Microsoft Word Processing tools....

CVE-2001-0040

APC UPS daemon, apcupsd, saves its process ID in a world-writable file, which allows local users to kill an arbitrary process by specifying the target process ID in the apcupsd.pid file...

CVE-2001-0135

CVE-2001-0135 affects Ultraboard 2000, version 2.11. The default install creates Skins, Database, and Backups directories with world-writable permissions, enabling a local user to modify sensitive information or potentially insert and execute CGI programs. The connected OpenVAS/Nessus entries ref...

CVE-2001-0135: Undefined Security Weakness

The default installation of Ultraboard 2000 2.11 creates the Skins, Database, and Backups directories with world-writeable permissions, which could allow local users to modify sensitive information or possibly insert and execute CGI programs...

CVE-2000-0936

Samba Web Administration Tool SWAT in Samba 2.0.7 installs the cgi.log logging file with world readable permissions, which allows local users to read sensitive information such as user names and passwords...

CVE-2000-0925

The CVE-2000-0925 entry concerns SmartWin CyberOffice Shopping Cart 2 (CyberShop). The available documents state that the default installation creates a _private directory with world-readable permissions, which allows remote attackers to obtain sensitive information. No further technical specific...

CVE-2000-1072

iCal 2.1 Patch 2 installs many files with world-writeable permissions, which allows local users to modify the iCal configuration and execute arbitrary commands by replacing the iplncal.sh program with a Trojan horse...

CVE-2000-0925

The default installation of SmartWin CyberOffice Shopping Cart 2 aka CyberShop installs the private directory with world readable permissions, which allows remote attackers to obtain sensitive information...

CVE-2000-1148: Undefined Security Weakness

The installation of VolanoChatPro chat server sets world-readable permissions for its configuration file and stores the server administrator passwords in plaintext, which allows local users to gain privileges on the server...

CVE-2000-1072: Undefined Security Weakness

iCal 2.1 Patch 2 installs many files with world-writeable permissions, which allows local users to modify the iCal configuration and execute arbitrary commands by replacing the iplncal.sh program with a Trojan horse...

CVE-2000-1148

The installation of VolanoChatPro chat server sets world-readable permissions for its configuration file and stores the server administrator passwords in plaintext, which allows local users to gain privileges on the server...