VMware Workstation 4.0: Possible privilege escalation on the host via symlink manipulation

It is possible for a user to gain an esclation in privileges on a system running VMware Workstation 4.0 for Linux systems by symlink manipulation in a world-writable directory such as /tmp. Affected systems: VMware Workstation 4.0 for Linux systems Dates: This was reported to VMware on 2003-06-17...

Xinet K-Talk Appletalk(tm) xkas vulnerability on IRIX

-----BEGIN PGP SIGNED MESSAGE----- SGI Security Advisory Title: Xinet K-Talk Appletalktm xkas vulnerability Number: 20020604-01-I Date: June 10, 2002 Reference: CAN-2002-0213 - ----------------------- - --- Issue Specifics --- - ----------------------- It's been reported that the Appletalktm...

Xinet K-Talk Appletalk(tm) xkas vulnerability on IRIX

-----BEGIN PGP SIGNED MESSAGE----- SGI Security Advisory Title: Xinet K-Talk Appletalktm xkas vulnerability Number: 20020604-01-I Date: June 10, 2002 Reference: CAN-2002-0213 - ----------------------- - --- Issue Specifics --- - ----------------------- It's been reported that the Appletalktm...

CVE-2002-0105

CDE dtlogin in Caldera UnixWare 7.1.0, and possibly other operating systems, allows local users to gain privileges via a symlink attack on /var/dt/Xerrors since /var/dt is world-writable...

CVE-2002-0105

CDE dtlogin in Caldera UnixWare 7.1.0, and possibly other operating systems, allows local users to gain privileges via a symlink attack on /var/dt/Xerrors since /var/dt is world-writable...

Слабые разрешения в xkas под Irix (weak permissions)

Директория /var/adm/appletalk/icons открыта на запись, что позволяет создать символьный линк в директории, который будет исопльзован при копировании файла...

shadow-utils useradd creates temporary files insecurely

Overview Shadow-utils is an encryption and account management package freely distributed for many Linux implementations. The useradd program in this package creates insecure temporary files with predictable names in a write-protected directory. If this directory is changed to be writable, an...

mgetty creates temporary files insecurely

Overview mgetty, a replacement for getty designed to support modem and fax use, creates files of a predictable name in a world-writable directory without checking for the prior existence or ownership of the file. Using a symbolic link attack, an intruder might cause the overwrite of arbitrary fil...

CVE-2001-0409

The CVE-2001-0409 vulnerability affects vim (aka gvim). It allows a local attacker to modify files being edited by other users via a symlink attack on swap/backup files when the victim edits a file in a world-writable directory. The underlying issue is a symlink race during edit sessions, enablin...

CVE-2001-0409

vim aka gvim allows local users to modify files being edited by other users via a symlink attack on the backup and swap files, when the victim is editing the file in a world writable directory...

CVE-2001-0409

vim aka gvim allows local users to modify files being edited by other users via a symlink attack on the backup and swap files, when the victim is editing the file in a world writable directory...

CVE-2001-0300

The CVE-2001-0300 issue pertains to the Oracle Internet Directory LDAP Daemon (oidldapd) version 2.1.1.1 included with Oracle 8i/8.1.7. The daemon writes logs to a directory (ldaplog) that has world‑writable permissions, enabling a local user to delete logs and, via a symlink attack, overwrite ot...

Joe Text Editor 2.8 - .joerc Arbitrary Command Execution

Joe Text Editor 2.8 - .joerc Arbitrary Command Execution source: https://www.securityfocus.com/bid/2437/info Joe is a text editor originally written by Joseph Allen. Joe offers a user-friendly interface, with key binding and configuration familiar to many users of Microsoft Word Processing tools....

Joe's Own Editor File Handling Error

WKIT SECURITY AB www.wkit.com TITLE: Joe's Own Editor File Handling Error ADVISORY ID: WSIR-01/02-02 REFERENCE: http://www.wkit.com/advisories CVE: GENERIC-MAP-NOMATCH CREDIT: Christer Цberg, Wkit Security AB CONTACT: [email protected] CLASS: File Handling Error OBJECT: joe1 exec VENDOR: Josef ...

Joe Text Editor 2.8 - '.joerc' Arbitrary Command Execution

source: https://www.securityfocus.com/bid/2437/info Joe is a text editor originally written by Joseph Allen. Joe offers a user-friendly interface, with key binding and configuration familiar to many users of Microsoft Word Processing tools. A problem in the sourcing of the .joerc file could lead ...

OpenBSD ftpd 2.62.7 - Remote Overflow

OpenBSD ftpd 2.62.7 - Remote Overflow / h0h0h0 0-day k0d3z Exploit by Scrippie, help by dvorak and jimjones greets to sk8 Not fully developt exploit but it works most of the time ; Things to add: - automatic writeable directory finding - syn-scan option to do mass-scanning - worm capabilities?...

FreeBSD-SA-00:45.esound

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:45 Security Advisory FreeBSD, Inc. Topic: esound port allows file permissions to be modified Category: ports Module: esound Announced: 2000-08-31 Credits: Brian Feldman...

GNOME esound 0.2.19 - Unix Domain Socket Race Condition

source: https://www.securityfocus.com/bid/1659/info EsounD, part of the GNOME desktop environment, is a server process allowing several applications to share the same sound hardware. Versions of esound up to and including 0.2.19 create a world-writable directory /tmp/.esd which is also used to...

Advisory: mgetty local compromise

Author : Stan Bubrouski Date : August 26, 2000 Package : mgetty Versions affected : 1.1.22, 1.1.21 and prior at least back to 1994 Severity : faxrunqd follows symbolic links when creating certain files. The default location for the files is /var/spool/fax/outgoing, which is a world-writable...

CVS 1.10.7 - Local Denial of Service

source: https://www.securityfocus.com/bid/1136/info CVS stands for Concurrent Versions Software and is an open-source package designed to allow multiple developers to work concurrently on a single source tree, recording changes and controlling versions. It is possible to cause a denial of service...