2.4.x/Slackware Init script vulnerability

I posted this to the linux kernel mailing last Friday, July 13th 2001: Submitted by : Josh [email protected], lockdown [email protected] on July 16th, 2001 Vulnerability : /lib/modules/2.4.5/modules.dep Tested On : Slackware 8.0. 2.4.5 Local : Yes Remote : No Temporary Fix : umask 022 at...

FreeBSD-SA-01:47.xinetd

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:47 Security Advisory FreeBSD, Inc. Topic: xinetd contains multiple vulnerabilities Category: ports Module: xinetd Announced: 2001-07-10 Credits: [email protected] Affects...

CVE-2001-0409

vim aka gvim allows local users to modify files being edited by other users via a symlink attack on the backup and swap files, when the victim is editing the file in a world writable directory...

[PkC] Advisory #005: Default Slackware 7.1 installation /etc/shells perms bug

/ pkc005.txt / -= SECURITY ADVISORY 005 =- | www.pkcrew.org / | / | | | | | / | | | | | / | | | | / | | / / | | | / | | | | | PkC | | | / | | | | | | || || || / Packet Knights Crew -= SECURITY ADVISORY 005 =- - Vulnerable program: Linux Slackware 7.1 default installation - Tested on: i386 from...

SSH allows deletion of other users files...

Sorry, I forgot some relevant information. With regards to previous post: Tested on:- Red Hat Linux release 7.0 Guinness zen-parse@clarity zen-parse$ rpm -qf /usr/sbin/sshd openssh-server-2.5.2p2-1.7.2 zen-parse@clarity zen-parse$ ssh -V OpenSSH2.5.2p2, SSH protocols 1.5/2.0, OpenSSL 0x0090581f T...

CVE-2001-0300

oidldapd 2.1.1.1 in Oracle 8.1.7 records log files in a directory ldaplog that has world-writable permissions, which may allow local users to delete logs and/or overwrite other files via a symlink attack...

CVE-2001-0300

oidldapd 2.1.1.1 in Oracle 8.1.7 records log files in a directory ldaplog that has world-writable permissions, which may allow local users to delete logs and/or overwrite other files via a symlink attack...

CVE-2001-0300

The CVE-2001-0300 issue pertains to the Oracle Internet Directory LDAP Daemon (oidldapd) version 2.1.1.1 included with Oracle 8i/8.1.7. The daemon writes logs to a directory (ldaplog) that has world‑writable permissions, enabling a local user to delete logs and, via a symlink attack, overwrite ot...

CVE-2001-0300: Undefined Security Weakness

oidldapd 2.1.1.1 in Oracle 8.1.7 records log files in a directory ldaplog that has world-writable permissions, which may allow local users to delete logs and/or overwrite other files via a symlink attack...

Joe's Own Editor File Handling Error

WKIT SECURITY AB www.wkit.com TITLE: Joe's Own Editor File Handling Error ADVISORY ID: WSIR-01/02-02 REFERENCE: http://www.wkit.com/advisories CVE: GENERIC-MAP-NOMATCH CREDIT: Christer Цberg, Wkit Security AB CONTACT: [email protected] CLASS: File Handling Error OBJECT: joe1 exec VENDOR: Josef ...

Joe Text Editor 2.8 - '.joerc' Arbitrary Command Execution

source: https://www.securityfocus.com/bid/2437/info Joe is a text editor originally written by Joseph Allen. Joe offers a user-friendly interface, with key binding and configuration familiar to many users of Microsoft Word Processing tools. A problem in the sourcing of the .joerc file could lead ...

Joe Text Editor 2.8 - .joerc Arbitrary Command Execution

Joe Text Editor 2.8 - .joerc Arbitrary Command Execution source: https://www.securityfocus.com/bid/2437/info Joe is a text editor originally written by Joseph Allen. Joe offers a user-friendly interface, with key binding and configuration familiar to many users of Microsoft Word Processing tools....

CVE-2001-0040

APC UPS daemon, apcupsd, saves its process ID in a world-writable file, which allows local users to kill an arbitrary process by specifying the target process ID in the apcupsd.pid file...

OpenBSD ftpd 2.62.7 - Remote Overflow

OpenBSD ftpd 2.62.7 - Remote Overflow / h0h0h0 0-day k0d3z Exploit by Scrippie, help by dvorak and jimjones greets to sk8 Not fully developt exploit but it works most of the time ; Things to add: - automatic writeable directory finding - syn-scan option to do mass-scanning - worm capabilities?...

Проблема в apcupsd

Создается открытый на запись файл, в который записывается pid процесса. Это позволяет подменить pid, в результате чего при попытке остановить демон будет убит другой процесс...

StarOffice 5.2 Temporary Dir Vulnerability

Hi, A while back I noticed that StarOffice 5.2 running under Linux and Solaris creates a temporary directory under /tmp with the name "soffice.tmp" with permissions 0777. I figured there had to be some security issue here so I had a further look and noticed that there were files created under her...

CVE-2000-0714

umb-scheme 3.2-11 for Red Hat Linux is installed with world-writeable files...

CVE-2000-0515

The snmpd.conf configuration file for the SNMP daemon snmpd in HP-UX 11.0 is world writable, which allows local users to modify SNMP configuration or gain privileges...

CVE-2000-0494

Veritas Volume Manager creates a world writable .serverpids file, which allows local users to add arbitrary commands into the file, which is then executed by the vmsaserver script...

CVE-2000-0515: Undefined Security Weakness

The snmpd.conf configuration file for the SNMP daemon snmpd in HP-UX 11.0 is world writable, which allows local users to modify SNMP configuration or gain privileges...