realpath(3) function contains off-by-one buffer overflow

Overview A function originally derived from 4.4BSD, realpath3, contains a vulnerability that may permit a malicious user to gain root access to the server. This function was derived from the FreeBSD 3.x tree. Other applications and operating systems that use or were derived from this code base ma...

Portmon file arbitrary read/write access vulnerability

Package: Portmon Auth: http://www.aboleo.net/ Versions: 1.7 prior ? Vulnerability: File arbitrary read/write access vulnerability Portmon is a network service monitoring daemon http://www.aboleo.net/software/portmon/. "In order to use ping support, Portmon must run as root or be installed setuid...

Security issues in D-Link DSL-300/DSL-300G+ Broadband Modem/Router

Arhont Ltd - Information Security Company Arhont Advisory by: Andrei Mikhailovsky www.arhont.com Advisory: D-Link DSL Broadband Modem/Router Router Model Name: D-Link DSL-300G/DSL-300G+ Model Specific: Other models might be vulnerable as well Manufacturer site: http://www.dlink.com Manufacturer...

SNMP security issues in D-Link DSL Broadband Modem/Router

Arhont Ltd - Information Security Company Arhont Advisory by: Andrei Mikhailovsky www.arhont.com Advisory: D-Link DSL Broadband Modem/Router Router Model Name: D-Link DSL-500 Model Specific: Other models might be vulnerable as well Manufacturer site: http://www.dlink.com Manufacturer contact UK:...

FreeBSD-SA-03:01.cvs

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-03:01.cvs Security Advisory The FreeBSD Project Topic: remotely exploitable vulnerability in cvs server Category: contrib Module: contribcvs Announced: 2003-02-04...

Default SNMP community in Surecom Broadband Router

Arhont Ltd. - Information Security Arhont Advisory by: Andrei Mikhailovsky www.arhont.com Advisory: Surecom Broadband Router Router Model Name: EP-4501 Model Specific: Other models might be vulnerable Manufacturer site: http://www.surecom.com.tw Manufacturer contact: [email protected] Contac...

HP ProCurve Switch 4000M - SNMP Write Denial of Service

source: https://www.securityfocus.com/bid/5336/info An issue has been reported with the HP ProCurve 4000M Switch. An attacker with SNMP write access to the device may write to the SNMP variable .iso.3.6.1.4.1.11.2.36.1.1.2.1.0. If more than 85 characters are written to this variable, the device...

HP ProCurve Switch 4000M - SNMP Write Denial of Service

HP ProCurve Switch 4000M - SNMP Write Denial of Service source: https://www.securityfocus.com/bid/5336/info An issue has been reported with the HP ProCurve 4000M Switch. An attacker with SNMP write access to the device may write to the SNMP variable .iso.3.6.1.4.1.11.2.36.1.1.2.1.0. If more than ...

File Locking Local Denial of Service; Impact on sendmail

-----BEGIN PGP SIGNED MESSAGE----- File Locking Local Denial of Service Impact on sendmail Reported by lumpy [email protected] Introduction ============ Any application which uses either flock or fcntl style locking or other APIs that use one of these locking methods such as open with OEXLOCK and...

Weak permissions in Etnus TotalView 5

write access to files and directories owned by root...

CVE-2001-0203

Watchguard Firebox II firewall allows users with read-only access to gain read-write access, and administrative privileges, by accessing a file that contains hashed passphrases, and using the hashes during authentication...

Microsoft IIS 4.05.0 - SSI Buffer Overrun Privilege Escalation

Microsoft IIS 4.05.0 - SSI Buffer Overrun Privilege Escalation // source: https://www.securityfocus.com/bid/3190/info A vulnerability exists in Microsoft IIS 4.0 and 5.0 that could allow a user with permission to write content to the IIS server to run any code in Local System context. / jim.c - I...

RedHat Linux 6.1 i386 - Tmpwatch Recursive Write Denial of Service

source: https://www.securityfocus.com/bid/1664/info Any user with write access to /tmp or /var/tmp, can induce tmpwatch to cause Red Hat and others runnng tmpwatch from cron to stop responding, and possibly require a hard reboot. This is accomplished by creating a directory tree many ie. 6000 nod...

Дырка в FlagShip

несколько исполняемых файлов открыто на запись...

Дырка в cvsweb

Атакующий, имеющий права на запись файлов может выполнить приложения...

cvsweb: remote shell for cvs committers

Cvsweb 1.80 contains a hole that provides attackers who have write access to a cvs repository with shell access. Thus, attackers who have write access to a cvs repository but not shell access can obtain a shell. In addition, anyone with write access to a cvs repository that is viewable with cvswe...

CVE-2000-0441

Vulnerability in AIX 3.2.x and 4.x allows local users to gain write access to files on locally or remotely mounted AIX filesystems...

CVSWeb Developer CVSWeb 1.80 - Insecure Perl 'open' Code Execution

source: https://www.securityfocus.com/bid/1469/info Cvsweb 1.80 makes an insecure call to the perl OPEN function, providing attackers with write access to a cvs repository the ability to execute arbitrary commands on the host machine. The code that is being exploited here is the following: open$f...

Filesystem vulnerability in AIX

---EXTERNAL RELEASE---EXTERNAL RELEASE---EXTERNAL RELEASE---EXTERNAL RELEASE--- IBM EMERGENCY RESPONSE SERVICE OUTSIDE ADVISORY REDISTRIBUTION 19 May 2000 14:30 GMT Number: ERS-OAR-E01-2000:087.1 =============================================================================== The ERS Outside...

Pacific Software Carello 1.2.1 - File Duplication Source Disclosure

Pacific Software Carello 1.2.1 - File Duplication Source Disclosure source: https://www.securityfocus.com/bid/1245/info A remote user can gain read and write access on a target machine running Carello shopping cart software. First, a user may create a duplicate of a known file in a known director...