CVSS: 4.9EPSS: 0%CPEs: 3EXPL: 0CVE-2014-9278 – openssh: ~/.k5users unexpectedly grants remote login
https://notcve.org/view.php?id=CVE-2014-9278
The OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7 and when running in a Kerberos environment, allows remote authenticated users to log in as another user when they are listed in the .k5users file of that user, which might bypass intended authentication requirements that would force a local login. El servidor OpenSSH, utilizado en Fedora y Red Hat Enterprise Linux 7 y cuando funciona en un entorno Kerberos, permite a usuarios remotos autenticados iniciar sesión como otro usuario cuando están listados en el fichero .k5users de ese usuario, lo que podría evadir los requisitos de autenticación que forzaría un inicio de sesión local. It was found that when OpenSSH was used in a Kerberos environment, remote authenticated users were allowed to log in as a different user if they were listed in the ~/.k5users file of that user, potentially bypassing intended authentication restrictions. • http://rhn.redhat.com/errata/RHSA-2015-0425.html http://thread.gmane.org/gmane.comp.encryption.kerberos.general/15855 http://www.openwall.com/lists/oss-security/2014/12/02/3 http://www.openwall.com/lists/oss-security/2014/12/04/17 http://www.securityfocus.com/bid/71420 https://bugzilla.mindrot.org/show_bug.cgi?id=1867 https://bugzilla.redhat.com/show_bug.cgi?id=1169843 https://exchange.xforce.ibmcloud.com/vulnerabilities/99090 https://access.redhat.com/security/cve/CVE • CWE-287: Improper Authentication •
CVSS: 6.9EPSS: 0%CPEs: 270EXPL: 0CVE-2011-1011 – policycoreutils: insecure temporary directory handling in seunshare
https://notcve.org/view.php?id=CVE-2011-1011
The seunshare_mount function in sandbox/seunshare.c in seunshare in certain Red Hat packages of policycoreutils 2.0.83 and earlier in Red Hat Enterprise Linux (RHEL) 6 and earlier, and Fedora 14 and earlier, mounts a new directory on top of /tmp without assigning root ownership and the sticky bit to this new directory, which allows local users to replace or delete arbitrary /tmp files, and consequently cause a denial of service or possibly gain privileges, by running a setuid application that relies on /tmp, as demonstrated by the ksu application. La función seunshare_mount en sandbox/seunshare.c en seunshare en ciertos paquetes de Red Hat de policycoreutils v2.0.83 y anteriores de Red Hat Enterprise Linux (RHEL) v6 y anteriores, y Fedora v14 y anteriores, monta un nuevo directorio en la parte superior de /tmp sin asignar la pertenencia de root y el bit sticky a este nuevo directorio, lo que permite a usuarios locales reemplazar o eliminar de archivos /tmp de su elección, y por lo tanto provocar una denegación de servicio o ganar privilegios en su caso, mediante la ejecución de una aplicación setuid que se basa en /tmp, como demostrado por la aplicación de KSU. • http://archives.neohapsis.com/archives/fulldisclosure/2011-02/0585.html http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056227.html http://openwall.com/lists/oss-security/2011/02/23/1 http://openwall.com/lists/oss-security/2011/02/23/2 http://pkgs.fedoraproject.org/gitweb/?p=policycoreutils.git%3Ba=blob%3Bf=policycoreutils-rhat.patch%3Bh=d4db5bc06027de23d12a4b3f18fa6f9b1517df27%3Bhb=HEAD#l2197 http://secunia.com/advisories/43415 http://secunia.com/advisories/43844 http://secunia&# • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.8EPSS: 5%CPEs: 4EXPL: 1CVE-2008-2575
https://notcve.org/view.php?id=CVE-2008-2575
cbrPager before 0.9.17 allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a (1) ZIP (aka .cbz) or (2) RAR (aka .cbr) archive filename. cbrPager anteriores a 0.9.17, permite a atacantes remotos asistidos por el usuario ejecutar comandos de su elección a través de metacaracteres de consola en un archivo con nombre de fichero (1) ZIP (aka .cbz) o (2) RAR (aka .cbr). • http://cvs.fedoraproject.org/viewcvs/rpms/cbrpager/devel/cbrpager-0.9.16-filen-shell-escaping.patch?rev=1.2 http://secunia.com/advisories/30417 http://secunia.com/advisories/30438 http://secunia.com/advisories/30701 http://security.gentoo.org/glsa/glsa-200806-05.xml http://sourceforge.net/forum/forum.php?forum_id=827120 http://sourceforge.net/project/shownotes.php?release_id=601538&group_id=119647 http://www.jcoppens.com/soft/cbrpager/log.en.php http://www.vupen.com/english&#x • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.1EPSS: 5%CPEs: 6EXPL: 5CVE-2007-5962 – vsftpd 2.0.5 - 'CWD' (Authenticated) Remote Memory Consumption
https://notcve.org/view.php?id=CVE-2007-5962
Memory leak in a certain Red Hat patch, applied to vsftpd 2.0.5 on Red Hat Enterprise Linux (RHEL) 5 and Fedora 6 through 8, and on Foresight Linux and rPath appliances, allows remote attackers to cause a denial of service (memory consumption) via a large number of CWD commands, as demonstrated by an attack on a daemon with the deny_file configuration option. Filtrado de memoria en cierto parche de Red Hat, aplicado a vsftpd 2.0.5 vsftpd 2.0.5 sobre Red Hat Enterprise Linux (RHEL) 5, Fedora 6 a la 8, Foresight Linux y aplicaciones rPath, permite a atacantes remotos provocar una denegación de servicio (Consumo de memoria) a través una un gran número de comandos CWD, como se ha demostrado mediante un ataque al demonio con la opción de configuración deny_file. • https://www.exploit-db.com/exploits/5814 https://www.exploit-db.com/exploits/31818 https://www.exploit-db.com/exploits/31819 https://github.com/antogit-sys/CVE-2007-5962 http://secunia.com/advisories/30341 http://secunia.com/advisories/30354 http://securitytracker.com/id?1020079 http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0185 http://www.openwall.com/lists/oss-security/2008/05/21/10 http://www.openwall.com/lists/oss-security/2008/05/21/12 http://www&# • CWE-399: Resource Management Errors CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 4.9EPSS: 0%CPEs: 3EXPL: 0CVE-2008-1796
https://notcve.org/view.php?id=CVE-2008-1796
Comix 3.6.4 creates temporary directories with predictable names, which allows local users to cause an unspecified denial of service. Comix 3.6.4 crea directorios temporales con nombres previsibles, lo cual permite a usuarios locales provocar una denegación de servicio no especificada. • http://secunia.com/advisories/29956 http://security.gentoo.org/glsa/glsa-200804-29.xml https://exchange.xforce.ibmcloud.com/vulnerabilities/41854 https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00171.html https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00183.html •