pcnfs.d contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is triggered during normal operation when file permissions are changed on a symbolic link to a restricted directory. The impact is that directories can become world writable.
A command execution flaw exists in rpc.ypupdated. The update daemon fails to validate data passed to a MAP UPDATE request. With a specially crafted request, a remote attacker can cause arbitrary code execution resulting in a loss of integrity.
Ultrix contains a flaw that may allow an attacker to gain access to unauthorized privileges. The issue is triggered when a race condition occurs in binmail when an inbox is saved with root privileges in a temporary file, allowing a local attacker to gain escalated root privileges.
Older AIX releases, and potentially other Unix flavors may contain a flaw related to user ID (UID) processing that allows for privilege escalation. In some cases, various daemons or services fail to properly check the bounds of UIDs resulting in an overflow. With a specially crafted UID, an attacker can assume root privileges regardless of the root UID mapping. For NFS servers, this may be abused to 'wrap' your UID around past 65535, so that the effective UID processed becomes '0' or 'root', resulting in full access to the exported file system.
FreeBSD contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is triggered when a malicious user executes a setuid program that utilizes the standard C library access() function. As access() will only verify that a user can access a given pathname, its use creates a race condition. This flaw may lead to a loss of integrity.
Retrospect Remote Control Panel has a flaw that potentially allows a remote attacker to initialize a system, download every file and de-initialize the system. The flaw is due to the installation of the software not fully configuring the server. Once installed, Remote will wait for the server to download a security code and serial number. If this is not done, it leaves the server open to any remote user who has a copy of the software to perform the same actions not taken by the administrator.
At least one version of ircII (2.2.9) located on the cs-pub.bu.edu FTP site were found to contain a backdoor. It is believed the code in ctcp.c allowed a CTCP JUPE or CTCP GROK command to execute arbitrary commands on the client host. This could allow an attacker to gain remote access to the host.
Smail contains a flaw that may allow a malicious user to access abitrary file. The issue is triggered when a local attacker links their .forward file to a privileged file on the system (such as /etc/shadow). Once linked, connecting to the SMTP port and issuing the 'debug' command along with a few other crafted commands will allow the user to display the contents of the privileged file.
The database information may change without any notice. Use of the information constitutes acceptance for use in an AS IS condition, and there are NO
warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the copyright
holder or distributor (OSVDB or OSF) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.