|
Lines 34-39
Link Here
|
| 34 |
|
34 |
|
| 35 |
--> |
35 |
--> |
| 36 |
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> |
36 |
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> |
|
|
37 |
<vuln vid="b5a49db7-72fc-11da-9827-021106004fd6"> |
| 38 |
<topic>scponly -- local privilege escalation exploits</topic> |
| 39 |
<affects> |
| 40 |
<package> |
| 41 |
<name>scponly</name> |
| 42 |
<range><lt>4.2</lt></range> |
| 43 |
</package> |
| 44 |
</affects> |
| 45 |
<description> |
| 46 |
<body xmlns="http://www.w3.org/1999/xhtml"> |
| 47 |
<p>Max Vozeler reports:</p> |
| 48 |
<blockquote cite="https://lists.ccs.neu.edu/pipermail/scponly/2005-December/001027.html"> |
| 49 |
<p>If ALL the following conditions are true, administrators using |
| 50 |
scponly-4.1 or older may be at risk of a local privilege |
| 51 |
escalation exploit:</p> |
| 52 |
<ul> |
| 53 |
<li>the chrooted setuid scponlyc binary is installed</li> |
| 54 |
<li>regular non-scponly users have interactive shell access |
| 55 |
to the box</li> |
| 56 |
<li>a user executable dynamically linked setuid binary |
| 57 |
(such as ping) exists on the same file system mount |
| 58 |
as the user's home directory</li> |
| 59 |
<li>the operating system supports an LD_PRELOAD style |
| 60 |
mechanism to overload dynamic library loading</li> |
| 61 |
</ul> |
| 62 |
</blockquote> |
| 63 |
<p>Pekka Pessi also reports:</p> |
| 64 |
<blockquote cite="https://lists.ccs.neu.edu/pipermail/scponly/2005-December/001027.html"> |
| 65 |
<p>If ANY the following conditions are true, administrators |
| 66 |
using scponly-4.1 or older may be at risk of a local privilege |
| 67 |
escalation exploit:</p> |
| 68 |
<ul> |
| 69 |
<li>scp compatibility is enabled</li> |
| 70 |
<li>rsync compatibility is enabled</li> |
| 71 |
</ul> |
| 72 |
</blockquote> |
| 73 |
</body> |
| 74 |
</description> |
| 75 |
<references> |
| 76 |
<url>https://lists.ccs.neu.edu/pipermail/scponly/2005-December/001027.html</url> |
| 77 |
<url>http://sublimation.org/scponly/#relnotes</url> |
| 78 |
</references> |
| 79 |
<dates> |
| 80 |
<discovery>2005-12-21</discovery> |
| 81 |
<entry>2005-12-22</entry> |
| 82 |
</dates> |
| 83 |
</vuln> |
| 84 |
|
| 37 |
<vuln vid="f7eb0b23-7099-11da-a15c-0060084a00e5"> |
85 |
<vuln vid="f7eb0b23-7099-11da-a15c-0060084a00e5"> |
| 38 |
<topic>fetchmail -- null pointer dereference in multidrop mode with |
86 |
<topic>fetchmail -- null pointer dereference in multidrop mode with |
| 39 |
headerless email</topic> |
87 |
headerless email</topic> |