SuSE Essential and Critical Security Patch Updates - Page 1146

SuSE: xf86-3.3.3-5 Critical: Directory Permission Exploit

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

XFree86 creates a directory in /tmp with the name .X11-unix for the X sockets and sets the directory to mode 1777. If an attacker creates a symlink with that filename and points it to another directory (e.g. /root), the permissions of the target directory is set to 1777.

LinuxSecurity.com Team
Dec 07, 1999

SuSE: IP Spoofing Threat Update - /dev/kmem Permissions Issue

The default permissions on /dev/kmem is insecure. A bug in all Linux 2.0.x kernels except 2.0.36 have a vulnerability which makes blind ip-spoofing possible.

LinuxSecurity.com Team
Dec 07, 1999

SuSE: Security Advisory - Critical Talkback Issue in Netscape 4.5

The Netscape Communicator 4.5 comes with "talkback", a quality enhancement tool by Fullcircle (www.fullcircle.com). If the communicator crashs for any reason, the file with the name /tmp/.$UID.talkback is read in, and the pid in this file is killed. After that, the file is truncated/created without checks for {sym|hard}links and the pid of the current talkback process is written into the file.