Microsoft Windows XP/2000/NT 4.0 - Network Share Provider SMB Request Buffer Overflow (1)

// source: https://www.securityfocus.com/bid/5556/info Microsoft Windows operating systems use the Server Message Block SMB protocol to support services such as file and printer sharing. A buffer overflow vulnerability has been reporting in the handling of some malformed SMB requests. An attacker...

Multiple vendors' Domain Name System (DNS) stub resolvers vulnerable to buffer overflow via network name and address lookups

Overview Buffer overflow vulnerabilities exists in the DNS stub resolver library used by BSD, ISC BIND, and GNU glibc. Other systems that use DNS resolver code derived from ISC BIND may also be affected. An attacker who is able to control DNS responses could exploit arbitrary code or cause a deni...

Integer overflow in xdr_array() function when deserializing the XDR stream

Overview There is an integer overflow present in the xdrarray function distributed as part of the Sun Microsystems XDR library. This overflow has been shown to lead to remotely exploitable buffer overflows in multiple applications, leading to the execution of arbitrary code. Although the library...

Multiple vendors' Domain Name System (DNS) stub resolvers vulnerable to buffer overflows

Overview Buffer overflow vulnerabilities exists in the DNS stub resolver library used by BSD, ISC BIND, and GNU glibc. Other systems that use DNS resolver code derived from ISC BIND may also be affected. An attacker who is able to control DNS responses could exploit arbitrary code or cause a deni...

Yahoo! Messenger "addview" function allows for the automatic execution of malicious script contained in web pages

Overview Yahoo! Messenger is an instant messaging client. When installed, Yahoo! Messenger enables a URI handler ymsgr :parameter. The addview function of this handler can be used to execute arbitrary script/html on the local system. Description The addview feature of Yahoo! Messenger is used to...

ISC DHCPD 2.03.0.1 - NSUPDATE Remote Format String

ISC DHCPD 2.03.0.1 - NSUPDATE Remote Format String // source: https://www.securityfocus.com/bid/4701/info The ISC DHCPD Dynamic Host Configuration Protocol is a collection of software implementing the DHCP protocol. It is available for a range of operating systems, including BSD and Solaris. A...

ISC DHCPD 2.0/3.0.1 - NSUPDATE Remote Format String

// source: https://www.securityfocus.com/bid/4701/info The ISC DHCPD Dynamic Host Configuration Protocol is a collection of software implementing the DHCP protocol. It is available for a range of operating systems, including BSD and Solaris. A remote format string vulnerability has been reported ...

[CERT-intexxia] AOLServer DB Proxy Daemon Format String Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SECURITY ADVISORY INTEXXIAc 30 01 2002 ID 1052-300102 TITLE : AOLServer DB Proxy Daemon Format String Vulnerability CREDITS : Guillaume Pelat found this vulnerability / INTEXXIA SYSTEM AFFECTED =============== AOLServer 3.4.2 AOLServer 3.4.1 AOLServer...

Anonymous Mail Forwarding Vulnerabilities in FormMail 1.9

A more easy-on-the-eyes Postscript version of the following advisory may be viewed at: http://www.monkeys.com/anti-spam/formmail-advisory.ps An entertaining working demonstration of a 100 client-side Javascript exploit for older and already well-known FormMail 1.6 version security flaws may be...

Addendum Re: Internet Explorer Pop-Up OBJECT Tag Bug

Pop-Up Bug Notes First, adding an addendum about the bug which Dave Ahmad discovered: This can be used with the window object as well, when setting the document body's innerHTML property and using method "window.open". This information has been forwarded to the vendor. Secondly, there are a numbe...

BSCW: Vulnerabilities and Problems

------------------------------------------------------------------------ -= BSCW Security Issues - Audit report 02 - 7. Sept. 2001 =- ------------------------------------------------------------------------ BSCW is a groupware system that runs on a webserver. For more information about BSCW visit...

Stunnel: Format String Bug in versions <3.22

Don't know why this didn't get approved when I submitted it last week, but here goes again... Release Date: 2001-Dec-22 Package: stunnel Versions: stunnel-3.3 = stunnel-3.21c Problem type: format string bugs Exploit script: none currently known Severity: high Network-accessible: yes Discovery:...

[CERT-intexxia] Auto Nice Daemon Format String Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SECURITY ADVISORY INTEXXIAc 26 11 2001 ID 1047-231101 TITLE : Auto Nice Daemon Format String Vulnerability CREDITS : Guillaume Pelat / INTEXXIA SYSTEM AFFECTED =============== AND = 1.0.4 DESCRIPTION =========== Auto Nice Daemon is vulnerable to a...

locale_sol.txt

----/ Exploiting the Libc Locale Subsystem Format String Vulnerability on Solaris/SPARC ---/ 10/10/2000 -/ Solar Eclipse ---/ I. Introduction This paper describes in detail the exploitation of the libc locale format strin g vulnerability on Solaris/SPARC. The full source code for the exploit is...

Advisory CA-2001-18

CERT Advisory CA-2001-18 Multiple Vulnerabilities in Several Implementations of the Lightweight Directory Access Protocol LDAP Original release date: July 16, 2001 Last revised: -- Source: CERT/CC A complete revision history can be found at the end of this file. Systems Affected iPlanet Directory...

NSFOCUS SA2001-03 : Microsoft FrontPage 2000 Server Extensions Buffer Overflow Vulnerability

NSFOCUS Security AdvisorySA2001-03 Topic: Microsoft FrontPage 2000 Server Extensions Buffer Overflow Vulnerability Release DateЈє 2001-6-25 CVE CAN ID : CAN-2001-0341 BUGTRAQ ID : 2841 Affected system: ================ Microsoft FrontPage 2000 Server Extensions - Microsoft IIS 4.0 - Microsoft IIS...

Re: Winamp 2.6x / 2.7x buffer overflow

Winamp 2.74 doesnt seem to be affected by the bug although I thought it would be, only 2.60 - 2.73 are affected, the AIP file format is some format invented by AudioSoft to provide a legal way to get MP3's from the net. AIP files or AudioSoft parameter files seem to contain weakly encrypted...

CVE-2001-0193

Format string vulnerability in man in some Linux distributions allows local users to gain privileges via a malformed -l parameter...

CVE-2001-0193

CVE-2001-0193 describes a format-string vulnerability in the man page viewer, observed in some Linux distributions via the -l parameter, enabling local privilege escalation. Connected documents identify Debian as affected via the man-db package and reference Debian Security Advisory DSA-028-1, wh...

CVE-2001-0193: Undefined Security Weakness

Format string vulnerability in man in some Linux distributions allows local users to gain privileges via a malformed -l parameter...