McAfee ePolicy Orchestrator Format String Vulnerability (a031703-1)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 @stake, Inc. www.atstake.com Security Advisory Advisory Name: ePolicy Orchestrator Format String Vulnerability Release Date: 03/17/2003 Application: McAfee ePolicy Orchestrator 2.5.1 Platform: Windows 2000 Server SP1 Windows 2000 Pro SP1 Severity: The...

Win32: Postmessage API security flaw

Hello, I would like to bring to your notice a certain vulnerability that has existed in Win 9x platforms for many years and now in Win2k/XP. Most of us our familiar with password revealers and password stealing trojans. Though flaws in Windows Messaging API have been show before this one relates ...

Win32hlp exploit for : ":LINK overflow"

hi list, In date Sunday, 9 March, 2003 1:00 AM s0h released an exploit : Win32hlp exploit for : ":LINK overflow" Source : http://s0h.cc/exploit/s0hWin32hlp.c Binary : http://s0h.cc/exploit/s0hWin32hlp.exe Discovered by ThreaT [email protected]. Coded by ThreaT [email protected] Hompage :...

Sendmail < 8.10.0 mail.local Newline Handling Remote DoS

mail.local in the remote Sendmail server, according to its version number, does not properly identify the .\n string which identifies the end of message text, which allows a remote attacker to cause a denial of service or corrupt mailboxes via a message line that is 2047 characters long and ends ...

Microsoft Windows Server 2000 - Help Facility .CNT File :Link Buffer Overflow

Microsoft Windows Server 2000 - Help Facility .CNT File :Link Buffer Overflow // source: https://www.securityfocus.com/bid/7102/info The Microsoft Windows 2000 Help facility does not perform sufficient bounds checking on .cnt files. If a .cnt file containing an unusually long :Link URI was opened...

Microsoft Windows Server 2000 - Help Facility '.CNT' File :Link Buffer Overflow

// source: https://www.securityfocus.com/bid/7102/info The Microsoft Windows 2000 Help facility does not perform sufficient bounds checking on .cnt files. If a .cnt file containing an unusually long :Link URI was opened by the Windows Help facility, a buffer would be overrun, allowing the executi...

MS02-021: Word Mail Reply Arbitrary Script Execution (321804)

Outlook 2000 and 2002 provide the option to use Microsoft Word as the email editor when creating and editing email in RTF or HTML. There is a flaw in some versions of Word that could allow an attacker to execute arbitrary code when the user replies to a specially formed message using Word. An...

[SecurityOffice] Netcharts XBRL Server v4.0.0 Information Leakage Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: MD5 - -- Netcharts XBRL Server v4.0.0 Information Leakage Vulnerability -- - -- Type Information Leakage - -- Release Date March 17, 2003 - -- Product / Vendor NetCharts XBRL Server 4.0 is a data visualization service that generates charts and graphs,...

SECURITY.NNOV: Windows NT 4.0/2000 cmd.exe long path buffer overflow/DoS

Title: Buffer overflow/DoS against cmd.exe for Windows NT 4.0/2000 Affected: Microsoft Windows NT 4.0 buffer overflow Microsoft Windows 2000 DoS Vendor: Microsoft Risk: Average for Windows NT 4.0 Low for Windows 2000 Exploitable: Yes Remote: No Vendor Notified: January, 30 2003 I. Intro cmd.exe i...

Microsoft Windows NT/2000 - 'cmd.exe' CD Buffer Overflow (PoC)

source: https://www.securityfocus.com/bid/6829/info The Windows NT and 2000 command prompt cmd.exe does not properly handle paths containing more than 256 characters. If the cd change directory command is used to change to a subdirectory resulting in a path with more than 256 characters, a buffer...

MS02-070: Flaw in SMB Signing Could Enable Group Policy to be Modified (329170)

The remote version of Windows contains a flaw in the SMB signing implementation. SMB signing is used to sign each packets sent between a client and a server to protect them against man-in-the-middle attacks. If the Domain policy is configured to force usage of SMB signing, it is possible for an...

DoS attack on Windows 2000 Terminal Server

This one's short and simple.. Description ----------- Any user with sufficient permission to log on to a Windows 2000 Terminal Server via RDP or ICA and access its filesystem can reboot the server at will. Exploit ------- - Open SYSTEMROOTSYSTEM32MSGINA.DLL for exclusive access read lock. I used...

Group policy DoS in Windows NT/2000

By putting exclusive lock on group policy file it's possible to stop group policy from applying domainwide...

Windows 2000 SMB signing protection bypass

During connectio nsetup it's possible to switch off SMB signing regardless of policy setting...

Microsoft Outlook 2000 V1 Exchange server certificates flaw

Message may be sent unecrypted...

Microsoft Security Bulletin MS02-070: Flaw in SMB Signing Could Enable Group Policy to be Modified &#40;309376&#41;

-----BEGIN PGP SIGNED MESSAGE----- - ---------------------------------------------------------------------- Title: Flaw in SMB Signing Could Enable Group Policy to be Modified 309376 Released: 11 December 2002 Revised: 22 January 2003 version 2.0 Software: Microsoft Windows 2000 Microsoft Windows...

WarFTPd CWD/MKD Command Overflow

The version of the War FTP Daemon running on this host is vulnerable to a buffer overflow attack. This is due to improper bounds checking within the code that handles both the CWD and MKD commands. By exploiting this vulnerability, it is possible to crash the server. This script was written by Er...

Another way to bypass Integrity Protection Driver &#40;&#39;subst&#39; vuln&#41;

Another Way To Bypass Pedestal Software Integrity Protection Driver 'subst' vulnerability Jan K. Rutkowski [email protected] About IPD ---------- IPD is an Open Source program to protect Windows 2000 kernel integrity. Check the following page for more info:...

Microsoft Windows Server 2000 - Lanman Denial of Service (2)

source: https://www.securityfocus.com/bid/4532/info An issue has been discovered in Windows 2000, which could cause a denial of system services. Submitting malformed data to port 445 could cause the Lanman service to consume high CPU and Kernel mode memory usage...

CVE-2002-1712

Microsoft Windows 2000 allows remote attackers to cause a denial of service memory consumption by sending a flood of empty TCP/IP packets with the ACK and FIN bits set to the NetBIOS port TCP/139, as demonstrated by stream3...