xinetd 2.3.0 audit status

Hi, As some of you may know, I've performed an audit of the xinetd 2.3.0 source code for certain classes of vulnerabilities. The audit has resulted in a significant number of fixes many are for non-security issues. The patch was over 100 KB large and got incorporated into xinetd starting with...

IPC@Chip Security

Sentry Research Labs www.sentry-labs.de.vu product: IPC@Chip Beck GmbH vendor informed: 21th of May status: unanswered Note: The demonstration tool and a german version there is also an english download version of this report is available form our website. Siberian...

More Icecast remote vulnerabilities

Following the announcement yesterday about buffer overflow vulnerabilities in Icecast, Andreas Hasenack [email protected] identified several more likely buffer overflow vulnerabilities. Matt Messier [email protected] took a look, and determined that at least some of them are definitely...

FreeBSD-SA-01:19.ja-klock

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:19 Security Advisory FreeBSD, Inc. Topic: ja-xklock port contains a local root compromise Category: ports Module: ja-xklock Announced: 2001-02-07 Credits: Found during...

FreeBSD-SA-01:13.sort

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:13 Security Advisory FreeBSD, Inc. Topic: sort uses insecure temporary files Category: core Module: sort Announced: 2001-01-29 Credits: Discovered during internal auditin...

Immunix OS Security update for lots of temp file problems

----------------------------------------------------------------------- Immunix OS Security Advisory Summary Date: January 10, 2000 Advisory ID: IMNX-2000-70-028-01 Author: Greg Kroah-Hartman [email protected] ----------------------------------------------------------------------- In an internal aud...

Midnight Commander

The Midnight Commander 4.5.51 latest. $ od -t x1 mcbug 0000000 03 14 77 04 0a $ mkdir cat mcbug $ mc try to view this directory - 'w' - 0x77 command will be executed; longer commands might be used, as well Obviously, this attack requires privledged user interaction. Midnight Commander won't displ...

FreeBSD-SA-00:71.mgetty

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:71 Security Advisory FreeBSD, Inc. Topic: mgetty can create or overwrite files Category: ports Module: mgetty Announced: 2000-11-20 Credits: Stan Bubrouski Affects: Ports...

FreeBSD-SA-00:64.global

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:64 Security Advisory FreeBSD, Inc. Topic: global port allows remote compromise through CGI script Category: ports Module: global Announced: 2000-11-06 Credits: Shigio...

half-life.txt

-----BEGIN PGP SIGNED MESSAGE----- Vulnerability Report by Mark Cooper Date Published: 16th October 2000 Advisory ID: N/A Bugtraq ID: 1799 http://www.securityfocus.com/bid/1799 CVE CAN: N/A Title: Half-Life Dedicated Server Vulnerability Class: Buffer Overflow Remotely Exploitable: Yes Locally...

Half-Life Dedicated Server Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Vulnerability Report by Mark Cooper Date Published: 16th October 2000 Advisory ID: N/A Bugtraq ID: 1799 http://www.securityfocus.com/bid/1799 CVE CAN: N/A Title: Half-Life Dedicated Server Vulnerability Class: Buffer Overflow Remotely Exploitable: Yes Locally...

/doc/packages Directory Browsable (deprecated)

The /doc/packages directory is browsable. This directory contains the versions of the packages installed on this host. A remote attacker can use this information to mount further attacks. This plugin has been deprecated. Webmirror3 plugin ID 10662 will identify a browsable directory. %NASLMINLEVE...

Ports Security Advisory: FreeBSD-SA-00:50.listmanager

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:50 Security Advisory FreeBSD, Inc. Topic: listmanager port allows local root compromise Category: ports Module: listmanager Announced: 2000-09-13 Affects: Ports collectio...

FreeBSD-SA-00:50.listmanager

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:50 Security Advisory FreeBSD, Inc. Topic: listmanager port allows local root compromise Category: ports Module: listmanager Announced: 2000-09-13 Affects: Ports...

Проблема с локальной безопасностью в NT - SystemLoadAndCallImage

Недокументированный вызов SystemLoadAndCallImage позволяет выполнить код в режиме ядра в обход аудита безопасности...

Redhat Linux 6.x remote root exploit

Hi, Included below is an exploit for the recently exposed linux rpc.statd format string vulnerability0. I have tailored it towards current Redhat Linux 6.x installations. It can easily be incorporated into attacks against the other vulnerable Linux distributions. I am not a security expert, but...

FreeBSD-SA-00:31.canna

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:31 Security Advisory FreeBSD, Inc. Topic: Canna port contains remote vulnerability REVISED Category: ports Module: Canna Announced: 2000-07-05 Revised: 2000-07-11 Affects...

XFree86: libICE DoS

Hi, I've been sitting on this one for a while. SUMMARY ======= Due to inadequate bounds checking in libICE, a denial of service exists with any application using inet listening libICE for network services. Unfortunately, there is a fairly prominent user of libICE, namely gnome-session. The...

XFree86: xdm flaw; present in kdm

Hi, Just a minor one this. Discovered during a 5 minute pass of "xdm". I subsequently discovered "kdm" has copied the xdm core xdmcp code. I'm posting this because I think Caldera released an advisory, but a general discussion of the problem did not yet appear on Bugtraq. Further audit of kdm/xdm...

Stelian Pop dump 0.4 - restore Buffer Overflow

// source: https://www.securityfocus.com/bid/1330/info A buffer overflow exists in the 'restore' program, part of the dump 0.4b15-1 package, distributed with RedHat Linux 6.2. By supplying a long string containing machine executable code at the prompt for a tape name, it is possible for an attack...