Mercury/32 4.51 SMTPD CRAM-MD5 Pre-Auth Remote Overflow Exploit

No description provided by source. / Mercury/32 4.51 SMTPD CRAM-MD5 Pre-Auth Remote Stack OverflowUniversal Public Version 1.0 http://www.ph4nt0m.org 2007-08-22 Code by: Zhenhan.Liu Original POC: http://www.milw0rm.com/exploits/4294 Vuln Analysis:...

Stack overflow

Stack-based buffer overflow in the MercuryS SMTP server in Mercury Mail Transport System, possibly 4.51 and earlier, allows remote attackers to execute arbitrary code via a long AUTH CRAM-MD5 string. NOTE: this might overlap CVE-2006-5961...

CVE-2007-4440

Stack-based buffer overflow in the MercuryS SMTP server in Mercury Mail Transport System, possibly 4.51 and earlier, allows remote attackers to execute arbitrary code via a long AUTH CRAM-MD5 string. NOTE: this might overlap CVE-2006-5961...

CVE-2007-4440

CVE-2007-4440 describes a stack-based buffer overflow in the MercuryS SMTP server of the Mercury Mail Transport System (likely version ≤ 4.51). The vulnerability occurs when processing an SMTP AUTH CRAM-MD5 string, enabling a remote attacker to potentially execute arbitrary code with the privileg...

CVE-2007-4417

IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 does not properly revoke privileges on methods, which allows remote authenticated users to execute a method after revocation until the routine auth cache is flushed...

Mercury Mail SMTP AUTH CRAM-MD5 Buffer Overflow

This module exploits a stack buffer overflow in Mercury Mail Transport System 4.51. By sending a specially crafted argument to the AUTH CRAM-MD5 command, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/smtp/mercury/crammd5 msf undefinedcrammd5 show action...

Mercury Mail Transport System AUTH CRAM-MD5 Buffer Overflow Vulnerability

Description Mercury Mail Transport System is prone to a remote stack-based buffer-overflow vulnerability because it fails to perform adequate boundary checks when handling AUTH CRAM-MD5 requests. Attackers can exploit this issue to execute arbitrary code with the privileges of the user running th...

[SECURITY] Fedora 7 Update: lighttpd-1.4.16-1.fc7

Secure, fast, compliant and very flexible web-server which has been optimiz ed for high-performance environments. It has a very low memory footprint compa red to other webservers and takes care of cpu-load. Its advanced feature-set FastCGI, CGI, Auth, Output-Compression, URL-Rewriting and many mo...

CVE-2007-3946

modauth httpauth.c in lighttpd before 1.4.16 allows remote attackers to cause a denial of service daemon crash via unspecified vectors involving 1 a memory leak, 2 use of md5-sess without a cnonce, 3 base64 encoded strings, and 4 trailing whitespace in the Auth-Digest header...

CVE-2007-3946

modauth httpauth.c in lighttpd before 1.4.16 allows remote attackers to cause a denial of service daemon crash via unspecified vectors involving 1 a memory leak, 2 use of md5-sess without a cnonce, 3 base64 encoded strings, and 4 trailing whitespace in the Auth-Digest header...

Denial of service

modauth httpauth.c in lighttpd before 1.4.16 allows remote attackers to cause a denial of service daemon crash via unspecified vectors involving 1 a memory leak, 2 use of md5-sess without a cnonce, 3 base64 encoded strings, and 4 trailing whitespace in the Auth-Digest header...

CVE-2007-3946

modauth httpauth.c in lighttpd before 1.4.16 allows remote attackers to cause a denial of service daemon crash via unspecified vectors involving 1 a memory leak, 2 use of md5-sess without a cnonce, 3 base64 encoded strings, and 4 trailing whitespace in the Auth-Digest header...

[Full-disclosure] Fujitsu-Siemens PRIMERGY BX300 Switch Blade Information Disclosure

Advisory: Fujitsu-Siemens PRIMERGY BX300 Switch Blade Information Disclosure RedTeam Pentesting discovered an information disclosure in the Fujitsu- Siemens BX300 Switch Blade during a penetration test. By accessing URLs of the web interface directly and aborting the authentication dialog, one is...

krb5 RPC library stack overflow

Integer signedness error in the gssrpcsvcauthunix function in svcauthunix.c in the RPC library in MIT Kerberos 5 krb5 1.6.1 and earlier might allow remote attackers to execute arbitrary code via a negative length value...

CVE-2007-3275

MailWasher Server (pre-2.2.1) with LDAP/AD improperly handles blank passwords, enabling remote access to arbitrary user accounts and exposure of stored spam emails. The issue is associated with LoginCheck::doPost in mwi/servlet/Login.cpp. Connected sources corroborate the affected software/versio...

Microsoft IIS <= 5.1 Hit Highlighting Authentication Bypass Exploit

Exploit for unknown platform in category remote exploits =================================================================== Microsoft IIS \nExample:\t$0 http://www.microsoft.com /en/us/default.aspx\n\n"; exit 0 fi site=$1 protectedObject=$2...

Microsoft IIS 5.1 - Hit Highlighting Authentication Bypass

Microsoft IIS 5.1 - Hit Highlighting Authentication Bypass !/bin/sh NTLM && BASIC AUTH BYPASS : sha0atbadchecksum.net Based on my adv: https://www.securityfocus.com/bid/24105/info CVE-2007-2815 if $ != 2 then printf "USAGE:\t\t$0 \nExample:\t$0 http://www.microsoft.com /en/us/default.aspx\n\n";...

Microsoft IIS 5.1 - Hit Highlighting Authentication Bypass

!/bin/sh NTLM && BASIC AUTH BYPASS : sha0atbadchecksum.net Based on my adv: https://www.securityfocus.com/bid/24105/info CVE-2007-2815 if $ != 2 then printf "USAGE:\t\t$0 \nExample:\t$0 http://www.microsoft.com /en/us/default.aspx\n\n"; exit 0 fi site=$1 protectedObject=$2...

Security fix for the ALT Linux 8 package proftpd version 1.3.0rel-alt2

May 16, 2007 Konstantin Lepikhov 1.3.0rel-alt2 - 1.3.0a stable release. - rollback alt-ltdl patch use alternate variant. - don't delete .la files due ltdlopenext breakage in this case. - remove previous CVE-2006-5815 fixes, use variant from Debian. - change packager. - cleanup obsoleted Conflicts...

Debian DSA-1247-1 : libapache-mod-auth-kerb - heap overflow

An off-by-one error leading to a heap-based buffer overflow has been identified in libapache-mod-auth-kerb, an Apache module for Kerberos authentication. The error could allow an attacker to trigger an application crash or potentially execute arbitrary code by sending a specially crafted kerberos...