IPsec-Tools: authentication bug in racoon

Background IPsec-Tools is a port of KAME's implementation of the IPsec utilities. It contains a collection of network monitoring tools, including racoon, ping, and ping6. Description The KAME IKE daemon racoon is used to authenticate peers during Phase 1 when using either preshared keys, GSS-API,...

PLD Software Ebola 0.1.4 - Remote Buffer Overflow

PLD Software Ebola 0.1.4 - Remote Buffer Overflow // source: https://www.securityfocus.com/bid/9156/info It has been reported that a buffer overflow condition is present in the authentication mechanism implemented in Ebola. The condition is due to the use of the C library function sprintf to...

MDaemon 5.0.5 authentication vulnerability

Hello, There is a security problem on MDaemon 5.0.5 maybe other versions affected as well regarding smtp authentication. Blank password authenticates any valid user: For primary domain: User: VALIDUSER or [email protected] Password: blank password For secondary domains: User:...

Format String Vulnerability in Crob Ftp Server

Package: Crob Ftp Server Auth: Crob Software Studio www.crob.net/studio/ftpserver/ Version: 2.50.4 Build 228 Vulnerability: Format String Risk: High Vulnerability Description: A format string flaw in the authentication process allows remote attackers without valid user/pass to execute arbitrary...

MS Windows SMB Authentication Remote Exploit

Exploit for unknown platform in category remote exploits ============================================ MS Windows SMB Authentication Remote Exploit ============================================ Exploit for "Authentication flaw in Windows SMB protocol" Release Date: April 24, 2003 Code by Haamed...

Microsoft Windows 2000/XP - SMB Authentication Remote Overflow

Exploit for "Authentication flaw in Windows SMB protocol" Release Date: April 24, 2003 Code by Haamed Gheibi [email protected] Salman Niksefat [email protected] Systems Affected by this exploit: Windows 2000 SP0 SP1 SP2 SP3 Windows XP SP0 SP1 EXPLOIT PROVIDED FOR EDUCATIONAL...

Re: QuickTime/Darwin Streaming Administration Server Multiple vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Word. I've found two other issues in QuickTime Streaming Server v4.1.1 that seem to be fixed in the newest v4.1.3: 1. File probing: Request: http://localhost:1220/parsexml.cgi?filename=../nonexistent Response: 'Can't access HTML file '../nonexistent'!...

Cisco VPN 3000 Concentrator PPTP No Encryption Option Remote DoS (CSCdx39981)

The remote VPN concentrator is subject to a VPN client authentication vulnerability that can force a reload of the concentrator when a very large string for the username prompt is sent. This vulnerability is documented as Cisco bug ID CSCdx39981. C Tenable Network Security, Inc. Thanks to Nicolas...

MySQL 3.23.x4.0.x - COM_CHANGE_USER Password Length Account

MySQL 3.23.x4.0.x - COMCHANGEUSER Password Length Account / source: https://www.securityfocus.com/bid/6373/info A flaw in the password authentication mechanism for MySQL may make it possible for an authenticated database user to compromise the accounts of other database users. The flaw lies in th...

acFTP Authentication Issue

acFTP is an open-source FTP daemon for Windows platforms http://www.sourceforge.net/projects/acftp that offers more functionality than many proprietary servers including the MS FTP service. The authentication code of acFTP contains a flaw -- specifically, the server treats users as logged in...

Insufficient Verification of Client Certificates in IIS 5.0 pre sp3

---------------------------------------------------------------------------- ------- Sentor Torparfar Advisory 001 Title: Insufficient Verification of Client Certificates in IIS 5.0 pre sp3 Date: August 16, 2002 Author: Johan Persson [email protected]...

SSH 3 AllowedAuthentications Remote Bypass

The remote host is running a version of SSH that is older than 3.1.2 and newer or equal to 3.0.0. There is a vulnerability in this release that may, under some circumstances, allow users to authenticate using a password whereas it is not explicitly listed as a valid authentication mechanism. An...

Security Bulletin MS02-024: Authentication Flaw in Windows Debugger can Lead to Elevated Privileges (Q320206)

---------------------------------------------------------------------- Title: Authentication Flaw in Windows Debugger can Lead to Elevated Privileges Q320206 Date: 22 May 2002 Software: Microsoft Windows Impact: Elevation of Privilege Max Risk: Critical Bulletin: MS02-024 Microsoft encourages...

CVE-2002-0301

Citrix NFuse 1.6 is affected: authentication can be bypassed by directly calling launch.asp using invalid NFUSE_USER and NFUSE_PASSWORD parameters, enabling access to sensitive information (partial confidentiality). Root cause: flawed authentication check visible in launch.asp handling of those p...

Security Bulletin MS02-011

---------------------------------------------------------------------- Title: Authentication Flaw Could Allow Unauthorized Users To Authenticate To SMTP Service Date: 27 February 2002 Software: Microsoft Windows 2000; Microsoft Exchange Server 5.5 Impact: Mail Relaying Max Risk: Low Bulletin:...

Lucent 8.x - VitalNet Password Authentication Bypass

Lucent 8.x - VitalNet Password Authentication Bypass source: https://www.securityfocus.com/bid/3784/info VitalNet is part of Lucent's VitalSuite SP product family. VitalNet allows users to monitor, analyze, manage and predict the performance of their network infrastructure. The implementation of...

Lucent 8.x - VitalNet Password Authentication Bypass

source: https://www.securityfocus.com/bid/3784/info VitalNet is part of Lucent's VitalSuite SP product family. VitalNet allows users to monitor, analyze, manage and predict the performance of their network infrastructure. The implementation of VitalNet's cookie-based authentication mechanism is...

DEBIAN-CVE-2001-1507

OpenSSH before 3.0.1 with Kerberos V enabled does not properly authenticate users, which could allow remote attackers to login unchallenged...

CVE-2001-1507

OpenSSH before 3.0.1 with Kerberos V enabled does not properly authenticate users, which could allow remote attackers to login unchallenged...

PT-2001-2592 · Openssh +1 · Openssh +1

Name of the Vulnerable Software and Affected Versions: OpenSSH versions prior to 3.0.1 Description: The issue concerns improper user authentication when Kerberos V is enabled. This could potentially allow remote attackers to login without being challenged. Recommendations: For versions prior to...