PT-2004-3109 · Embedthis · Mbedthis Appweb Http Server

Name of the Vulnerable Software and Affected Versions: Mbedthis AppWeb HTTP server versions prior to 1.1.3 Description: The issue allows remote attackers to bypass access restrictions via a URI with mixed case characters. Recommendations: For versions prior to 1.1.3, update to version 1.1.3 or...

CVE-2004-1083

Apache for Apple Mac OS X 10.2.8 and 10.3.6 restricts access to files in a case sensitive manner, but the Apple HFS+ filesystem accesses files in a case insensitive manner, which allows remote attackers to read .DSStore files and files beginning with ".ht" using alternate capitalization...

PT-2004-2059 · Apache +1 · Apache +1

Name of the Vulnerable Software and Affected Versions: Apache for Apple Mac OS X versions 10.2.8 and 10.3.6 Description: The issue arises from the difference in how Apache and the Apple HFS+ filesystem handle file access in terms of case sensitivity. Apache restricts access to files in a...

PT-2003-1602 · Sun · Sun One Application Server

Name of the Vulnerable Software and Affected Versions: Sun ONE Application Server version 7.0 Description: The issue allows remote attackers to obtain JSP source code via a request that uses the uppercase ".JSP" extension instead of the lowercase .jsp extension. Recommendations: For Sun ONE...

Sun ONE Application Server 7.0 - Source Disclosure

source: https://www.securityfocus.com/bid/7709/info Sun ONE Application Server is prone to a source code disclosure vulnerability. This issue is due to handling of case in requests for resources. By changing the case of a file extension, the server may fail to interpret the script and instead ser...

CVE-2002-0394

Red-M 1050 Bluetooth Access Point uses case insensitive passwords, which makes it easier for attackers to conduct a brute force guessing attack due to the smaller space of possible passwords...

CVE-2002-2119

Novell eDirectory 8.6.2 and 8.7 use case insensitive passwords, which makes it easier for remote attackers to conduct brute force password guessing...

PT-2002-2839 · Novell · Novell Edirectory

Name of the Vulnerable Software and Affected Versions: Novell eDirectory versions 8.6.2 through 8.7 Description: The issue allows remote attackers to conduct brute force password guessing more easily due to the use of case insensitive passwords. Recommendations: For Novell eDirectory versions 8.6...

OpenVMS weak passwords

Llimit character set, case insensitivity and fast encryption algorythm allow password bruteforcing...

Cracking OpenVMS passwords with John the Ripper

I have written a patch for John the Ripper http://www.openwall.com/john/ to allow cracking OpenVMS Vax and Alpha passwords. The patch is based on code from Shawn Clifford, Davide Casale and Mario Ambrogetti. The sources are in http://jl.gailly.net/security/john-VMS-patch.tar.gz A README file is a...

CVE-2002-0485

Norton Anti-Virus NAV allows remote attackers to bypass content filtering via attachments whose Content-Type and Content-Disposition headers are mixed upper and lower case, which is ignored by some mail clients...

CVE-2002-0485

Norton Anti-Virus NAV allows remote attackers to bypass content filtering via attachments whose Content-Type and Content-Disposition headers are mixed upper and lower case, which is ignored by some mail clients...

CVE-2002-0485

Affected software: Norton Anti-Virus (NAV). Vulnerability: attachments whose Content-Type and Content-Disposition headers are mixed upper/lower case can bypass content filtering, an issue observed by some mail clients. Root cause: header case sensitivity leads to filtering bypass. Impact: allows ...

CVE-2002-0485

Norton Anti-Virus NAV allows remote attackers to bypass content filtering via attachments whose Content-Type and Content-Disposition headers are mixed upper and lower case, which is ignored by some mail clients...

PT-2002-1536 · Symantec · Norton Anti-Virus

Name of the Vulnerable Software and Affected Versions: Norton Anti-Virus NAV affected versions not specified Description: The issue allows remote attackers to bypass content filtering via attachments whose Content-Type and Content-Disposition headers are mixed upper and lower case, which is ignor...

BIND memcpy not bounded in case T_SIG of rrextract()

Overview Version 8.2.2 of BIND current circa November 1999 contained a buffer overflow in the routine that converts records from network format to database format. Description Version 8.2.2 of BIND includes some checks for the correct format of a signature record in DNSSEC that previous versions...

CVE-2001-0766

Apache on MacOS X Client 10.0.3 with the HFS+ file system allows remote attackers to bypass access restrictions via a URL that contains some characters whose case is not matched by Apache's filters...

CVE-2001-0766

CVE-2001-0766 affects Apache on MacOS X Client 10.0.3 with HFS+; a case-insensitive filesystem leads to bypassing URL-based access filters. The root cause is that Apache’s file access protection assumes a case-sensitive FS, so URLs with mixed case can bypass / restrictions, potentially exposing p...

PT-2001-1946 · Apache +1 · Apache +2

Name of the Vulnerable Software and Affected Versions: Apache versions 1.3.19 and earlier on MacOS X Client 10.0.3 with the HFS+ file system Description: The issue allows remote attackers to bypass access restrictions via a URL that contains some characters whose case is not matched by Apache's...

Apache web server performs case sensitive filtering on Mac OS X HFS+ case insensitive filesystem

Overview The Apache 1.3.14 web server's file access protection scheme can be bypassed for the Mac OS X HFS+ filesystem. Description The Apache web server's file access protection scheme i.e., file request "filtering" assumes that the filesystem being protected is case sensitve. For example, in a...