Multiple Ethernet Driver Frame Padding Information Disclosure (Etherleak)

The remote host uses a network device driver that pads ethernet frames with data which vary from one packet to another, likely taken from kernel memory, system memory allocated to the device driver, or a hardware buffer on its network interface card. Known as 'Etherleak', this information...

X Font Service Crafted XFS Query Remote Overflow

The remote X Font Service xfs is affected by a buffer overflow. An attacker may use this flaw to gain shell access on the remote host as 'root' or 'nobody'. C Tenable Network Security, Inc. It turns out the initial revision of this script would not crash all versions of the font service...

Microsoft IIS IDC Extension XSS

This IIS Server appears to be vulnerable to a cross-site scripting attack due to an error in the handling of overly-long requests on an idc file. It is possible to inject JavaScript in the URL, that will appear in the resulting page. %NASLMINLEVEL 70300 This script was written by Geoffroy Raimbau...

Multiple OS /bin/login Remote Overflow

The remote implementation of the /bin/login utility, used when authenticating a user via telnet or rsh contains an overflow which allows an attacker to gain a shell on this host, without even sending a shell code. An attacker may use this flaw to log in as any user except root on the remote host....

rlogin -froot Remote Root Access

The remote /bin/login seems to be affected by a 'forced root login' vulnerability. By attempting to connet via rlogin and forcing it to use the root account rlogin -froot, any attacker may use this flaw to gain remote root access on this system. C Tenable Network Security, Inc. include"compat.inc...

eXtremail Multiple SMTP Command flog Function Format String

According to its version number, the remote eXtremail server has a format string vulnerability. A remote attacker could exploit this to crash the service, or possibly execute arbitrary code. C Tenable Network Security, Inc. Ref: http://online.securityfocus.com/archive/1/192791 Could not find a...

iBill ibillpm.pl Password Generation Weakness

The remote host is running iBill, an internet billing application. Some versions of the 'ibillpm.pl' CGI use a weak password management system that can be brute-forced. No flaw was tested. Your script might be a safe version. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Script audit and...

BadBlue Hex-encoded Null Byte Request Arbitrary File Access

The remote host is running the BadBlue web server. It was possible to read the contents of 'EXT.ini', the BadBlue configuration file, by sending a specially crafted GET request. C Tenable Network Security, Inc. untested Script audit and contributions from Carmichael Security Erik Anderson Added...

Cisco TFTP Server Long Filename DoS (CSCdy03429)

Trivial File Transfer Protocol TFTP is a protocol which allows for easy transfer of files between network connected devices. A vulnerability has been discovered in the processing of filenames within a TFTP read request when Cisco IOS is configured to act as a TFTP server. This vulnerability is...

[AP] Cisco vpnclient buffer overflow

-- ------------------------- -- - AngryPacket Security Advisory - -- ------------------------- -- - +--------------------- -- - + advisory information +------------------ -- - author: methodic [email protected] release date: 05/28/2002 homepage: http://sec.angrypacket.com advisory...

Microsoft Site Server Multiple Script Information Disclosure

The remote web server seems to leak information when some pages are accessed using the account 'LDAPAnonymousUser' with the password 'LdapPassword1'. Pages which leak information include, but are not limited to : - /SiteServer/Admin/knowledge/persmbr/vs.asp -...

Xerver Web Server < 2.20 Crafted C:/ Request Remote DoS

It is possible to crash the Xerver web server by sending a long URL to its administration port. C Tenable Network Security, Inc. Script audit and contributions from Carmichael Security Erik Anderson nb: domain no longer exists Added BugtraqID and CAN From Bugtraq : Date: Fri, 8 Mar 2002 18:39:39...

MRTG mrtg.cgi cfg Parameter Traversal Arbitrary Files Access

The 'mrtg.cgi' script is part of the MRTG traffic visualization application. A vulnerability exists in this script that allows an attacker to view the first line of any file on the system. %NASLMINLEVEL 70300 This script was written by H D Moore Script audit and contributions from Carmichael...

JRun Web Server (JWS) GET Request Traversal Arbitrary File Access

This host is running the Allaire JRun web server. Versions 2.3.3, 3.0, and 3.1 are vulnerable to a directory traversal attack. This allows a potential intruder to view the contents of any file on the system. %NASLMINLEVEL 70300 This script was written by H D Moore Script audit and contributions...

Cisco Malformed SNMP Message Handling DoS (CSCdw67458)

There is a vulnerability in the way the remote device handles SNMP messages. An attacker may use this flaw to crash the remote device continuously. This vulnerability is documented as Cisco bug ID CSCdw67458. C Tenable Network Security, Inc. Script audit and contributions from Carmichael Security...

Shambala Web Server Malformed HTTP GET Request DoS

It was possible to kill the web server by sending this request : GET !"?%&/=? Shambala is known to be vulnerable to this attack. C Tenable Network Security, Inc. Script audit and contributions from Carmichael Security Erik Anderson nb: domain no longer exists Added BugtraqID and CVE Status:...

OpenBSD Local Root Compromise

ZOOM International Security Advisory OpenBSD local root compromise Systems affected: OpenBSD all version, OpenBSD Current prior April 8, 2002 Risk: High Date: April 11, 2002 Legal Notice: This advisory is copyright c ZOOM International. Disclaimer: Information contained in this advisory are...

F5 Device Default Support Password

The remote F5 Networks device has the default password set for the 'support' user account. This account normally provides read/write access to the web configuration utility. An attacker could take advantage of this to reconfigure your systems and possibly gain shell access to the system with...

*ALERT* BID 3581: Wu-Ftpd File Globbing Heap Corruption Vulnerability

--------------------------------------------------------------------------- Security Alert Subject: Wu-Ftpd File Globbing Heap Corruption Vulnerability BUGTRAQ ID: 3581 CVE ID: CVE-MAP-NOMATCH Published: Nov 27, 2001 Updated: Nov 28, 2001 01:12:56 Remote: Yes Local: No Availability: Always...

Malformed Fragmented Packets DoS Dlink Firewall/Routers

/ / // / / / / / / Fate Research Labs Security Advisory / / // Networking Division // / // -------------------------------------------------------------------- Details: DLink Firewall/Router Vulnerable to Malformed Fragmented Packets Advisory ID: F8-DLINK20010906 Issue date: 062001SEPT Fate...