ISC INN 2.x - Command-Line Buffer Overflow (2)

source: https://www.securityfocus.com/bid/2620/info The innfeed utility, part of ISC InterNetNews, has an exploitable buffer overflow in its command-line parser. Specifically, innfeed will overflow if an overly long -c option is passed to it. A local attacker in the news group could use this...

[COVERT-2001-02] Globbing Vulnerabilities in Multiple FTP Daemons

Network Associates, Inc. COVERT Labs Security Advisory April 9, 2001 Globbing Vulnerabilities in Multiple FTP Daemons COVERT-2001-02 o Synopsis Multiple FTP server implementations contain buffer overflows that allow local and remote attackers to gain root privileges on affected servers. These...

FreeBSD-SA-01:16.mysql

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:16 Security Advisory FreeBSD, Inc. Topic: mysql may allow remote users to gain increased privileges Category: ports Module: mysql322-server/mysql323-server Announced:...

CVE-2000-0534

The apsfilter software in the FreeBSD ports package does not properly read user filter configurations, which allows local users to execute commands as the lpd user...

Boa Web Server Traversal Arbtirary File Access/Execution

The remote Boa Webserver allows an attacker to read arbitrary files on the remote web server by prefixing the pathname of the file with hex-encoded '../../' characters. This script was written by Thomas Reinke See the Nessus Scripts License for details Changes by Tenable: - Revised plugin title,...

Traceroute exploit + story

LBL traceroute exploit. By Dvorak, Synnergy Networks www.synnergy.net Vulnerable: All versions of LBL traceroute using savestr. See Chris Evans post in bugtraq http://www.securityfocus.com/archive/1/136215 Discovery: Pekka Savola [email protected] Published to bugtraq by: Chris Evans...

Solaris 2.67.0 eject locale - Subsystem Format String

Solaris 2.67.0 eject locale - Subsystem Format String / source: https://www.securityfocus.com/bid/1634/info nectiva 4.x/5.x,Debian 2.x,IBM AIX 3.x/4.x,Mandrake 7,RedHat 5.x/6.x,IRIX 6.x, Solaris 2.x/7/8,Turbolinux 6.x,Wirex Immunix OS 6.2 Locale Subsystem Format String Many UNIX operating systems...

robpoll-cgi-problem.txt

Software: Robpoll.cgi URL: http:// Platforms: Unix, NT Type: CGI, Change password by default robpoll.cgi Remote Possible Problem discovered by Nick: alt3kx Mail: [email protected] Webs: w w w . h e r t m x . o r g w w w . s 0 d . o r g w w w . r a z a - m e x i c a n a . o r g Summary:...

CVE-2000-0520

CVE-2000-0520 describes a local buffer overflow in the restore program (version 0.4b17 and earlier) within the dump package. The vulnerability allows a local attacker to execute arbitrary commands by supplying a long tape name. Public details in the provided documents do not list affected platfor...

DALnet Bahamut IRCd 4.6.5 - SUMMON Remote Buffer Overflow

DALnet Bahamut IRCd 4.6.5 - SUMMON Remote Buffer Overflow // source: https://www.securityfocus.com/bid/1404/info Dalnet ircd is a server for a popular internet chat application, IRC Internet Relay Chat. The implementation for one of its features, the "summon" command, has a hole which could grant...

FreeBSD-SA-00:20.krb5

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:20 Security Advisory FreeBSD, Inc. Topic: krb5 port contains remote and local root exploits. Category: ports Module: krb5 Announced: 2000-05-26 Credits: Jeffrey I...

CVE-2000-0364

The CVE-2000-0364 entry concerns Red Hat Linux 6.0 where screen and rxvt fail to properly set tty device modes, enabling a local user to write to other virtual consoles. The vulnerability is localized (attack vector LOCAL) with low complexity and no authentication, and it can impact confidentiali...

Переполнение буфера в LCDproc

Многочисленные классические переполнения буфера...

win98-bluescreen.txt

=-= Next Generation of Windows 98 Blues Screen 2 =-= By RUBINHOC from BraZiL Original exploit found by www.securax.org Only for: ruindows 98 maybe 95 too. Techniques: NEW - Infernal Pulse 03/17/2000 =-= WIN98 webservers =-= customized by RUBINHOC rubinhoc:roottelnet victim.com 80 Trying x.x.x.x...

RedHat Linux 6.x - X Font Server Buffer Overflow (Denial of Service)

RedHat Linux 6.x - X Font Server Buffer Overflow Denial of Service // source: https://www.securityfocus.com/bid/1111/info A denial of service exists in the X11 font server shipped with RedHat Linux 6.x. Due to improper input validation, it is possible for any user to crash the X fontserver. This...

Standard Poors ComStock 4.2.4 - Command Execution

Standard Poors ComStock 4.2.4 - Command Execution source: https://www.securityfocus.com/bid/1080/info Numerous vulnerabilities exist in the ComStock product, as sold by Standard & Poor's. ComStock is based on the RedHat 5.1 distribution, and contains many of the vulnerabilities found in the 5.1...

Zeus Web Server 3.x - Null Terminated Strings

source: https://www.securityfocus.com/bid/977/info Appending "%00" to the end of a CGI script filename will permit a remote client to view full contents of the script if the CGI module option "allow CGIs anywhere" is enabled. Scripts located in directories which are designated as executable eg...

CVE-2000-0082

WebTV email client allows remote attackers to force the client to send email without the user's knowledge via HTML...

CVE-1999-1573

Multiple unknown vulnerabilities in the "r-cmnds" 1 remshd, 2 rexecd, 3 rlogind, 4 rlogin, 5 remsh, 6 rcp, 7 rexec, and 8 rdist for HP-UX 10.00 through 11.00 allow attackers to gain privileges or access files...

unixware.pkg.exploits.txt

Greetings, OVERVIEW Most of UnixWare's pkg commands can be exploited to print /etc/shadow, leading to a probable root compromise. BACKGROUND Only tested on UnixWare 7.1. DETAILS The permissions for the UnixWare pkg commands are as follows: bash-2.02$ ls -la /usr/sbin/pkgchk /usr/bin/pkginfo...