Extended Module Player oxm.c及dtt_load.c文件多个本地溢出漏洞

BUGTRAQ ID: 27047 Extended Module Player（XMP）是用于播放老式MOD文件的命令行播放器。 XMP实现上存在多个缓冲区溢出漏洞，远程攻击者可能利用此漏洞控制用户系统。 --------------------------------------------- A testoxm/decrunchoxm缓冲区溢出 --------------------------------------------- 由于可以绕过ilen...

Extended Module Player (xmp) 'oxm.c'和'dtt_load.c'缓冲区溢出漏洞

Extended Module Player xmp是一款命令行播放程序。 Extended Module Player xmp存在多个缓冲区溢出问题，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 问题一是testoxm / decrunchoxm处理OXM文件格式存在缓冲区溢出。 问题二是dttload处理pofs和plen数组存在缓冲区溢出。 Extended Module Player xmp 2.5.1 厂商解决方案 ----------- 目前没有详细解决方案提供： http://xmp.sourceforge.net/ 可参考如下测试程序：...

Buffer-overflow in Extended Module Player 2.5.1

Luigi Auriemma Application: Extended Module Player XMP http://xmp.sourceforge.net Versions: = 2.5.1 Platforms: Linux, BSD, Solaris, HP-UX, MacOS X, QNX, BeOS, Windows, OS/2 and AmigaOS Bugs: A buffer-overflow in testoxm / decrunchoxm B buffer-overflow in dttload Exploitation: local Date: 27 Dec...

Extended Module Player (xmp) 2.5.1 - 'oxm.c' / 'dtt_load.c' Multiple Local Buffer Overflow Vulnerabilities

// source: https://www.securityfocus.com/bid/27047/info Extended Module Player xmp is prone to multiple local buffer-overflow vulnerabilities because it fails to perform adequate boundary checks before copying user-supplied input into an insufficiently sized buffer. These issues occur when the...

Memory corruption

Unspecified vulnerability in the Sun eXtended System Control Facility XSCF Control Package XCP firmware before 1050 on SPARC Enterprise M4000, M5000, M8000, and M9000 servers allows remote attackers to cause a denial of service reboot via 1 telnet, 2 ssh, or 3 http network traffic that triggers...

CVE-2007-6360

Unspecified vulnerability in the Sun eXtended System Control Facility XSCF Control Package XCP firmware before 1050 on SPARC Enterprise M4000, M5000, M8000, and M9000 servers allows remote attackers to cause a denial of service reboot via 1 telnet, 2 ssh, or 3 http network traffic that triggers...

CVE-2007-6360: Undefined Security Weakness

Unspecified vulnerability in the Sun eXtended System Control Facility XSCF Control Package XCP firmware before 1050 on SPARC Enterprise M4000, M5000, M8000, and M9000 servers allows remote attackers to cause a denial of service reboot via 1 telnet, 2 ssh, or 3 http network traffic that triggers...

CVE-2007-5448

Madwifi 0.9.3.2 and earlier allows remote attackers to cause a denial of service panic via a beacon frame with a large length value in the extended supported rates xrates element, which triggers an assertion error, related to net80211/ieee80211scanap.c and net80211/ieee80211scansta.c...

Code injection

Madwifi 0.9.3.2 and earlier allows remote attackers to cause a denial of service panic via a beacon frame with a large length value in the extended supported rates xrates element, which triggers an assertion error, related to net80211/ieee80211scanap.c and net80211/ieee80211scansta.c...

CVE-2007-4529

The WebAdmin interface in TeamSpeak Server 2.0.20.1 allows remote authenticated users with the ServerAdmin flag to assign Registered users certain privileges, resulting in a privilege set that extends beyond that ServerAdmin's own servers, as demonstrated by the 1 AdminAddServer, 2...

wef-study.txt

Windows Extended file attributes buffer overflow Study II In a previous article , i write about extended file attributes: "A local buffer overflow exists in the windows explorer . The extended file atributes functions have a small size of the buffer in 'FileAllInformation,FileNameInformation' and...

Lhaca LZH文档畸形Extended Header Size值栈缓冲区溢出漏洞

Lhaca是一款由日本开发的免费文档压缩解压工具。 Lhaca在处理畸形的LHA文档时存在缓冲区溢出漏洞，远程攻击者可能利用此漏洞通过诱使用户处理恶意文件控制用户机器。 Lhaca没有充分地验证从LHA文件读取的Extended Header Size值便将其拷贝到了Extended Header Data字节数的栈缓冲区，如果Extended Header Size值大于255的话就可能触发缓冲区溢出，导致执行任意指令；此外由于没有正确地使用strncpy还可能导致进一步覆盖该缓冲区。有漏洞的函数如下： function40D974FILE fp, char outbuffer cha...

Stack overflow

Stack-based buffer overflow in Lhaca File Archiver before 1.22 allows user-assisted remote attackers to execute arbitrary code via a large LHA "Extended Header Size" value in an LZH archive, a different issue than CVE-2007-3375...

CVE-2007-3512: Undefined Security Weakness

Stack-based buffer overflow in Lhaca File Archiver before 1.22 allows user-assisted remote attackers to execute arbitrary code via a large LHA "Extended Header Size" value in an LZH archive, a different issue than CVE-2007-3375...

httpd mod_status XSS

Cross-site scripting XSS vulnerability in modstatus.c in the modstatus module in Apache HTTP Server httpd, when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browser...

security flaw

The ext2 file system code in Linux kernel 2.6.x allows local users to cause a denial of service crash via an ext2 stream with malformed data structures that triggers an error in the ext2checkpage due to a length that is smaller than the minimum...

Design/Logic Flaw

Unspecified vulnerability in Hitachi TP1/NET/OSI-TP-Extended on HI-UX/WE2 before 20070213, and on HP-UX before 20070314, allows remote attackers to cause a denial of service via certain data to a port...

CVE-2007-3045

Unspecified vulnerability in Hitachi TP1/NET/OSI-TP-Extended on HI-UX/WE2 before 20070213, and on HP-UX before 20070314, allows remote attackers to cause a denial of service via certain data to a port...

CVE-2007-3045

Unspecified vulnerability in Hitachi TP1/NET/OSI-TP-Extended on HI-UX/WE2 before 20070213, and on HP-UX before 20070314, allows remote attackers to cause a denial of service via certain data to a port...

CVE-2007-3045

CVE-2007-3045 fingerprint: Unspecified vulnerability in Hitachi TP1/NET/OSI-TP-Extended on HI-UX/WE2 (pre-20070213) and HP-UX (pre-20070314) can allow remote attackers to cause a denial of service by sending certain data to a port. Affected component is the Hitachi TP1/NET/OSI-TP-Extended stack; ...