TFTP Server文件名处理远程栈溢出漏洞

BUGTRAQ ID: 28462 TFTP Server是用于PXEBOOT的免费多线程TFTP服务器。 TFTP Server没有正确地处理用户所提交的超长文件名，如果用户提交了带有超长文件名的认证请求的话，就可能触发栈溢出，导致拒绝服务或执行任意指令。 achaldhir TFTP Server 1.4 achaldhir --------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://sourceforge.net/projects/tftp-server/...

Apache Tomcat处理包含MS-DOS设备名请求信息泄漏漏洞

BUGTRAQ ID: 28484 CVE ID: CVE-2005-4703 CNCVE ID:CNCVE-20054703 Tomcat是一款由Apache软件基金会下属的Jakarta项目开发的一个Servlet容器。 Apache Tomcat 4.0.3不正确处理包含MS-DOS设备名的请求，远程攻击者可以利用漏洞获得敏感信息。 当请求的文件匹配MS-DOS文件名时，就会出现错误。服务器会返回包含安装路径等敏感信息。 Apache Software Foundation Tomcat 4.0.3 Apache Software Foundation Tomcat 4.0.3...

siteman-disclose.txt

Siteman V:1.1.9 File Disclosure Vulnerability BY IRCRASH AUTHOR : IRCRASH Dr.Crash Page Address: http://Sitename/articles.php?do=viewart&id=%00&cat=file name%00 Dork : "Siteman Version 1.1.9" Our site : HTTP://IRCRASH.COM...

Debian Security Advisory DSA 159-1 (python)

The remote host is missing an update to python announced via advisory DSA 159-1. OpenVAS Vulnerability Test $Id: deb1591.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 159-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

unp: Arbitrary command execution

Background unp is a script for unpacking various file formats. Description Erich Schubert from Debian discovered that unp does not escape file names properly before passing them to calls of the shell. Impact A remote attacker could entice a user or automated system to unpack a compressed archive...

Stack overflow

Stack-based buffer overflow in the printiso9660recurse function in iso-info src/iso-info.c in GNU Compact Disc Input and Control Library libcdio 0.79 and earlier allows context-dependent attackers to cause a denial of service core dump and possibly execute arbitrary code via a disk or image that...

DEBIAN-CVE-2007-6613

Stack-based buffer overflow in the printiso9660recurse function in iso-info src/iso-info.c in GNU Compact Disc Input and Control Library libcdio 0.79 and earlier allows context-dependent attackers to cause a denial of service core dump and possibly execute arbitrary code via a disk or image that...

CVE-2007-6613

Stack-based buffer overflow in the printiso9660recurse function in iso-info src/iso-info.c in GNU Compact Disc Input and Control Library libcdio 0.79 and earlier allows context-dependent attackers to cause a denial of service core dump and possibly execute arbitrary code via a disk or image that...

CVE-2007-6613

Stack-based buffer overflow in the printiso9660recurse function in iso-info src/iso-info.c in GNU Compact Disc Input and Control Library libcdio 0.79 and earlier allows context-dependent attackers to cause a denial of service core dump and possibly execute arbitrary code via a disk or image that...

CVE-2007-6613

Stack-based buffer overflow in the printiso9660recurse function in iso-info src/iso-info.c in GNU Compact Disc Input and Control Library libcdio 0.79 and earlier allows context-dependent attackers to cause a denial of service core dump and possibly execute arbitrary code via a disk or image that...

CVE-2007-6613

Stack-based buffer overflow in the printiso9660recurse function in iso-info src/iso-info.c in GNU Compact Disc Input and Control Library libcdio 0.79 and earlier allows context-dependent attackers to cause a denial of service core dump and possibly execute arbitrary code via a disk or image that...

CVE-2007-6610

unp 1.0.12, and other versions before 1.0.14, does not properly escape file names, which might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument. NOTE: this might only be a vulnerability when unp is invoked by a third party product...

CVE-2007-6516

Buffer overflow in RavWare Software MAS Flic ActiveX Control masflc.ocx 1.0.0.1 allows remote attackers to execute arbitrary code via a long FileName property...

Cygwin超长文件名堆溢出漏洞

BUGTRAQ ID: 26557 Cygwin是许多自由软件的集合，用于在各种版本的Microsoft Windows上运行UNIX类系统。 Cygwin处理超长文件名时存在漏洞，恶意用户可能利用此漏洞在系统上执行任意指令。 一般来讲Linux文件系统允许255字节的文件名，但cygwin允许239字节，并执行检查防范大于等于240字节的文件名。尽管执行了这个检查，存储文件名的动态内存缓冲区仅分配了232字节，因此233到239字节的文件名可以绕过检查覆盖堆上最多7个字节，导致执行任意指令。 Cygwin 1.5.7 - 1.5.19...

Quickly remove illegal file name code-vulnerability warning-the black bar safety net

allyesno: we will encounter many so-called illegal file name For example .. con, nul, etc. FlowerCode gives the following method can quickly delete these file names http://hi.baidu.com/flowercode/blog/item/3f68be02a7cfd10d4bfb519f.html References Two lines of code get deleted quickly using illega...

t1lib font filename string overflow

Buffer overflow in the intT1EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent attackers to execute arbitrary code via a long FileName parameter. NOTE: this issue was originally reported to be in the imagepsloadfont function in phpgd2.dll in the gd PHPGD2...

t1lib font filename string overflow

Buffer overflow in the intT1EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent attackers to execute arbitrary code via a long FileName parameter. NOTE: this issue was originally reported to be in the imagepsloadfont function in phpgd2.dll in the gd PHPGD2...

CVE-2002-2413

WebSite Pro 3.1.11.0 on Windows allows remote attackers to read script source code for files with extensions greater than 3 characters via a URL request that uses the equivalent 8.3 file name...

CVE-2002-2346

CVE-2002-2346 affects phpBB 2.0 through 2.0.3. The vulnerability arises in how avatar file names are generated: they use hex-encoded client IP addresses, allowing remote attackers to obtain the client’s IP address by inspecting the uploaded avatar filename. The connected Red Hat and CVE records c...

Debian DSA-1371-1 : phpwiki - several vulnerabilities

Several vulnerabilities have been discovered in phpWiki, a wiki engine written in PHP. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-2024 It was discovered that phpWiki performs insufficient file name validation, which allows unrestricted file...