CVE-2004-0640

Format string vulnerability in the SSLsetverify function in telnetd.c for SSLtelnet daemon SSLtelnetd 0.13 allows remote attackers to execute arbitrary code...

CVE-2004-0453

Format string vulnerability in the monitor "memory dump" command in VICE 1.6 to 1.14 allows local users to cause a denial of service emulator crash and possibly execute arbitrary code via format string specifiers in an output string...

CVE-2004-0640

Format string vulnerability in the SSLsetverify function in telnetd.c for SSLtelnet daemon SSLtelnetd 0.13 allows remote attackers to execute arbitrary code...

DEBIAN-CVE-2004-0536

Format string vulnerability in Tripwire commercial 4.0.1 and earlier, including 2.4, and open source 2.3.1 and earlier, allows local users to gain privileges via format string specifiers in a file name, which is used in the generation of an email report...

CVE-2004-0579

Format string vulnerability in super before 3.23 allows local users to execute arbitrary code as root...

OpenFTPd 0.30.1 - message system Remote Shell

OpenFTPd 0.30.1 - message system Remote Shell / shouts to mitakeet :D exploit for openftpd format string bug. tested on most current version only. -infamous42md AT hotpop DOT com is real email only tricky part is find a place to stick the shell, as there isn't enough room to send it with the form...

OpenFTPd 0.30.1 - message system Remote Shell

/ shouts to mitakeet :D exploit for openftpd format string bug. tested on most current version only. -infamous42md AT hotpop DOT com is real email only tricky part is find a place to stick the shell, as there isn't enough room to send it with the format string. thankfully when using the 'site msg...

OpenFTPD (<= 0.30.2) Remote Exploit

Exploit for linux platform in category remote exploits =================================== OpenFTPD : jmp 0x804db90 ^^^^^^^^^ the first one gdb break main Breakpoint 1 at 0x804bd05 gdb r Starting program: /home/andi/openftpd/bin/msg Thread debugging using libthreaddb enabled New Thread 16384 LWP...

OpenFTPd 0.30.2 - Remote Overflow

OpenFTPd 0.30.2 - Remote Overflow / hoagieopenftpd.c LINUX/X86 OPENFTPD REMOTE EXLPOIT : jmp 0x804db90 ^^^^^^^^^ the first one gdb break main Breakpoint 1 at 0x804bd05 gdb r Starting program: /home/andi/openftpd/bin/msg Thread debugging using libthreaddb enabled New Thread 16384 LWP 29479 Switchi...

OpenFTPD <= 0.30.1 (message system) Remote Shell Exploit

Exploit for linux platform in category remote exploits ======================================================== OpenFTPD = 0.30.1 message system Remote Shell Exploit ======================================================== / shouts to mitakeet :D exploit for openftpd format string bug. tested on...

OpenFTPd 0.30.2 - Remote Overflow

/ hoagieopenftpd.c LINUX/X86 OPENFTPD REMOTE EXLPOIT : jmp 0x804db90 ^^^^^^^^^ the first one gdb break main Breakpoint 1 at 0x804bd05 gdb r Starting program: /home/andi/openftpd/bin/msg Thread debugging using libthreaddb enabled New Thread 16384 LWP 29479 Switching to Thread 16384 LWP 29479...

OpenFTPD SITE MSG FTP Command Format String

The remote host is running OpenFTPD - an FTP server designed to help file sharing aka 'warez'. Some versions of this server are vulnerable to a remote format string attack that could allow an authenticated attacker to execute arbitrary code on the remote host. Note that Nessus did not actually...

Mandrake Linux Security Advisory : hylafax (MDKSA-2002:055)

Numerous vulnerabilities in the HylaFAX product exist in versions prior to 4.1.3. It does not check the TSI string which is received from remote FAX systems before using it in logging and other places. A remote sender using a specially formatted TSI string can cause the faxgetty program to...

Mandrake Linux Security Advisory : gftp (MDKSA-2001:044)

A format string vulnerability exists in all versions of gftp prior to version 2.0.8. This vulnerability has been fixed upstream in version 2.0.8. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandrake Linux Security...

Mandrake Linux Security Advisory : libsafe (MDKSA-2002:026)

Wojciech Purczynski discovered that format string protection in libsafe can be easily bypassed by using flag characters that are implemented in glibc but are not implemented in libsafe. It was also discovered that printf function wrappers incorrectly parse argument indexing in format strings,...

Mandrake Linux Security Advisory : gnupg (MDKSA-2001:053-1)

A format string vulnerability exists in gnupg 1.0.5 and previous versions which is fixed in 1.0.6. This vulnerability can be used to invoke shell commands with privileges of the currently logged-in user. Update : The /usr/bin/gpg executable was installed setuid root and setgid root. While being...

Mandrake Linux Security Advisory : libgtop (MDKSA-2001:094)

A remote format string vulnerability was found in the libgtop daemon by Laboratory intexxia. By sending a specially crafted format string to the server, a remote attacker could potentially execute arbitrary code on the remote system with the daemon's permissions. By default libgtop runs as the us...

Mandrake Linux Security Advisory : mc (MDKSA-2004:039)

Several vulnerabilities in Midnight Commander were found by Jacub Jelinek. This includes several buffer overflows CVE-2004-0226, as well as a format string issue CVE-2004-0232, and an issue with temporary file and directory creation CVE-2004-0231. Most of the included fixes are backports from CVS...

Mandrake Linux Security Advisory : tripwire (MDKSA-2004:057-1)

Paul Herman discovered a format string vulnerability in tripwire that could allow a local user to execute arbitrary code with the rights of the user running tripwire typically root. This vulnerability only exists when tripwire is generating an email report. Update : The packages previously releas...

Mandrake Linux Security Advisory : dhcp (MDKSA-2002:037)

Fermin J. Serna discovered a problem in the dhcp server and client package from versions 3.0 to 3.0.1rc8, which are affected by a format string vulnerability that can be exploited remotely. By default, these versions of DHCP are compiled with the dns update feature enabled, which allows DHCP to...