9617 matches found
CVE-2000-0763: Undefined Security Weakness
xlockmore and xlockf do not properly cleanse user-injected format strings, which allows local users to gain root privileges via the -d option...
CVE-2000-0733: Undefined Security Weakness
Telnetd telnet server in IRIX 5.2 through 6.1 does not properly cleans user-injected format strings, which allows remote attackers to execute arbitrary commands via a long RLD variable in the IAC-SB-TELOPTENVIRON request...
CVE-2000-0666: Undefined Security Weakness
rpc.statd in the nfs-utils package in various Linux distributions does not properly cleanse untrusted format strings, which allows remote attackers to gain root privileges...
@stake Advisory: PHP3/PHP4 Logging Format String Vulnerability (A 101200-1)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 We contacted the PHP team on 10/3/2000 concerning this problem. We wanted to hold off releasing our advisory until a fix was available for PHP3 since some users may not be able to easily upgrade to PHP4. Fixes for PHP3 and PHP4 are now available. We a...
CVE-2000-0583: Undefined Security Weakness
vchkpw program in vpopmail before version 4.8 does not properly cleanse an untrusted format string used in a call to syslog, which allows remote attackers to cause a denial of service via a USER or PASS command that contains arbitrary formatting directives...
CVE-2000-0751: Undefined Security Weakness
mopd Maintenance Operations Protocol loader daemon does not properly cleanse user-injected format strings, which allows remote attackers to execute arbitrary commands...
CVE-2000-0594: Undefined Security Weakness
BitchX IRC client does not properly cleanse an untrusted format string, which allows remote attackers to cause a denial of service via an invite to a channel whose name includes special formatting characters...
Дырки в PHP (format string)
Многочисленные ошибки форматной строки...
PHP remote format string vulnerabilities
OVERVIEW PHP is a commonly used HTML-embedded scripting language. Format string vulnerabilities exist in the error logging routines of PHP versions 3 and 4, allowing remote users to execute arbitrary code under the web server's user id. A web server having PHP installed and one or more PHP script...
PHP 3.04.0 - Error Logging Format String
PHP 3.04.0 - Error Logging Format String // source: https://www.securityfocus.com/bid/1786/info PHP is a scripting language designed for CGI applications that is used on many websites. There exists a remotely exploitable format string vulnerability in all versions of PHP below PHP 4.0.3. The...
PHP 3.0/4.0 - Error Logging Format String
// source: https://www.securityfocus.com/bid/1786/info PHP is a scripting language designed for CGI applications that is used on many websites. There exists a remotely exploitable format string vulnerability in all versions of PHP below PHP 4.0.3. The vulnerability exists in the code that handles...
[RHSA-2000:066-03] lpr has a format string security bug, LPRng compat issues, and a race cond.
--------------------------------------------------------------------- Red Hat, Inc. Security Advisory Synopsis: lpr has a format string security bug, LPRng compat issues, and a race cond. Advisory ID: RHSA-2000:066-03 Issue date: 2000-09-25 Updated on: 2000-10-04 Product: Red Hat Linux Keywords:...
Re: OpenBSD Security Advisory
Hi, Here is another exploit for an application fstat that OpenBSD's format string audit has seemingly forgotten about. What I would like to know is why this and a number of other privileged applications have security vulnerabilities in them. They WERE fixed, but NO ADVISORY nor ANY MENTION IN THE...
Дырка в LPRng и lpr.
Ошибка форматной строки в lpd, причем последний работает как suid root. Кроме того ошибки форматной строки и преобразования данных в lpr...
Дырка в OpenBSD (fstat, talkd)
Ошибки форматной строки...
OpenBSD 2.x - fstat Format String
OpenBSD 2.x - fstat Format String // source: https://www.securityfocus.com/bid/1746/info fstat is a program shipped with BSD unix variants that is used to list the open files on a system. It is installed sgid kmem so it can access information about open files from the kernel memory structures. A...
OpenBSD 2.x - 'fstat' Format String
// source: https://www.securityfocus.com/bid/1746/info fstat is a program shipped with BSD unix variants that is used to list the open files on a system. It is installed sgid kmem so it can access information about open files from the kernel memory structures. A user definable environment variabl...
Format string input validation error in wu-ftpd site_exec() function
Overview A vulnerability involving an input validation error in the "site exec" command has recently been identified in the Washington University ftpd wu-ftpd software package. Sites running affected systems are advised to update their wu-ftpd software as soon as possible. A similar but distinct...
LPRng use_syslog() Remote Format String Arbitrary Command Execution
LPRng seems to be running on this port. Versions of LPRng prior to 3.6.24 are missing format string arguments in at least two calls to 'syslog' that handle user-supplied input. Using specially crafted input with format strings, an unauthenticated, remote attacker may be able to leverage these...