CVE-2008-1147

CVE-2008-1147 describes a weakness in a PRNG that uses XOR and 2-bit random hops (Algorithm X2) used in OpenBSD 2.6–3.4, macOS 10–10.5.1, FreeBSD 4.4–7.0, and DragonFlyBSD 1.0–1.10.1. The vulnerability allows remote attackers to infer sensitive values such as IP fragmentation IDs by observing a s...

urlevasion.txt

I dont know if its new but i code it during a PentTest and i would like to share it with you. It is based on code developed By sinhack research labs: http://sinhack.net/URLFilteringEvasion/sakeru.tx Description: "Fortinet's URL blocking functionality can be bypassed by specially-crafted HTTP...

TippingPoint detection bypass

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The following advisory is also available in PDF format for download at: http://www.cybsec.com/vuln/CYBSEC-SecurityPre-Advisory3ComTippingPointIPSDetectionBypass2.pdf CYBSEC S.A. www.cybsec.com Pre-Advisory Name: TippingPoint detection bypass...

OpenBSD - ICMPv6 Fragment Remote Execution

The PoC executes the shellcode int 3 and returns. It overwrites the extfree function pointer on the mbuf and forces a mfreem on the overflowed packet. The Impacket library is used to craft and send packets http://oss.coresecurity.com/projects/impacket.html or download from Debian repositories...

snort-dos.txt

/ DOS Snort Inline Affected Versions: 2.6.1.1, 2.6.1.2, 2.7.0beta Requirements : Frag3 Enabled, Inline, Linux, ipconntrack disabled Antimatt3r [email protected] Offset needs to be supplied that would cause reassembly for different snort fragmentation reassembly policies. Since the first packet...

Snort 2.6.1.1/2.6.1.2/2.7.0 (fragementation) Remote DoS Exploit

Exploit for multiple platform in category dos / poc =============================================================== Snort 2.6.1.1/2.6.1.2/2.7.0 fragementation Remote DoS Exploit =============================================================== / DOS Snort Inline Affected Versions: 2.6.1.1, 2.6.1.2,...

Snort 2.6.1.1/2.6.1.2/2.7.0 (fragementation) Remote DoS Exploit

No description provided by source. / DOS Snort Inline Affected Versions: 2.6.1.1, 2.6.1.2, 2.7.0beta Requirements : Frag3 Enabled, Inline, Linux, ipconntrack disabled Antimatt3r [email protected] Offset needs to be supplied that would cause reassembly for different snort fragmentation reassemb...

MS04-011 Microsoft LSASS Service DsRolerUpgradeDownlevelServer Overflow

This module exploits a stack buffer overflow in the LSASS service, this vulnerability was originally found by eEye. When re-exploiting a Windows XP system, you will need need to run this module twice. DCERPC request fragmentation can be performed by setting 'FragSize' parameter. This module...

PT-2006-1579 · Cisco +1 · Cisco Pix +3

Name of the Vulnerable Software and Affected Versions: Cisco PIX/ASA versions 7.1.x before 7.12 Cisco PIX/ASA versions 7.0.x before 7.05 Cisco PIX version 6.3.x before 6.3.5112 Cisco FWSM versions 2.3.x before 2.34 Cisco FWSM versions 3.x before 3.17 Description: The issue allows remote attackers...

CVE-2006-0839

Removed by vendor...

[Full-disclosure] [thunkers.net] D-Link Fragmented UDP DoS Vulnerability

At the time of discovery the issue affected the latest D-Link firmwares. As D-Link has since released a new firmware, this is no longer the case, so... cheers... --- Aaron Portnoy ------------------------------------------------------------------------------------ D-Link Fragmented UDP Denial of...

Verified evasion in Snort

pre Dan Kaminsky gave a presentation at shmoocon and mentioned using ip fragmentation timers to evade intrusion detection systems. It's a pretty straightforward technique and easy to code up so we decided to look and see if Snort was vulnerable...

ping of death

The machine crashed when pinged with an incorrectly fragmented packet. This is known as the SPDX-FileCopyrightText: 2003 Michel Arboi Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

[Full-disclosure] ICMP attacks against TCP: Conclusions

Folks, My posts to this list have tried to show how easy it is to perform ICMP attacks against TCP. The attacks are blind, so the attacker does not need to be a "man in the middle" to perform then. The typical number of packets required to perform any of these attacks is about 16000 in many cases...

CVE-2001-1465

CVE-2001-1465 affects SurfControl SuperScout. The issue is in the packet-filtering logic that only filters packets containing both an HTTP GET request and a Host header; an attacker can bypass filtering by fragmenting traffic so that no single packet contains both elements. This is a local-access...

Microsoft Windows XP - TCP Packet Fragmentation Handling Denial of Service (2)

Microsoft Windows XP - TCP Packet Fragmentation Handling Denial of Service 2 // source: https://www.securityfocus.com/bid/11258/info Multiple vendor implementations of the TCP stack are reported prone to a remote denial-of-service vulnerability. The issue is reported to present itself due to...

Microsoft Windows XP - TCP Packet Fragmentation Handling Denial of Service (3)

// source: https://www.securityfocus.com/bid/11258/info Multiple vendor implementations of the TCP stack are reported prone to a remote denial-of-service vulnerability. The issue is reported to present itself due to inefficiencies present when handling fragmented TCP packets. The discoverer of th...

ROSE Attack - Newdawn2

Exploit for unknown platform in category dos / poc ====================== ROSE Attack - Newdawn2 ====================== / ROSE attack chuck at lemure.net Discovered by: email protected code modified from large IGMP attack by: Kox by Coolio email protected Sends out first and last ICMP packet echo...

Microsoft Windows XP - TCP Packet Fragmentation Handling Denial of Service (3)

Microsoft Windows XP - TCP Packet Fragmentation Handling Denial of Service 3 // source: https://www.securityfocus.com/bid/11258/info Multiple vendor implementations of the TCP stack are reported prone to a remote denial-of-service vulnerability. The issue is reported to present itself due to...

ROSE Attack - NewDawn4

Exploit for unknown platform in category dos / poc ====================== ROSE Attack - NewDawn4 ====================== /-------------------------------------------------------------/ / Implementation of Rose Attack described by Gandalf gandalf at digital.net Reference: Bugtraq, 30 mars 2004, "IP...