Jetty可预测随机会话ID漏洞

Jetty是一款流行的Java Web服务器。 Jetty的会话ID随机生成实现上存在漏洞，远程攻击者可能利用此漏洞获取非授权访问。 Jetty使用java.util.Random生成会话ID。java.util.random实现以下形式的线性同余随机数生成器： synchronized protected int nextint bits seed = seed 0x5DEECE66DL + 0xBL & 1L 48 - 1; return intseed 48 - bits;...

CVE-2006-0037

ipnatpptp in the PPTP NAT helper netfilter/ipnathelperpptp.c in Linux kernel 2.6.14, and other versions, allows local users to cause a denial of service memory corruption or crash via a crafted outbound packet that causes an incorrect offset to be calculated from pointer arithmetic when non-linea...

CVE-2006-0037

ipnatpptp in the PPTP NAT helper netfilter/ipnathelperpptp.c in Linux kernel 2.6.14, and other versions, allows local users to cause a denial of service memory corruption or crash via a crafted outbound packet that causes an incorrect offset to be calculated from pointer arithmetic when non-linea...

CVE-1999-1111

The CVE-1999-1111 entry describes a vulnerability in StackGuard before 1.21 where an attacker can bypass Random and Terminator Canary protections by a non-linear attack that directly modifies the return-address pointer instead of overflowing a buffer. Documents do not provide exploitation details...

Новый вид сканирования - Pixie scan

Используется факт линейного изменения IP ID, что позволяет просканировать открытые порты даже за маскарирующим сервером используя пакет с внутреннего адреса и проверяя прирощение IP ID...

Catastrophic failure of Strip password generation.

Executive summary: If you have ever used Strip for the Palm to generate your passwords, change them. Change them NOW. Strip Secure Tool for Recalling Important Passwords is a nice encrypted password notebook for the Palm; see http://www.zetetic.net/products.html for details. Strip-0.5 also featur...