openssh security and bug fix update

4.3p2-24 - fixed audit log injection problem CVE-2007-3102 248059 4.3p2-23 - document where the nss certificate and token dbs are looked for 4.3p2-22 - experimental support for PKCS11 tokens through libnss3 183423 4.3p2-21 - fix an information leak in Kerberos password authentication CVE-2006-505...

audit logging of failed logins

Unspecified vulnerability in the linuxauditrecordevent function in OpenSSH 4.3p2, as used on Fedora Core 6 and possibly other systems, allows remote attackers to write arbitrary characters to an audit log via a crafted username. NOTE: some of these details are obtained from third party informatio...

Fedora 7 : fail2ban-0.8.0-9.fc7 (2007-0621)

This update closes a remote log injection bug which could lead to a DOS attack. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...

Fedora Core 6 : openssh-4.3p2-25.fc6 (2007-715)

Tue Oct 2 2007 Tomas Mraz - 4.3p2-25 - do not fall back on trusted X11 cookies CVE-2007-4752 280471 - Fri Jul 13 2007 Tomas Mraz - 4.3p2-24 - fixed audit log injection problem CVE-2007-3102 248059 - Thu Jun 21 2007 Tomas Mraz - 4.3p2-23 - document where the nss certificate and token dbs are...

Remote log injection on DenyHosts, Fail2ban and BlockHosts

Hi List, DenyHosts, Fail2ban and BlockHosts are vulnerable to remote log injection that can lead to arbitrarily injection of IP addresses in /etc/hosts.deny. To make it more "interesting", not only IP addresses can be added, but also the wild card "all", causing it to block the whole Internet out...

NMDeluxe 1.0.1 - 'footer.php?template' Local File Inclusion

Perl BeyazKurt [email protected] NMDeluxe 1.0.1 template Local File Inclusion Exploit D0rk : "powered by NMDeluxe" dorka gerenk yok ama nese :p Dün trojen yedim a.q ! baÅŸka türlü yapamaz zate lamerler Download : http://wsdeluxe.com/nmdeluxe/downloads.html Your Name & Site URL :p Coded by...

bbsxp sql latest version 0day-vulnerability warning-the black bar safety net

bbsxp some time ago a log injection vulnerability, this vulnerability is still present in this place. ! References the reference content sub LogMessage if Request. ServerVariables"QueryString""" then QueryString="?"& amp;Request. ServerVariables"QueryString"&"" Conn. Execute"insert into BBSXPLog...

CVE-2006-6302

fail2ban 0.7.4 and earlier does not properly parse sshd log files, which allows remote attackers to add arbitrary hosts to the /etc/hosts.deny file and cause a denial of service by adding arbitrary IP addresses to the sshd log file, as demonstrated by logging in via ssh with a login name containi...

Mailman 2.1.8 Multiple Security Issues

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SA0013 - Public Advisory +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ +++++ Mailman 2.1.8 Multiple Security Issues +++++ +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ PUBLISHED ON Sep 13, 2006 PUBLISHED AT...

CVE-2006-1480

CVE-2006-1480 affects WebAlbum 2.02 and is a local file include vulnerability in the skin2 cookie handling (inc/inc_main.php). The flaw allows an unauthenticated attacker to read arbitrary local files or cause command execution by: (1) injecting code into local log files via GET commands, and (2)...

Simple PHP Blog 0.4.7.1 - Remote Command Execution

!/usr/bin/perl use IO::Socket; print "Simple PHP Blog this works with magicquotesgpc = Off\r\n\r\n"; short explaination: we have this code in install05.php: ... script is not deleted after installation, so, if magicquotesgpc = Off, you can include an arbitrary file from local resources, poc:...

CVE-2006-0201: Undefined Security Weakness

Dave Nielsen and Patrick Breitenbach PayPal Web Services aka PHP Toolkit 0.50, and possibly earlier versions, allows remote attackers to enter false payment entries into the log file via HTTP POST requests to ipnsuccess.php...

CVE-2005-3704: Undefined Security Weakness

System log server in Mac OS X and OS X Server 10.4 through 10.4.3 allows remote attackers to spoof syslog messages in log files by injecting various control characters such as newline NL...

AN HTTPD 1.42 - Arbitrary Log Content Injection

AN HTTPD 1.42 - Arbitrary Log Content Injection source: https://www.securityfocus.com/bid/13069/info AN HTTPD is affected by a vulnerability that may allow remote attacker to inject arbitrary content in to the log file. This issue arises due to a failure of input validation. Corruption of logs ma...

AN HTTPD 1.42 - Arbitrary Log Content Injection

source: https://www.securityfocus.com/bid/13069/info AN HTTPD is affected by a vulnerability that may allow remote attacker to inject arbitrary content in to the log file. This issue arises due to a failure of input validation. Corruption of logs may result in concealing attacks and/or misleading...

Apache < 1.3.31 / 2.0.49 Error Log Escape Sequence Injection

Binary data 1221.prm...

D-Link AirPlus DI-614+ / DI-624 / DI-704 - DHCP Log HTML Injection

source: https://www.securityfocus.com/bid/10587/info It is reported that the DI-614+, DI-704, and the DI-624 are susceptible to an HTML injection vulnerability in their DHCP log. An attacker who has access to the wireless, or internal network segments of the router can craft malicious DHCP...

Apache < 1.3.31 / 2.0.49 Log Entry Terminal Escape Sequence Injection

The target is running an Apache web server that allows for the injection of arbitrary escape sequences into its error logs. An attacker might use this vulnerability in an attempt to exploit similar vulnerabilities in terminal emulators. Nessus has determined the vulnerability exists only by looki...

Multiple Apache vulnerabilities

modssl memory leak, logfile terminal escape sequences injection...

DEBIAN-CVE-2003-0083

Apache 1.3 before 1.3.25 and Apache 2.0 before version 2.0.46 does not filter terminal escape sequences from its access logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences, a different vulnerabilit...