Core Security Technologies Advisory 2008.0204

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs Timbuktu Pro Remote Path Traversal and Log Injection Advisory Information Title: Timbuktu Pro Remote Path Traversal and Log Injection Advisory ID: CORE-2008-0204...

CORE-2008-0204: Timbuktu Pro Remote Path Traversal and Log Injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs Timbuktu Pro Remote Path Traversal and Log Injection Advisory Information Title: Timbuktu Pro Remote Path Traversal and Log Injection Advisory ID: CORE-2008-0204...

Motorola Timbuktu Pro 8.6.58.7 - Directory Traversal Log Injection

Motorola Timbuktu Pro 8.6.58.7 - Directory Traversal Log Injection Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs Title: Timbuktu Pro Remote Path Traversal and Log Injection Advisory ID: CORE-2008-0204 Advisory URL:...

Timbuktu Pro Remote Path Traversal and Log Injection

Timbuktu Pro Remote Path Traversal and Log Injection Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs-research Advisory Information Title: Timbuktu Pro Remote Path Traversal and Log Injection Advisory ID: CORE-2008-0204 Advisory URL:...

Motorola Timbuktu Pro 8.6.5/8.7 - Directory Traversal / Log Injection

Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs Title: Timbuktu Pro Remote Path Traversal and Log Injection Advisory ID: CORE-2008-0204 Advisory URL: http://www.coresecurity.com/?action=item&id=2166 Date published: 2008-03-11 Date of last update: 2008-03-11...

Motorola Timbuktu Pro 8.6.5/8.7 Path Traversal / Log Injection Exploit

Exploit for unknown platform in category remote exploits ====================================================================== Motorola Timbuktu Pro 8.6.5/8.7 Path Traversal / Log Injection Exploit ====================================================================== Core Security Technologies ...

openssh security and bug fix update

4.3p2-24 - fixed audit log injection problem CVE-2007-3102 248059 4.3p2-23 - document where the nss certificate and token dbs are looked for 4.3p2-22 - experimental support for PKCS11 tokens through libnss3 183423 4.3p2-21 - fix an information leak in Kerberos password authentication CVE-2006-505...

pam security, bug fix, and enhancement update

0.99.6.2-3.26 - removed realtime default limits 240123 from the package as it caused regression on machines with nonexistent realtime group 0.99.6.2-3.25 - added and improved translations 219124 - adjusted the default limits for realtime users 240123 0.99.6.2-3.23 - pamunix: truncated MD5 passwor...

audit logging of failed logins

Unspecified vulnerability in the linuxauditrecordevent function in OpenSSH 4.3p2, as used on Fedora Core 6 and possibly other systems, allows remote attackers to write arbitrary characters to an audit log via a crafted username. NOTE: some of these details are obtained from third party informatio...

Fedora 7 : fail2ban-0.8.0-9.fc7 (2007-0621)

This update closes a remote log injection bug which could lead to a DOS attack. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...

Fedora Core 6 : openssh-4.3p2-25.fc6 (2007-715)

Tue Oct 2 2007 Tomas Mraz - 4.3p2-25 - do not fall back on trusted X11 cookies CVE-2007-4752 280471 - Fri Jul 13 2007 Tomas Mraz - 4.3p2-24 - fixed audit log injection problem CVE-2007-3102 248059 - Thu Jun 21 2007 Tomas Mraz - 4.3p2-23 - document where the nss certificate and token dbs are...

Remote log injection on DenyHosts, Fail2ban and BlockHosts

Hi List, DenyHosts, Fail2ban and BlockHosts are vulnerable to remote log injection that can lead to arbitrarily injection of IP addresses in /etc/hosts.deny. To make it more "interesting", not only IP addresses can be added, but also the wild card "all", causing it to block the whole Internet out...

NMDeluxe 1.0.1 - 'footer.php?template' Local File Inclusion

Perl BeyazKurt [email protected] NMDeluxe 1.0.1 template Local File Inclusion Exploit D0rk : "powered by NMDeluxe" dorka gerenk yok ama nese :p Dün trojen yedim a.q ! baÅŸka türlü yapamaz zate lamerler Download : http://wsdeluxe.com/nmdeluxe/downloads.html Your Name & Site URL :p Coded by...

bbsxp sql latest version 0day-vulnerability warning-the black bar safety net

bbsxp some time ago a log injection vulnerability, this vulnerability is still present in this place. ! References the reference content sub LogMessage if Request. ServerVariables"QueryString""" then QueryString="?"& amp;Request. ServerVariables"QueryString"&"" Conn. Execute"insert into BBSXPLog...

CVE-2006-6302

fail2ban 0.7.4 and earlier does not properly parse sshd log files, which allows remote attackers to add arbitrary hosts to the /etc/hosts.deny file and cause a denial of service by adding arbitrary IP addresses to the sshd log file, as demonstrated by logging in via ssh with a login name containi...

Mailman 2.1.8 Multiple Security Issues

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SA0013 - Public Advisory +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ +++++ Mailman 2.1.8 Multiple Security Issues +++++ +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ PUBLISHED ON Sep 13, 2006 PUBLISHED AT...

CVE-2006-1480

CVE-2006-1480 affects WebAlbum 2.02 and is a local file include vulnerability in the skin2 cookie handling (inc/inc_main.php). The flaw allows an unauthenticated attacker to read arbitrary local files or cause command execution by: (1) injecting code into local log files via GET commands, and (2)...

Simple PHP Blog 0.4.7.1 - Remote Command Execution

!/usr/bin/perl use IO::Socket; print "Simple PHP Blog this works with magicquotesgpc = Off\r\n\r\n"; short explaination: we have this code in install05.php: ... script is not deleted after installation, so, if magicquotesgpc = Off, you can include an arbitrary file from local resources, poc:...

AN HTTPD 1.42 - Arbitrary Log Content Injection

AN HTTPD 1.42 - Arbitrary Log Content Injection source: https://www.securityfocus.com/bid/13069/info AN HTTPD is affected by a vulnerability that may allow remote attacker to inject arbitrary content in to the log file. This issue arises due to a failure of input validation. Corruption of logs ma...

AN HTTPD 1.42 - Arbitrary Log Content Injection

source: https://www.securityfocus.com/bid/13069/info AN HTTPD is affected by a vulnerability that may allow remote attacker to inject arbitrary content in to the log file. This issue arises due to a failure of input validation. Corruption of logs may result in concealing attacks and/or misleading...