[BuHa-Security] DoS Vulnerability in MS IE 6 SP2

-----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 --------------------------------------------------- | BuHa Security-Advisory 12 | May 25th, 2006 | --------------------------------------------------- | Vendor | MS Internet Explorer 6.0 | | URL | http://www.microsoft.com/windows/ie/ | | Version ...

[BuHa-Security] MS06-013: HTML Tag Memory Corruption Vulnerability in MS IE 6 SP2

-----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 --------------------------------------------------- | BuHa Security-Advisory 13 | May 25th, 2006 | --------------------------------------------------- | Vendor | MS Internet Explorer 6.0 | | URL | http://www.microsoft.com/windows/ie/ | | Version ...

Re: The Weakness of Windows Impersonation Model

Hi Brian, I wrote a paper on this subject last year, "Snagging Security Tokens to Elevate Privileges" http://www.databasesecurity.com/dbsec-briefs.htm after Tim Mullen and thrashed out a few details at Blackhat last year over a few White Russians. The paper discusses the problem in the context of...

Authentication flaw

The MS-Logon authentication scheme in UltraVNC aka Ultr@VNC 1.0.1 uses weak encryption XOR for challenge/response, which allows remote attackers to gain privileges by sniffing and decrypting passwords...

CVE-2006-2206

The MS-Logon authentication scheme in UltraVNC aka Ultr@VNC 1.0.1 uses weak encryption XOR for challenge/response, which allows remote attackers to gain privileges by sniffing and decrypting passwords...

CVE-2006-2206

The CVE-2006-2206 entry concerns UltraVNC 1.0.1 whose MS-Logon scheme uses weak XOR encryption for challenge/response. This weak cryptography permits an attacker on the network to sniff credentials and decrypt passwords, enabling privilege escalation.

Vulnerability in the way [email protected] handles MS-Logon Authentication.

AGR IT Advisory May 2, 2006 AGR-ADV-2006-01 TITLE: Vulnerability in the way [email protected] handles MS-Logon Authentication. Overview Deon Force discovered a vulnerability in Ultr@VNC 1.0.1 and earlier versions with MS-Logon I and MS-Logon II authentication that may allow attackers to crack the...

Design/Logic Flaw

The Gmax Mail client in Hitachi Groupmax before 20060426 allows remote attackers to cause a denial of service application hang or erroneous behavior via an attachment with an MS-DOS device filename...

CVE-2006-2087

The Gmax Mail client in Hitachi Groupmax before 20060426 allows remote attackers to cause a denial of service application hang or erroneous behavior via an attachment with an MS-DOS device filename...

CVE-2006-2087

The Gmax Mail client in Hitachi Groupmax before 20060426 allows remote attackers to cause a denial of service application hang or erroneous behavior via an attachment with an MS-DOS device filename...

CVE-2006-2087

The CVE-2006-2087 entry concerns Hitachi Groupmax’s Gmax Mail client prior to 20060426. The vulnerability arises from processing an attachment with an MS-DOS device filename, which can cause a denial of service (application hang or erroneous behavior). Documented affected component: the Gmax Mail...

Security Best Practice: Enforcement of MS-RPC Protections over all TCP Ports

Remote Procedure Call RPC is a protocol that a program can use to request a service from a program located on another computer in a network. Microsoft Remote Procedure Call MS-RPC is Microsoft's implementation of RPC. Microsoft Windows has reported multiple vulnerabilities MS05-039, MS05-043,...

[BuHa-Security] Multiple Vulnerabilities in MS IE 6.0 SP2

-----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 Multiple Vulnerabilities in MS IE 6.0 SP2 Recently, I discovered three vulnerabilities in Microsoft Internet Explorer 6 SP2 with all patches applied. All of these bugs are located in mshtml.dll' and are caused by incorrect handling of specially...

MS Windows XP/2003 (IGMP v3) Denial of Service Exploit (MS06-007)

No description provided by source. / IGMP v3 DoS Exploit ref: http://www.juniper.net/security/auto/vulnerabilities/vuln2866.html ref: http://www.microsoft.com/technet/security/Bulletin/MS06-007.mspx by Alexey Sintsov [email protected] Req: Administrator rights on system Windows Firewall off for...

MS Internet Explorer 6.0 (script action handlers) (mshtml.dll) DoS

No description provided by source. htmlbodyimg src=http://lcamtuf.coredump.cx/photo/current/m2A.jpgfoo onclick=bork onclick=bork onclick=bork onclick=bork onclick=bork onclick=bork onclick=bork onclick=bork onclick=bork onclick=bork onclick=bork onclick=bork onclick=bork onclick=bork onclick=bork...

[Full-disclosure] [HV-HIGH] Microsoft Excel Named Range Arbitrary Code Execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Microsoft Excel Named Range Arbitrary Code Execution Classification: =============== Level: low-med-HIGH-crit ID: HEXVIEW200603141 URL: http://www.hexview.com/docs/20060314-1.txt References: =============== Originally published by fearwall on eBay CVE...

BlackBerry Enterprise Server buffer overflow

Buffer overflow on corrupted MS Word attachments...

windowsMem.txt

Desc : Windows Dos emulation allows dumping of first 1 Mo of RAM with no particular privilege. Tested under : Win 2000, XP SP2, 2003 Code : ;---------------- dumper.asm ----------------------------------------- ; Dump first 1 Mo of memory under any MS product ; 1 Mo is the maximum quantity of...

Microsoft Windows MS-DOS applications uninitilized memory access information leak

Memory is not initialized then allocated for MS-DOS virtual machine. It allows to read data from physical memory...

Lyris ListManager MSDE Weak sa Password

The remote host appears to be running ListManager, a web-based commercial mailing list management application from Lyris. The version of ListManager on the remote host was installed using Microsoft SQL Server Desktop Engine MSDE for its database backend along with a weak password for the 'sa'...