CVE-2001-1162

Directory traversal vulnerability in the %m macro in the smb.conf configuration file in Samba before 2.2.0a allows remote attackers to overwrite certain files via a .. in a NETBIOS name, which is used as the name for a .log file...

CVE-2001-1162: Undefined Security Weakness

Directory traversal vulnerability in the %m macro in the smb.conf configuration file in Samba before 2.2.0a allows remote attackers to overwrite certain files via a .. in a NETBIOS name, which is used as the name for a .log file...

CVE-2002-0419: Exposure of Sensitive Information to an Unauthorized Actor

Information leaks in IIS 4 through 5.1 allow remote attackers to obtain potentially sensitive information or more easily conduct brute force attacks via responses from the server in which 2 in certain configurations, the server IP address is provided as the realm for Basic authentication, which...

Microsoft Internet Explorer may handle certain web pages in an incorrect, less restrictive security zone (MS02-023)

Overview Microsoft Internet Explorer IE may handle malformed Internet pages accessed through the NetBIOS protocol as if they belong to the IE's Intranet or Trusted Sites security zones, instead of the more restrictive Internet security zone. Description If a user views a page on the Internet that...

Re: dH team & SECURITY.NNOV: special device access, information leakage and DoS in Outlook Express

At Wednesday 5/15/2002 03:11 PM +0400, you wrote: Title: Special device access and DoS in Microsoft Internet Exporer/Outlook Express/Outlook All versions of Windows have a reserved filenames referred to special devices such as prn, aux, nul, etc also called DOS devices. This might be related to a...

Unauthorized access to special devices and NetBIOS connections in Microsoft Internet Explorer

With IFRAME and BGSOUND tags it's possible to cause DoS against Outlook Express or to send data to special device. It's also posible to cause IE to establish NetBIOS connection with any untrusted host...

Special device access and DoS in Microsoft Internet Exporer

Title: special device access and DoS in Microsoft Internet Exporer/Outlook Express/Outlook Authors: ERRor, 3APA3A Date: May, 14 2002 Affected: Internet Explorer 6.0 Vendor: Microsoft Risk: Average to high Remote: Yes Exploitable: Yes Vendor notified: April, 24 2002 Intro: All versions of Windows...

CVE-2001-1110

CVE-2001-1110 (EFTP 2.0.7.337) is documented as a remote-attack vulnerability where an attacker can obtain NETBIOS credentials by requesting information on a file in a network share, causing the server to send credentials to the share owner’s host and enabling the attacker to sniff the connection...

CVE-2001-1110

EFTP 2.0.7.337 allows remote attackers to obtain NETBIOS credentials by requesting information on a file that is in a network share, which causes the server to send the credentials to the host that owns the share, and allows the attacker to sniff the connection...

CVE-2001-1110: Undefined Security Weakness

EFTP 2.0.7.337 allows remote attackers to obtain NETBIOS credentials by requesting information on a file that is in a network share, which causes the server to send the credentials to the host that owns the share, and allows the attacker to sniff the connection...

Samba NETBIOS Name Traversal Arbitrary Remote File Creation

The remote Samba server, according to its version number, allows creation of arbitrary remote files. This vulnerability allows an attacker to overwrite arbitrary files by supplying an arbitrarily formed NetBIOS machine name to this server, and to potentially become root on the remote server. An...

CVE-2001-1110

EFTP 2.0.7.337 allows remote attackers to obtain NETBIOS credentials by requesting information on a file that is in a network share, which causes the server to send the credentials to the host that owns the share, and allows the attacker to sniff the connection...

FreeBSD-SA-01:45.samba

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:45 Security Advisory FreeBSD, Inc. Topic: samba Category: ports Module: samba Announced: 2001-07-10 Credits: Michal Zalewski Affects: Ports collection prior to the...

Проблема с лог-файлом в Samba (directory traversal)

При использовании лог-файлов с именами соответствующими NETBIOS-именам компьютером, если имся компьютера содержит ../ - будет перезаписан файл в директории более высокого уровня. NETBIOS-имя может содержать до 15 символов...

[SECURITY] [DSA-065-1] samba remote file append/creation problem

Package : samba Problem type : remote file append/creation Debian-specific: no Michal Zalewski discovered that samba does not properly validate NetBIOS names from remote machines. By itself that is not a problem, except if Samba is configure to write log-files to a file that includes the NetBIOS...

CVE-2001-0264

Gene6 G6 FTP Server 2.0 aka BPFTP Server 2.10 allows remote attackers to obtain NETBIOS credentials by requesting information on a file that is in a network share, which causes the server to send the credentials to the host that owns the share, and allows the attacker to sniff the connection...

CVE-2001-0264

Gene6 G6 FTP Server 2.0 aka BPFTP Server 2.10 allows remote attackers to obtain NETBIOS credentials by requesting information on a file that is in a network share, which causes the server to send the credentials to the host that owns the share, and allows the attacker to sniff the connection...

CVE-2001-0264

Summary (CVE-2001-0264): Gene6 G6 FTP Server 2.0 (also BPFTP Server 2.10) exposes NetBIOS credentials when information about a file in a network share is requested, causing the server to send credentials to the share owner’s host and enabling eavesdropping. Affected component: BPFTP/G6 FTP Server...

CVE-2001-0264: Undefined Security Weakness

Gene6 G6 FTP Server 2.0 aka BPFTP Server 2.10 allows remote attackers to obtain NETBIOS credentials by requesting information on a file that is in a network share, which causes the server to send the credentials to the host that owns the share, and allows the attacker to sniff the connection...

@stake Security Advisory: G6 FTP File Existence Disclosure and Netbios Hash Retrieval (A040301-1)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 @stake, Inc. www.atstake.com Security Advisory Notification Advisory Name: G6 FTP File Existence Disclosure and Netbios Hash Retrieval Release Date: 04/03/2001 Application: G6 FTP Server v2.0 exploit and example, other applications vulnerable to Netbi...