Netcat v1.10 NT Stack Buffer Overflow

This module exploits a stack buffer overflow in Netcat v1.10 NT. By sending an overly long string we are able to overwrite SEH. The vulnerability exists when netcat is used to bind -e an executable to a port in doexec.c. This module tested successfully using "c:\nc -L -p 31337 -e ftp". Module...

CVE-2004-1361

Integer underflow in winhlp32.exe in Windows NT, Windows 2000 through SP4, Windows XP through SP2, and Windows 2003 allows remote attackers to execute arbitrary code via a malformed .hlp file, which leads to a heap-based buffer overflow...

curl -- authentication buffer overflow vulnerability

Two iDEFENSE Security Advisories reports: An exploitable stack-based buffer overflow condition exists when using NT Lan Manager NTLM authentication. The problem specifically exists within Curlinputntlm defined in lib/httpntlm.c. Successful exploitation allows remote attackers to execute arbitrary...

CVE-2004-0900

CVE-2004-0900 pertains to the Windows NT 4.0 DHCP Server, where an unchecked buffer during DHCP message length validation can be exploited by a remote attacker to execute arbitrary code via a malformed DHCP message. The vulnerability is part of MS04-042 (DHCP vulnerabilities) and affects Windows ...

CVE-2004-0893

The Local Procedure Call LPC interface of the Windows Kernel for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the lengths of messages sent to the LPC port, which allows local users to gain privileges, aka "Windows Kernel Vulnerability."...

CVE-2004-0893

This CVE describes two privilege-elevation flaws in Windows components from 2004: (1) the Local Procedure Call (LPC) interface in the Windows kernel fails to validate message lengths, enabling a locally-authenticated attacker to gain full control; and (2) LSASS validates identity tokens improperl...

CVE-2004-0900

The DHCP Server service for Microsoft Windows NT 4.0 Server and Terminal Server Edition does not properly validate the length of certain messages, which allows remote attackers to execute arbitrary code via a malformed DHCP message, aka the "DHCP Request Vulnerability."...

CVE-2004-0899

CVE-2004-0899 corresponds to a Denial of Service in the Windows NT 4.0 DHCP Server when DHCP Logging is enabled, caused by an unchecked message length. Public documentation and vulnerability scanners (MS04-042, KB885249) indicate a fix exists: install the MS04-042 security update for Windows NT 4...

CVE-2004-0568: Undefined Security Weakness

HyperTerminal application for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the length of a value that is saved in a session file, which allows remote attackers to execute arbitrary code via a malicious HyperTerminal session file .ht, web site, or...

CVE-2004-0900: Undefined Security Weakness

The DHCP Server service for Microsoft Windows NT 4.0 Server and Terminal Server Edition does not properly validate the length of certain messages, which allows remote attackers to execute arbitrary code via a malformed DHCP message, aka the "DHCP Request Vulnerability."...

CVE-2004-0899: Undefined Security Weakness

The DHCP Server service for Microsoft Windows NT 4.0 Server and Terminal Server Edition, with DHCP logging enabled, does not properly validate the length of certain messages, which allows remote attackers to cause a denial of service application crash via a malformed DHCP message, aka "Logging...

CVE-2004-0893: Undefined Security Weakness

The Local Procedure Call LPC interface of the Windows Kernel for Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003 does not properly validate the lengths of messages sent to the LPC port, which allows local users to gain privileges, aka "Windows Kernel Vulnerability."...

Microsoft Windows DHCP Server Logging Remote Denial Of Service Vulnerability

Description Microsoft Windows DHCP server on NT 4 server platforms is reported susceptible to a remote denial of service vulnerability in its logging functionality. This issue is due to a failure of the application to properly handle user-supplied network input. This vulnerability allows remote...

Microsoft Windows WINS Name Value Handling Remote Buffer Overflow Vulnerability

Description The WINS server contains a buffer-overflow vulnerability that can allow attackers to corrupt WINS process memory. The issue occurs because the software fails to perform sufficient boundary checks on computer 'name' data that is handled during a WINS transaction. Ultimately, a WINS...

MS04-044: Vulnerabilities in Windows Kernel and LSASS (885835)

The remote host is running version of the NT kernel and LSASS which could allow a local user to gain elevated privileged. An attacker who has the ability to execute arbitrary commands on the remote host could exploit these flaws to gain SYSTEM privileges. C Tenable Network Security, Inc...

MS04-042: Windows NT Multiple DHCP Vulnerabilities (885249)

The remote host has the Windows DHCP server installed. There is a flaw in the remote version of this server that could allow an attacker to execute arbitrary code on the remote host with SYSTEM privileges. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid15965;...

CVE-2004-1080

Summary: CVE-2004-1080 describes a remote memory overwrite in the Windows WINS service (wins.exe) via a crafted WINS replication packet sent to TCP port 42, which could allow arbitrary code execution. Affected products: Microsoft Windows NT Server 4.0, Windows 2000 Server, and Windows Server 2003...

CVE-2004-1080

The WINS service wins.exe on Microsoft Windows NT Server 4.0, Windows 2000 Server, and Windows Server 2003 allows remote attackers to write to arbitrary memory locations and possibly execute arbitrary code via a modified memory pointer in a WINS replication packet to TCP port 42, aka the...

CVE-2004-0939

CVE-2004-0939 affects Neoteris Instant Virtual Extranet (IVE) 3.x and 4.x when LDAP or NT domain authentication is enabled. The flaw is an unauthenticated brute-force risk caused by not limiting the number of password attempts during changepassword.cgi, allowing remote password guessing. Public s...

CVE-2004-0939

changepassword.cgi in Neoteris Instant Virtual Extranet IVE 3.x and 4.x, with LDAP authentication or NT domain authentication enabled, does not limit the number of times a bad password can be entered, which allows remote attackers to guess passwords via a brute force attack...