CVE-2007-2108

Unspecified vulnerability in the Core RDBMS component in Oracle Database 9.0.1.5, 9.2.0.8, 10.1.0.5, and 10.2.0.2 on Windows allows remote attackers to have an unknown impact, aka DB01. NOTE: as of 20070424, Oracle has not disputed reliable claims that this issue occurs because the NTLM SSPI...

Design/Logic Flaw

Unspecified vulnerability in the Core RDBMS component in Oracle Database 9.0.1.5, 9.2.0.8, 10.1.0.5, and 10.2.0.2 on Windows allows remote attackers to have an unknown impact, aka DB01. NOTE: as of 20070424, Oracle has not disputed reliable claims that this issue occurs because the NTLM SSPI...

CVE-2007-2108

CVE-2007-2108 affects Oracle Database Core RDBMS on Windows (versions 9.0.1.5, 9.2.0.8, 10.1.0.5, 10.2.0.2). Remote attackers may gain privileges due to NTLM SSPI AcceptSecurityContext granting privileges based on username while all users appear as Guest. No exploit details provided in the source...

CVE-2007-2108

Unspecified vulnerability in the Core RDBMS component in Oracle Database 9.0.1.5, 9.2.0.8, 10.1.0.5, and 10.2.0.2 on Windows allows remote attackers to have an unknown impact, aka DB01. NOTE: as of 20070424, Oracle has not disputed reliable claims that this issue occurs because the NTLM SSPI...

Atrium Mercur IMapD NTLM缓冲区溢出漏洞

Atrium Mercur IMapD是一款Imap协议实现的IMAPD守护程序。 Atrium Mercur IMapD处理NTLM验证存在缓冲区溢出，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 提交恶意的请求，可导致触发缓冲区溢出。攻击者可导致拒绝服务或者任意指令执行攻击。 Atrium Software Mercur IMAPD 1 SP4 目前没有解决方案提供： http://www.atrium-software.com/ !/usr/bin/perl mercur-v1.pl Mercur v5.00.14 win32 remote exploit by mu-b...

Atrium Mercur Mailserver IMAPD buffer overflow

Multiple buffer overflows in IMAP NTLM authentication implementation. Buffer overflow in SUBSCRIBE command...

CVE-2007-1578

Multiple integer signedness errors in the NTLM implementation in Atrium MERCUR IMAPD mcrimap4.exe 5.00.14, with SP4, allow remote attackers to execute arbitrary code via a long NTLMSSP argument that triggers a stack-based buffer overflow...

Stack overflow

Multiple integer signedness errors in the NTLM implementation in Atrium MERCUR IMAPD mcrimap4.exe 5.00.14, with SP4, allow remote attackers to execute arbitrary code via a long NTLMSSP argument that triggers a stack-based buffer overflow...

CVE-2007-1578

Multiple integer signedness errors in the NTLM implementation in Atrium MERCUR IMAPD mcrimap4.exe 5.00.14, with SP4, allow remote attackers to execute arbitrary code via a long NTLMSSP argument that triggers a stack-based buffer overflow...

CVE-2007-1578

CVE-2007-1578 : MERCUR IMAPD (Atrium MERCUR Messaging Server) is affected by multiple NTLMSSP-related memory corruption issues in the IMAP service’s NTLMSSP handling. The flaw is described as a stack-based buffer overflow triggered by a long NTLMSSP argument, allowing remote attackers to execute ...

mercur-v1.txt

!/usr/bin/perl mercur-v1.pl Mercur v5.00.14 win32 remote exploit by mu-b - Dec 2006 - Tested on: Mercur v5.00.14 win32 use Getopt::Std; getopts't:n:', %arg; use Socket; use MIME::Base64; my $target; if defined$arg't' $target = $arg't' if !defined$target my $imapdport = 143; my $senddelay = 1; if...

Mercur IMAPD 5.00.14 (Windows x86) - Remote Denial of Service

Mercur IMAPD 5.00.14 Windows x86 - Remote Denial of Service !/usr/bin/perl mercur-v1.pl Mercur v5.00.14 win32 remote exploit by mu-b - Dec 2006 - Tested on: Mercur v5.00.14 win32 use Getopt::Std; getopts't:n:', %arg; use Socket; use MIME::Base64; my $target; if defined$arg't' $target = $arg't' if...

MailEnable multiple security vulnerabilities

Multiple crossite scripting issues. NTLM authentication DoS. Buffer overflow in IMAP APPEND command...

CVE-2007-0955

The NTLMUnPackType3 function in MENTLM.dll in MailEnable Professional 2.35 and earlier allows remote attackers to cause a denial of service application crash via certain base64-encoded data following an AUTHENTICATE NTLM command to the imap port 143/tcp, which results in an out-of-bounds read...

CVE-2007-0955

The CVE-2007-0955 entry concerns MailEnable Professional (version 2.35 and earlier) where the NTLM_UnPack_Type3 function in MENTLM.dll is vulnerable. Remote attackers can cause an application crash (DoS) by sending certain base64-encoded data after an AUTHENTICATE NTLM command to the IMAP port (1...

[Full-disclosure] MailEnable DoS POC

The POC attached exploits an out of bounds memory read in the NTLM authentication routines of MailEnable Pro/Enterprise. The problem lies in the NTLMUnPackType3 function of MENTLM.dll. This appears to have been silently "patched" somewhere between versions 2.351 and 2.36-7. observe the quotes...

MailEnable Professional/Enterprise 2.35 - Out of Bounds Denial of Service

!/usr/bin/perl maildisable-v5.pl Mail Enable Professional/Enterprise Connected\n"; sendSOCKET, "1 AUTHENTICATE NTLM\r\n", 0; sleep$senddelay; $buf = $PAD x 12. "\xfa\xff\xff\xff". $PAD x 12; sendSOCKET, encodebase64$buf."\r\n", 0; sleep$senddelay; $buf = $PAD x 28. "\x00\x01". $PAD x 2...

MailEnable ProfessionalEnterprise 2.37 - Denial of Service

MailEnable ProfessionalEnterprise 2.37 - Denial of Service !/usr/bin/perl maildisable-v7.pl Mail Enable Professional/Enterprise v2.32-7 win32 by mu-b - Wed Feb 14 2007 - Tested on: Mail Enable Professional v2.37 win32 use Getopt::Std; getopts't:', %arg; use Socket; use MIME::Base64; my $target; i...

MailEnable Professional/Enterprise <= 2.37 Denial of Service Exploit

Exploit for unknown platform in category dos / poc ==================================================================== MailEnable Professional/Enterprise Connected\n"; sendSOCKET, "1 AUTHENTICATE NTLM\r\n", 0; sleep$senddelay; $buf = $PAD x 12. "\xfa\xff\xff\xff". $PAD x 12; sendSOCKET,...

MailEnable Professional/Enterprise 2.37 - Denial of Service

!/usr/bin/perl maildisable-v7.pl Mail Enable Professional/Enterprise v2.32-7 win32 by mu-b - Wed Feb 14 2007 - Tested on: Mail Enable Professional v2.37 win32 use Getopt::Std; getopts't:', %arg; use Socket; use MIME::Base64; my $target; if defined$arg't' $target = $arg't' if !defined$target my...