OCS Inventory NG代理Backend.pm Perl模块处理代码执行漏洞

BUGTRAQ ID: 35593 CVECAN ID: CVE-2009-0667 OCS Inventory NG（Open Computer and Software Inventory Next Generation）是一款系统管理软件，能帮助管理员掌握计算机软件安装和配置，在HTTP代理和服务器之间实现低网络流量通讯。 OCS Inventory套件中的代理组件没有安全地处理Perl模块搜索路径。在通过cron启动代理且默认的Perl模块路径中包含有当前目录的情况下，代理会在系统上的每个目录中扫描Perl模块。以下是Agent/Backend.pm中所执行的代码： foreac...

DSA-1828-1 ocsinventory-agent - arbitrary code execution

Bulletin has no description...

Oracle Secure Backup login.php ora_osb_lcookie command execution

Added: 06/22/2009 CVE: CVE-2008-4006 BID: 33177 OSVDB: 51343 Background Oracle Secure Backup is a centralized tape backup management solution for Oracle Database. Problem A command execution vulnerability in the Oracle Secure Backup web interface allows remote attackers to execute arbitrary...

CVE-2009-1391

Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS, SpamAssassin, and possibly other products, allows context-dependent attackers to cause a denial of service hang or crash via a crafted zlib compressed stream that triggers a...

DEBIAN-CVE-2009-1391

Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS, SpamAssassin, and possibly other products, allows context-dependent attackers to cause a denial of service hang or crash via a crafted zlib compressed stream that triggers a...

Heap overflow

Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS, SpamAssassin, and possibly other products, allows context-dependent attackers to cause a denial of service hang or crash via a crafted zlib compressed stream that triggers a...

CVE-2009-1391

Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS, SpamAssassin, and possibly other products, allows context-dependent attackers to cause a denial of service hang or crash via a crafted zlib compressed stream that triggers a...

CVE-2009-1391

Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS, SpamAssassin, and possibly other products, allows context-dependent attackers to cause a denial of service hang or crash via a crafted zlib compressed stream that triggers a...

CVE-2009-1391

CVE-2009-1391 affects Perl’s Compress-Raw-Zlib (base module in perl-Compress-Raw-Zlib) and related Compress-Raw-Bzip2, via an off-by-one in the inflate function (Zlib.xs) that can trigger a heap-based buffer overflow, causing DoS (hang/crash). The issue impacted Perl-based products using these mo...

VulnCheck KEV: CVE-2009-1391

Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS, SpamAssassin, and possibly other products, allows context-dependent attackers to cause a denial of service hang or crash via a crafted zlib compressed stream that triggers a...

'Compress::Raw::Zlib' Perl模块远程代码执行漏洞

Bugraq ID: 35307 CVE ID：CVE-2009-1391 CNCVE ID：CNCVE-20091391 Compress::Raw::Zlib是一款Zlib压缩库提供perl低级接口的模块。 Compress::Raw::Zlib inflate存在缓冲区溢出，远程攻击者可以利用漏洞使应用程序崩溃或以应用程序权限执行任意指令。 Zlib.xs中的"inflate"函数存在单字节错误，当处理特殊构建的压缩数据时存在堆缓冲区溢出，可导致perl进程关起或崩溃。 Compress::Raw::Zlib 2.015 Compress::Raw::Zlib 2.014 升级程序...

Compress::Raw::Zlib Perl Module - Remote Code Execution

source: https://www.securityfocus.com/bid/35307/info The 'Compress::Raw::Zlib' Perl module is prone to a remote code-execution vulnerability. Successful exploits may allow remote attackers to execute arbitrary code or cause denial-of-service conditions in applications that use the vulnerable...

CVE-2009-1341

Memory leak in the dequotebytea function in quote.c in the DBD::Pg aka DBD-Pg or libdbd-pg-perl module before 2.0.0 for Perl allows context-dependent attackers to cause a denial of service memory consumption by fetching data with BYTEA columns...

DEBIAN-CVE-2009-0663

Heap-based buffer overflow in the DBD::Pg aka DBD-Pg or libdbd-pg-perl module 1.49 for Perl might allow context-dependent attackers to execute arbitrary code via unspecified input to an application that uses the getline and pggetline functions to read database rows...

Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : net-snmp vulnerabilities (USN-685-1)

Wes Hardaker discovered that the SNMP service did not correctly validate HMAC authentication requests. An unauthenticated remote attacker could send specially crafted SNMPv3 traffic with a valid username and gain access to the user's views without a valid authentication passphrase. CVE-2008-0960...

Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : libarchive-tar-perl, perl vulnerabilities (USN-700-1)

Jonathan Smith discovered that the Archive::Tar Perl module did not correctly handle symlinks when extracting archives. If a user or automated system were tricked into opening a specially crafted tar file, a remote attacker could over-write arbitrary files. CVE-2007-4829 Tavis Ormandy and Will...

SQL injection

Added: 04/10/2009 Background Structured Query Language SQL is the most common language understood by modern relational databases. Problem A web program uses input parameters within an SQL query in an unsafe manner. This could allow a remote attacker to inject arbitrary SQL commands via a speciall...

Mandriva Update for perl-Net-DNS MDVSA-2008:073 (perl-Net-DNS)

Check for the Version of perl-Net-DNS OpenVAS Vulnerability Test Mandriva Update for perl-Net-DNS MDVSA-2008:073 perl-Net-DNS Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or...

Ubuntu Update for net-snmp vulnerabilities USN-685-1

Ubuntu Update for Linux kernel vulnerabilities USN-685-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN6851.nasl 7969 2017-12-01 09:23:16Z santu $ Ubuntu Update for net-snmp vulnerabilities USN-685-1 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH,...

Ubuntu Update for libnet-dns-perl vulnerabilities USN-483-1

Ubuntu Update for Linux kernel vulnerabilities USN-483-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN4831.nasl 7969 2017-12-01 09:23:16Z santu $ Ubuntu Update for libnet-dns-perl vulnerabilities USN-483-1 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH,...