HP StorageWorks - NSI Double Take Remote Overflow (Metasploit)

$Id: doubletake.rb 4529 2007-03-23 01:08:18Z $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/projects/Framework/...

Trillian多个远程溢出漏洞

BUGTRAQ ID: 29330 Trillian是一个聊天程序，和多种即时通讯程序使用相同的接口，包括AIM、ICQ、Yahoo! Messenger、MSN Messenger和IRC。 Trillian中负责解析MSN协议头的代码中存在栈溢出漏洞，在处理X-MMS-IM-FORMAT头时，有漏洞的代码未经长度检查便将某些属性直接拷贝到了栈上的缓冲区；Trillian在解析FONT标签中带有超长属性值的消息时，sprintf函数将属性的值直接拷贝到了栈缓冲区上；Trillian的talk.dll在解析XML时没有正确的处理IMG标签中的畸形属性，可能导致覆盖过所分配的堆块。...

TFTP Server for Windows 1.4 - ST Remote BSS Overflow

TFTP Server for Windows 1.4 - ST Remote BSS Overflow !/usr/bin/perl TFTPServer SP v1.4 for Windows remote .bss overflow exploit The Service or the RunStandAlone version. URL: http://sourceforge.net/projects/tftp-server/ Author: tix or tixxDZ Date: 07/05/2008 Tested on Windows XP SP2 French not...

BigAnt Server 2.2 - Remote Overflow (SEH)

BigAnt Server 2.2 - Remote Overflow SEH !/usr/bin/python BigAnt Server Ver 2.2 PreAuth Remote SEH Overflow 0day Matteo Memelli aka ryujin www.be4mind.com - www.gray-world.net 04/13/2008 Tested on Windows 2000 Sp4 English Vulnerable process is AntServer.exe Offset for SEH overwrite is 954 Bytes...

TIBCO Rendezvous < 8.0.1 Remote Overflow

Binary data 4462.prm...

HP OpenView Network Node Manager (OV NNM) 7.5.1 - ovalarmsrv.exe Remote Overflow

HP OpenView Network Node Manager OV NNM 7.5.1 - ovalarmsrv.exe Remote Overflow / Dreatica-FXP crew ---------------------------------------- Target : HP OpenView Network Node Manager v7.5 ---------------------------------------- Exploit : HP OpenView NNM v7.5.1 ovalarmsrv.exe Remote Buffer Overflo...

Python stringobject.c多个远程溢出漏洞

BUGTRAQ ID: 28749 Python是一种开放源代码的脚本编程语言。 Python的核心API提供了多个用于分配字符串对象的函数，其中一个API调用允许分配或重新分配PyStringObject，这个函数为PyStringFromStringAndSize，该函数获取了两个参数，分别为一个指针和一个有符整数。如果指针非空的话，就会将指向该指针的内存重新分配为第二个参数所指定的大小；如果指针为空，就会分配整数所指定的字节数并返回。 在这个操作期间，没有验证第二个参数是否为负数，而该值与PyStringObject的大小相加并用作了分配函数的长度，可能导致错误的内存分配。...

Apache Tomcat Connector jk2-2.0.2 (mod_jk2) Remote Overflow Exploit

No description provided by source. / Fedora Core 6,7,8 exec-shield based Apache Tomcat Connector jk2-2.0.2modjk2 remote overflow exploit by INetCop Security Advanced exploitation in exec-shield Fedora Core case study URL: http://www.milw0rm.com/papers/151 IOActive Security Advisory:...

Apache Tomcat Connector jk2-2.0.2 mod_jk2 - Remote Overflow

/ Fedora Core 6,7,8 exec-shield based Apache Tomcat Connector jk2-2.0.2modjk2 remote overflow exploit by INetCop Security Advanced exploitation in exec-shield Fedora Core case study URL: http://www.milw0rm.com/papers/151 IOActive Security Advisory: http://www.securityfocus.com/archive/1/487983...

Apache Tomcat Connector jk2-2.0.2 mod_jk2 - Remote Overflow

Apache Tomcat Connector jk2-2.0.2 modjk2 - Remote Overflow / Fedora Core 6,7,8 exec-shield based Apache Tomcat Connector jk2-2.0.2modjk2 remote overflow exploit by INetCop Security Advanced exploitation in exec-shield Fedora Core case study URL: http://www.milw0rm.com/papers/151 IOActive Security...

Apache Tomcat Connector jk2-2.0.2 (mod_jk2) Remote Overflow Exploit

Exploit for linux platform in category remote exploits =================================================================== Apache Tomcat Connector jk2-2.0.2 modjk2 Remote Overflow Exploit =================================================================== / Fedora Core 6,7,8 exec-shield based...

Quick TFTP Server Pro 2.1 - Remote Overflow (SEH)

Quick TFTP Server Pro 2.1 - Remote Overflow SEH !/usr/bin/python Quick TFTP Pro 2.1 SEH Overflow 0day Tested on Windows XP SP2. Coded by Mati Aharoni muts..at..offensive-security.com http://www.offensive-security.com/0day/quick-tftp-poc.py.txt bt quickftp.py Quick TFTP Pro 2.1 SEH Overflow 0day...

NetWin SurgeMail <= 3.8k4-4 IMAP LIST Command Remote Overflow

Binary data 4431.prm...

IBM Informix Dynamic Server多个远程溢出漏洞

BUGTRAQ ID: 28198 CVECAN ID: CVE-2008-0727,CVE-2008-0949 IBM Informix Dynamic Server为企业提供运行业务所需的任务关键型数据基础设施。 Informix Dynamic Server默认监听于TCP 1526端口的oninit.exe进程在认证期间没有验证DBPATH变量和用户口令的长度，如果用户提供了超长的变量名或口令的话，就可以触发缓冲区溢出，导致执行任意指令。 IBM Informix Dynamic Server 9.x IBM Informix Dynamic Server 7.x IBM...

Borland StarTeam多个远程溢出及拒绝服务漏洞

BUGTRAQ ID: 28080 Borland Starteam是Borland公司ALM生命周期管理的核心工具，是目前市面上最好的软件配置管理工具之一。 Starteam服务器没有正确地计算为从客户端所接收到的某些数组所需分配的内存数，导致多个整数溢出漏洞。在PROJECTLOGIN和SETSERVERACL命令中，有32位从客户端所接收到的用于指定报文中条目数量的数字分别被乘以8（或4，具体取决于文件名名称或规范）和12，然后未经考虑32位的限制便将结果用于分配内存，这可能触发堆溢出，允许攻击者控制某些寄存器，导致执行恶意指令。但攻击者必须拥有有效帐号才能利用这些漏洞。...

Livebox TP路由器远程溢出拒绝服务漏洞

BUGTRAQ ID: 28066 Livebox TP是在波兰广泛使用的宽带路由器。 Livebox TP在处理畸形用户请求时存在输入验证漏洞，远程攻击者可能利用此漏洞控制服务器。 Livebox TP中所内嵌的ADI Convergence Galaxy FTP服务器没有正确地验证用户输入参数，如果远程攻击者向路由器的FTP服务发送了特制报文的话，就可能触发缓冲区溢出，导致服务崩溃。 Neostrada Livebox TP 厂商补丁： Neostrada --------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

SurgeMail CGI可执行程序远程溢出漏洞

BUGTRAQ ID: 27992 SurgeMail是下一代的邮件服务器，可运行在Windows NT/2K或UNIX平台上，支持所有的标准IMAP、POP3、SMTP、SSL和ESMTP协议。 SurgeMail中用于处理CGI可执行程序的函数中存在缓冲区溢出漏洞，远程攻击者可能利用此漏洞控制服务器。...

D-Link MPEG4 SHM Audio Control (VAPGDecoder.dll 1.7.0.5) BOF Exploit

Exploit for unknown platform in category remote exploits ==================================================================== D-Link MPEG4 SHM Audio Control VAPGDecoder.dll 1.7.0.5 BOF Exploit ==================================================================== //add su one, user: sun pass: tzu...

dlink-overflow.txt

//add su one, user: sun pass: tzu shellcode = unescape"%u03eb%ueb59%ue805%ufff8%uffff%u4949%u3749%u4949" + "%u4949%u4949%u4949%u4949%u4949%u4949%u5a51%u456a" + "%u5058%u4230%u4231%u6b41%u4141%u3255%u4241%u3241" + "%u4142%u4230%u5841%u3850%u4241%u6d75%u6b39%u494c" +...

Adobe Flash Media Server多个远程溢出漏洞

BUGTRAQ ID: 27762 CVECAN ID: CVE-2007-6149,CVE-2007-6148,CVE-2007-6431 Adobe Flash Media Server是基于Flash应用程序的服务器，可提供运行交互式应用及音频视频流的环境。 Flash Media Server包含有名为Edge Server的组件，该组件在TCP 1935和19350端口监听入站连接。Edge...