Multiple OS /bin/login Remote Overflow

The remote implementation of the /bin/login utility, used when authenticating a user via telnet or rsh contains an overflow which allows an attacker to gain a shell on this host, without even sending a shell code. An attacker may use this flaw to log in as any user except root on the remote host....

Web Server HTTP 1.1 Header Remote Overflow

It was possible to kill the web server by sending an invalid request with a too long HTTP 1.1 header Accept-Encoding, Accept-Language, Accept-Range, Connection, Expect, If-Match, If-None-Match, If-Range, If-Unmodified-Since, Max-Forwards, TE, Host. This vulnerability could be exploited to crash t...

Web Server HTTP 1.0 Header Remote Overflow

It was possible to kill the web server by sending an invalid request with a too long HTTP 1.0 header From, If-Modified-Since, Referer or Content-Type. This vulnerability could be exploited to crash the web server. It might even be possible to execute arbitrary code on your system. As this is a...

Sambar Server Multiple CGI Remote Overflow

It is possible to kill the Sambar web server 'server.exe' by sending it a long request like: /cgi-win/testcgi.exe?XXXX...X /cgi-win/cgitest.exe?XXXX...X /cgi-win/Pbcgi.exe?XXXXX...X or maybe in /cgi-bin/ An attacker may use this flaw to cause the server to crash continuously. %NASLMINLEVEL 70300 ...

MS02-045: Microsoft Windows SMB Protocol SMB_COM_TRANSACTION Packet Remote Overflow DoS (326830) (uncredentialed check)

The remote host is vulnerable to a denial of service attack in its SMB stack. An attacker may exploit this flaw to crash the remote host remotely, without any authentication. C Tenable Network Security, Inc. This script was written by Renaud Deraison Thanks to Ivan Arce who provided me with all t...

WS_FTP Server SITE CPWD Command Remote Overflow

This host is running a version of WSFTP FTP server prior to 3.1.2. Versions earlier than 3.1.2 contain an unchecked buffer in routines that handle the 'CPWD' command arguments. The 'CPWD' command allows remote users to change their password. By issuing a malformed argument to the CPWD command, a...

Web Server HTTP Header Handling Remote Overflow

It was possible to kill the web server by sending an invalid request with a long header name or value. A remote attacker may exploit this vulnerability to make the web server crash continually or even execute arbitrary code. C Tenable Network Security, Inc. include"compat.inc"; if description...

Web Server HTTP Method Handling Remote Overflow

It was possible to kill the web server by sending an invalid request with a long HTTP method field. A remote attacker may exploit this vulnerability to make the web server crash continually or possibly execute arbitrary code. C Tenable Network Security, Inc. Script audit and contributions from...

wwwoffle-2.7b and prior segfaults with negative Content-Length value

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 QITEST1 SECURITY ADVISORY 005 wwwoffle-2.7b and prior segfaults with negative Content-Length value PROGRAM DESCRIPTION WWWOFFLE, World Wide Web Offline Explorer, is a proxy HTTP/FTP server for computers with dial-up internet access. DETAILS When...

WU-IMAP 2000.287(1-2) - Remote Overflow

/ 7350owex- x86/linux WU-IMAP 2000.2871-2 remote exploit TESO CONFIDENTIAL - SOURCE MATERIALS This is unpublished proprietary source code of TESO Security. The contents of these coded instructions, statements and computer programs may not be disclosed to third parties, copied or duplicated in any...

Apache Chunked Encoding Remote Overflow

The remote Apache web server is affected by the Apache web server chunk handling vulnerability. If safe checks are enabled, this may be a false positive since it is based on the version of Apache. Although unpatched Apache versions 1.2.2 and above, 1.3 through 1.3.24, and 2.0 through 2.0.36 are...

IRIX rpc.yppasswdd Unspecified Remote Overflow

The remote RPC service 100009 yppasswdd is vulnerable to a buffer overflow which allows any user to obtain a root shell on this host. Note: This issue is different than the one described in CVE-2002-0357 / SGI advisory 20020601-01-P. C Tenable Network Security, Inc. This is NOT the issue describe...

Cisco NTP ntpd readvar Variable Remote Overflow (CSCdt93866)

By sending a crafted NTP control packet, it is possible to trigger a buffer overflow in the NTP daemon. This vulnerability can be exploited remotely. The successful exploitation may cause arbitrary code to be executed on the target machine. This vulnerability is documented as Cisco Bug ID...

SRT Security Advisory (SRT2002-04-31-1159): Mnews

====================================================================== Strategic Reconnaissance Team Security Advisory SRT2002-04-31-1159 Topic : Mnews local and remote overflow vulnerabilities Date : May 31, 2002 Credit : zillionatsafemode.org Site : http://www.snosoft.com...

University of Washington imap Server (uw-imapd) BODY Request Remote Overflow

The remote version of UW-IMAP is vulnerable to a buffer overflow condition that could allow an authenticated attacker to execute arbitrary code on the remote host with the privileges of the IMAP server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

ISC BIND < 4.9.7 / 8.1.2 Inverse-Query Remote Overflow

The remote BIND server, according to its version number, is vulnerable to an inverse query overflow which could allow an attacker to execute arbitrary code on the remote host. C Tenable Network Security, Inc. This script replaces bindbof.nes include"compat.inc"; if description scriptid10329;...

EFTP .lnk File Handling Remote Overflow

The version of EFTP running on the remote host has a remote buffer overflow vulnerability. Issuing the LS command on a maliciously crafted .lnk file results in an overflow. A remote attacker could exploit this to crash the service, or possibly execute arbitrary code. C Tenable Network Security,...

sniffit-exp1.txt

/ Remote overflow in sniffit.0.3.7.beta tested on slackware 7.1 found/coded by g463 -18th january 2002- The vulnerability is triggered when the option -L is called from the command line with 'normmail' ie : ./sniffit -c ./sampleconfigfile -L normmail It calls a piece of code where the buffer is...

SysV /bin/login Environment Remote Overflow (telnet check)

The remote /bin/login seems to crash when it receives too many environment variables. This is likely due to a buffer overflow vulnerability which might allow an attacker to execute arbitrary code on the remote host. C Tenable Network Security, Inc. Sun's patch makes /bin/login exits when it...

WebLogic Server Double Dot GET Request Remote Overflow

Requesting an overly long URL starting with a double dot can crash certain versions of WebLogic servers or possibly even allow for arbitrary code execution. %NASLMINLEVEL 70300 This script was written by Vincent Renardias Licence : GPL v2 Changes by Tenable: - Revised plugin title 4/13/2009 - Add...