more RADIUS authentication attack scenarios

Hello bugtraq, There is also problem with some vendor-specific RADIUS authentication implementation. For example Microsoft has it's specific attributes defined in RFC 2548. These attributes allow MS-CHAP and MS-CHAPv2 authentication via RADIUS. There is design flow in this authentication scenario...

CVE-2001-1473

The SSH-1 protocol allows remote servers to conduct man-in-the-middle attacks and replay a client challenge response to a target server by creating a Session ID that matches the Session ID of the target, but which uses a public key pair that is weaker than the target's public key, which allows th...

Passwords sent via SSH encrypted with RC4 can be easily cracked

Overview Passwords sent using SSH with RC4 encryption can be easily cracked by an attacker who is able to capture and replay the session. This problem occurs for three reasons: SSH sessions can be replayed, the RC4 encryption algorithm has some specific weaknesses, and the SSH daemon provides too...

SSH connections using RC4 and password authentication can be replayed

Overview This vulnerability may allow an attacker to replay a captured SSH1 session. Description Preconditions: Client requests RC4 and the server grants request Client uses password authentication When an SSH1 session using the RC4 cipher is established, the client and server agree upon a sessio...

@stake Advisory: NTLM Replaying via Windows 2000 Telnet Client (A 091400-1)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I wish this could have gone out sooner but there was an issue with the initial Microsoft patch which we found during our testing. They subsequently decided to fix the patch which delayed things a bit. We feel that if a vendor is taking an issue...

CVE-2000-0205

Trend Micro OfficeScan allows remote attackers to replay administrative commands and modify the configuration of OfficeScan clients...

CVE-1999-0443

Technical details about CVE-1999-0443 are not publicly available in the provided documents. No vendor/affected product or remediation information is specified. Monitor for updates.

CVE-1999-0443

Patrol management software allows a remote attacker to conduct a replay attack to steal the administrator password...

EUVD-1999-0391

The cryptographic challenge of SMB authentication in Windows 95 and Windows 98 can be reused, allowing an attacker to replay the response and impersonate a user...

CVE-1999-0391

The cryptographic challenge of SMB authentication in Windows 95 and Windows 98 can be reused, allowing an attacker to replay the response and impersonate a user...

CVE-1999-0391

CVE-1999-0391 involves the reuse of the SMB authentication cryptographic challenge in Windows 95/Windows 98, enabling an attacker to replay the response and impersonate a user. Affected software is Windows 95 and Windows 98; the vulnerability lies in the SMB authentication verification (cryptogra...

95replay.txt

L0pht Security Advisory Advisory released Jan. 5, 1999 Application: Windows 95/98 Network File Sharing Severity: Sniffed authentications can be used to impersonate network users Author: [email protected] http://www.l0pht.com/advisories.html Overview : Windows 95/98 network file sharing reuses the...

CVE-1999-0443

Patrol management software allows a remote attacker to conduct a replay attack to steal the administrator password...

CVE-1999-0391

The cryptographic challenge of SMB authentication in Windows 95 and Windows 98 can be reused, allowing an attacker to replay the response and impersonate a user...

PT-1999-1077 · Microsoft · Windows 98 +1

Name of the Vulnerable Software and Affected Versions: Windows 95 and Windows 98 Description: The issue concerns the cryptographic challenge of SMB authentication, which can be reused. This allows an attacker to replay the response and impersonate a user. Recommendations: For Windows 95 and Windo...

Kerio Personal Firewall Replay Attack and Buffer Overflow

Advisory ID Internal CORE-2003-0305-02 Bugtraq ID: 7179, 7180 CVE Names: CAN-2003-0219, CAN-2003-0220 Title: Kerio Personal Firewall Replay Attack and Buffer Overflow Class: Design Error; Boundary Error Condition Buffer Overflow Remotely Exploitable: Yes Locally Exploitable: Yes Vendors contacted...

CVE-2023-34255

Removed by vendor...

CVE-2026-45074: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay

More info at https://symfony.com/cve-2026-45074...

CVE-2026-45074: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay

More info at https://symfony.com/cve-2026-45074...