grip -- CDDB response multiple matches buffer overflow vulnerability

Joseph VanAndel reports that grip is vulnerability to a buffer overflow vulnerability when receiving more than 16 CDDB responses. This could lead to a crash in grip and potentially execution arbitrary code. A workaround is to disable CDDB lookups...

CVE-2003-0688

The DNS map code in Sendmail 8.12.8 and earlier, when using the "enhdnsbl" feature, does not properly initialize certain data structures, which allows remote attackers to cause a denial of service process crash via an invalid DNS response that causes Sendmail to free incorrect data...

DEBIAN-CVE-2003-0685

Buffer overflow in Netris 0.52 and earlier, and possibly other versions, allows remote malicious Netris servers to execute arbitrary code on netris clients via a long server response...

CVE-2002-0714

FTP proxy in Squid before 2.4.STABLE6 does not compare the IP addresses of control and data connections with the FTP server, which allows remote attackers to bypass firewall rules or spoof FTP server responses...

CVE-2002-0758

CVE-2002-0758 affects SuSE 8.0 where the ifup-dhcp script in the sysconfig package may process spoofed DHCP responses, allowing remote attackers to cause arbitrary commands to be stored and executed. The underlying issue is the handling of DHCP data by the script, leading to code execution on the...

CVE-2002-0163

Vulnerability: Squid earlier than 2.4 STABLE4 and some 2.5/2.6 builds were exposed to a heap-based buffer overflow in the internal DNS code when handling compressed DNS responses, caused by improper bounds/checks in lib/rfc1035.c. Impact per sources: potential denial of service and possible remot...

CVE-2002-0758

ifup-dhcp script in the sysconfig package for SuSE 8.0 allows remote attackers to execute arbitrary commands via spoofed DHCP responses, which are stored and executed in a file...

Incorrect NXDOMAIN responses from AAAA queries could cause denial-of-service conditions

Overview Some DNS servers respond with an inappropriate error message if queried for nonexistent AAAA records, which can lead to possible denial of service. Description Some DNS servers respond with a "Name Error" response code NXDOMAIN, RCODE 3 instead of "No Error" RCODE 0 when queried for a...

CVE-2002-2211

BIND 4 and BIND 8, when resolving recursive DNS queries for arbitrary hosts, allows remote attackers to conduct DNS cache poisoning via a birthday attack that uses a large number of open queries for the same resource record RR combined with spoofed responses, which increases the possibility of...

CVE-2002-2212

The DNS resolver in unspecified versions of Fujitsu UXP/V, when resolving recursive DNS queries for arbitrary hosts, allows remote attackers to conduct DNS cache poisoning via a birthday attack that uses a large number of open queries for the same resource record RR combined with spoofed response...

CVE-2002-2213

The DNS resolver in unspecified versions of Infoblox DNS One, when resolving recursive DNS queries for arbitrary hosts, allows remote attackers to conduct DNS cache poisoning via a birthday attack that uses a large number of open queries for the same resource record RR combined with spoofed...

CVE-2002-1364

Buffer overflow in the getorigin function in traceroute-nanog allows attackers to execute arbitrary code via long WHOIS responses...

CVE-2002-1219

Buffer overflow in named in BIND 4 versions 4.9.10 and earlier, and 8 versions 8.3.3 and earlier, allows remote attackers to execute arbitrary code via a certain DNS server response containing SIG resource records RR...

[SECURITY] [DSA 169-1] New ht://Check packages fix cross site scripting problem

-------------------------------------------------------------------------- Debian Security Advisory DSA 169-1 [email protected] http://www.debian.org/security/ Martin Schulze September 25th, 2002 http://www.debian.org/security/faq -...

Microsoft IIS 5.0 - IDC Extension Cross-Site Scripting

Microsoft IIS 5.0 - IDC Extension Cross-Site Scripting source: https://www.securityfocus.com/bid/5900/info A vulnerability in Microsoft Internet Information Server IIS may make cross-site scripting attacks possible. When IIS receives a request for an .idc file, the server typically returns a 404...

CVE-2002-1090

Buffer overflow in readsmtpresponse of protocol.c in libesmtp before 0.8.11 allows a remote SMTP server to 1 execute arbitrary code via a certain response or 2 cause a denial of service via long server responses...

CVE-2002-0525

Format string vulnerabilities in 1 inews or 2 rnews for INN 2.2.3 and earlier allow local users and remote malicious NNTP servers to gain privileges via format string specifiers in NTTP responses...

CVE-2002-0758

ifup-dhcp script in the sysconfig package for SuSE 8.0 allows remote attackers to execute arbitrary commands via spoofed DHCP responses, which are stored and executed in a file...

CVE-2002-0702

Format string vulnerabilities in the logging routines for dynamic DNS code print.c of ISC DHCP daemon DHCPD 3 to 3.0.1rc8, with the NSUPDATE option enabled, allow remote malicious DNS servers to execute arbitrary code via format strings in a DNS server response...

Apache Tomcat 3.2.3/3.2.4 - Example Files Web Root Full Path Disclosure

source: https://www.securityfocus.com/bid/4877/info Apache Tomcat is a freely available, open source web server maintained by the Apache Foundation. When Apache Tomcat is installed with a default configuration, several example files are also installed. When some of these example files are request...