[Full-Disclosure] iDEFENSE Security Advisory 11.08.04: Samba SMBD Remote Denial of Service Vulnerability

Samba SMBD Remote Denial of Service Vulnerability iDEFENSE Security Advisory 11.08.04 www.idefense.com/application/poi/display?id=156&type=vulnerabilities November 08, 2004 I. BACKGROUND Samba is an Open Source/Free Software suite that provides seamless file and print services to SMB/CIFS clients...

[SECURITY] [DSA 580-1] New iptables packages fix modprobe failure

-------------------------------------------------------------------------- Debian Security Advisory DSA 580-1 [email protected] http://www.debian.org/security/ Martin Schulze November 1st, 2004 http://www.debian.org/security/faq -...

[SECURITY] [DSA 580-1] New iptables packages fix modprobe failure

-------------------------------------------------------------------------- Debian Security Advisory DSA 580-1 [email protected] http://www.debian.org/security/ Martin Schulze November 1st, 2004 http://www.debian.org/security/faq -...

DSA-580-1 iptables - missing initialisation

Bulletin has no description...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS. The asn1bufskiptail function in the ASN.1 decoder library for MIT Kerberos 5 krb5 1.2.2 through 1.3.4 allows remote attackers to cause a denial of service infinite loop via a certain BER encoding. Remediation Ther...

CVE-2004-0593

Sygate Enforcer 3.5MR1 and earlier passes broadcast traffic before authentication, which could allow remote attackers to bypass filtering rules...

Apache < 2.0.51 mod_ssl Rewrite Rules DoS

Binary data 2276.prm...

GLSA-200406-21 : mit-krb5: Multiple buffer overflows in krb5_aname_to_localname

The remote host is affected by the vulnerability described in GLSA-200406-21 mit-krb5: Multiple buffer overflows in krb5anametolocalname The library function krb5anametolocalname contains multiple buffer overflows. This is only exploitable if explicit mapping or rules-based mapping is enabled...

CVE-2004-0593

CVE-2004-0593 concerns Sygate Enforcer 3.5MR1 and earlier, where the appliance passes broadcast traffic before authentication, enabling remote attackers to bypass filtering rules. The issue affects the Enforcer’s capability to enforce policy prior to authentication, potentially exposing protected...

Remote DoS vulnerability in Linux kernel 2.6.x

Overview ----------- There is a remotely exploitable bug in all Linux kernel 2.6 series due to using incorrect variable type. Vulnerability is connected to netfilter subsystem and may cause DoS. It's disclosed only when using iptables with rules matching TCP options i.e. --tcp-option. There is...

mit-krb5: Multiple buffer overflows in krb5_aname_to_localname

Background mit-krb5 is the free implementation of the Kerberos network authentication protocol by the Massachusetts Institute of Technology. Description The library function krb5anametolocalname contains multiple buffer overflows. This is only exploitable if explicit mapping or rules-based mappin...

Web Wiz Forums 7.x - Registration_Rules.asp Cross-Site Scripting

Web Wiz Forums 7.x - RegistrationRules.asp Cross-Site Scripting source: https://www.securityfocus.com/bid/10555/info A vulnerability exists in the Web Wiz Forums software that may allow a remote user to launch cross-site scripting attacks. The problem is reported to exist due to improper sanitizi...

Web Wiz Forums 7.x - 'Registration_Rules.asp' Cross-Site Scripting

source: https://www.securityfocus.com/bid/10555/info A vulnerability exists in the Web Wiz Forums software that may allow a remote user to launch cross-site scripting attacks. The problem is reported to exist due to improper sanitizing of user-supplied data passed to the 'registrationrules.asp'...

CVE-2003-0974

Applied Watch Command Center allows remote attackers to conduct unauthorized activities without authentication, such as 1 add new users to a console, as demonstrated using appliedsnatch.c, or 2 add spurious IDS rules to sensors, as demonstrated using addrule.c...

CVE-2003-0974

Applied Watch Command Center allows remote attackers to conduct unauthorized activities without authentication, such as 1 add new users to a console, as demonstrated using appliedsnatch.c, or 2 add spurious IDS rules to sensors, as demonstrated using addrule.c...

CVE-2003-0974: Undefined Security Weakness

Applied Watch Command Center allows remote attackers to conduct unauthorized activities without authentication, such as 1 add new users to a console, as demonstrated using appliedsnatch.c, or 2 add spurious IDS rules to sensors, as demonstrated using addrule.c...

Applied Watch protection bypass

It's possible to add new users or IDS rules without authentication...

CVE-2003-1183

The WebCache component in Oracle Files 9.0.3.1.0, 9.0.3.2.0, and 9.0.3.3.0 of Oracle Collaboration Suite Release 1 caches files despite the cacheability rules imposed by Oracle Files, which allows local users to gain access...

CVE-2003-0658

Docview before 1.1-18 in Caldera OpenLinux 3.1.1, SCO Linux 4.0, OpenServer 5.0.7, configures the Apache web server in a way that allows remote attackers to read arbitrary publicly readable files via a certain URL, possibly related to rewrite rules...

TCP/IP SYN+FIN Packet Filtering Weakness

The remote host does not discard TCP SYN packets that have the FIN flag set. Depending on the kind of firewall you are using, an attacker may use this flaw to bypass its rules. C Tenable Network Security, Inc. Ref: To: [email protected] From: [email protected] Date: Mon, 5 May 2003 11:01:0...