Microsoft Windows SMB buffer overflow

Buffer overflow on SMB protocol parsing...

Microsoft Windows Malformed SMB Search Request Buffer Overflow (MS08-063; CVE-2008-4038)

The Server Message Block SMB Protocol is a network file sharing protocol that is implemented in Microsoft Windows. A remote code execution vulnerability has been reported in the way that Microsoft Server Message Block SMB Protocol handles specially crafted file names. The vulnerability is due to...

FreeBSD Ports: kdebase, kdelibs

The remote host is missing an update to the system as announced in the referenced advisory. VID 4593cb09-4c81-11d9-983e-000c6e8f12ef OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

Samba lsa_io_trans_names buffer overflow

Added: 12/24/2007 CVE: CVE-2007-2446 BID: 24195 OSVDB: 34699 Background Samba is a software package which implements the SMB protocol on a variety of platforms, providing compatibility with Windows systems. Problem A vulnerability in the LSA RPC interface allows a remote attacker to execute...

Samba NMBD登录请求远程溢出漏洞

BUGTRAQ ID: 26454 CVECAN ID: CVE-2007-4572 Samba是一套实现SMB（Server Messages Block）协议、跨平台进行文件共享和打印共享服务的程序。 Samba的nmbd在处理GETDC登录服务器请求时存在缓冲器溢出漏洞，可能导致非预期的服务器行为。 如果远程攻击者发送了畸形的GETDC请求的话就可以触发这个漏洞，但无法利用这个溢出执行任意指令，在大多数情况下也不会导致Samba服务器崩溃。仅在将Samba服务器配置为主或备份域控制器时才会出现这个漏洞。 Samba 3.0.0 - 3.0.26a 临时解决方法：...

SMB NULL Session Authentication

The remote host is running and SMB protocol. It is possible to log into the browser or spoolss pipes using a NULL session i.e., with no login or password. Depending on the configuration, it may be possible for an unauthenticated, remote attacker to leverage this issue to get information about the...

Moderate: elinks security update

0.9.2-3.3.5.2 - fix elinks-0.9.2-httpspostdata.patch 303881 0.9.2-3.3.5.1 - fix 297611 - CVE-2007-5034 elinks reveals POST data to HTTPS proxy 0.9.2-3.3 - fix 215731 - elinks smb protocol arbitrary file access...

iDefense Security Advisory 07.17.07: Computer Associates Alert Notification Server Multiple Buffer Overflow Vulnerabilities

Computer Associates Alert Notification Server Multiple Buffer Overflow Vulnerabilities iDefense Security Advisory 07.17.07 http://labs.idefense.com/intelligence/vulnerabilities/ Jul 17, 2007 I. BACKGROUND Computer Associates Alert Notification Server is used by several CA products, including eTru...

CA产品警告通知服务器远程栈溢出漏洞

CVECAN ID: CVE-2007-3825 警告通知服务器（alert.exe）是很多CA产品都在使用的服务，用于为控制台用户提供通知。 警告通知服务器所注册的RPC接口（GUID 3d742890-397c-11cf-9bf1-00805f88cb72）存在栈溢出漏洞。如果远程攻击者向该服务接口提交了超长的RPC请求的话，就可能触发这个溢出，导致以系统权限执行任意指令。 可使用SMB协议到达有漏洞的代码，因此在Windows XP及之后系统上必须有效的认证凭据，而Windows 2000无须认证。 Computer Associates BrightStor ARCserve...

Samba服务器VFS插件afsacl.so远程格式串处理漏洞

Samba是一套实现SMB（Server Messages Block）协议、跨平台进行文件共享和打印共享服务的程序。 Samba的VFS插件afsacl.so库在处理文件名时存在格式串漏洞，攻击者可能利用此漏洞诱使用户处理恶意的VFS分区控制服务器。 Samba在调用snprintf时将磁盘上所储存的文件名用作了格式串，如果用户能够写入的共享使用Samba的afsacl.so库对AFS文件系统上的文件设置Windows NT访问控制列表的话，就可能通过文件名中的格式串标识符导致执行任意代码。 这个漏洞仅影响与CIFS共享了AFS文件系统并在smb.conf中明确要求加载afsacl.s...

Samba过多共享连接请求拒绝服务漏洞

Samba是一套实现SMB（Server Messages Block）协议、跨平台进行文件共享和打印共享服务的程序。 Samba的实现上存在意外情况处理失败的问题，远程攻击者可能利用此漏洞对Samba服务器执行拒绝服务攻击。 smbd守护程序维护着追踪文件和打印共享活动连接的内部数据结构。在某些环境下如果向smbd守护程序发送了大量的共享连接请求的话，就会导致持续增加smbd进程的内存占用率，造成拒绝服务。 Samba Samba 3.0.1 - 3.0.22 Debian ------ Debian已经为此发布了一个安全公告（DSA-1110-1）以及相应补丁:...

Critical elinks security update

0.9.2-3.3 - fix 215731 - elinks smb protocol arbitrary file access...

RHEL 4 : elinks (RHSA-2006:0742)

An updated elinks package that corrects a security vulnerability is now available for Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. Elinks is a text mode Web browser used from the command line that supports renderi...

elinks security update

CentOS Errata and Security Advisory CESA-2006:0742 An updated elinks package that corrects a security vulnerability is now available for Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. Elinks is a text mode Web brows...

Critical: Red Hat Security Advisory: elinks security update

An updated elinks package that corrects a security vulnerability is now available for Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. Elinks is a text mode Web browser used from the command line that supports renderi...

Microsoft SRV.SYS Pipe Transaction No Null

This module exploits a NULL pointer dereference flaw in the SRV.SYS driver of the Windows operating system. This bug was independently discovered by CORE Security and ISS. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framewo...

MS06-030: Vulnerability in Server Message Block Could Allow Elevation of Privilege (914389)

The remote version of Windows contains a version of SMB Server Message Block protocol that is affected by several vulnerabilities. An attacker may exploit these flaws to elevate his privileges and gain control of the remote host. C Tenable Network Security, Inc. include"compat.inc"; if descriptio...

MS06-031: Vulnerability in RPC Mutual Authentication Could Allow Spoofing (917736)

The remote version of Windows contains a version of SMB Server Message Block protocol that is vulnerable to a spoofing attack. An attacker may exploit these flaws to enduce a user to connect to a malicious RPC server. Tenable Network Security, Inc. include"compat.inc"; if description scriptid2169...

Security Best Practice: Protection against CIFS Brute-Force Attacks

CIFS is an extension to the Message Block Server SMB protocol, a network protocol native to Windows systems which allows sharing of files and printers across a network. In recent years we have witnessed various worms attempting to compromise and spread through Windows machines with weak, default...

PT-2005-4056 · Ethereal +1 · Ethereal +1

Name of the Vulnerable Software and Affected Versions: Ethereal versions 0.10.12 and earlier Description: The issue allows remote attackers to cause a denial of service, resulting in a crash, via unknown vectors in the IrDA dissector and the SMB dissector when SMB transaction payload reassembly i...