pam_smb / pam_ntdom User Name Remote Overflow

The remote telnet server shuts the connection abruptly when given a long username followed by a password. Although Nessus could not be 100% positive, it may mean that the remote host is using an older pamsmb or pamntdom pluggable authentication module to validate user credentials against a NT...

[SECURITY] New version of libpam-smb released

Package: libpam-smb Vulnerability: remote root exploit Debian-specific: no libpam-smb contains a buffer overflow that can be used to execute arbitrary commands with root privilege. libpam-smb was not shipped with Debian 2.1 slink, but was included in Debian 2.2 potato. A fixed version of libpam-s...

[SECURITY] New version of libpam-smb released

------------------------------------------------------------------------ Debian Security Advisory [email protected] http://www.debian.org/security/ Michael Stone September 11, 2000 - ------------------------------------------------------------------------ Package: libpam-smb Vulnerability:...

Microsoft Windows 9x - File Handle Buffer Overflow

Microsoft Windows 9x - File Handle Buffer Overflow // source: https://www.securityfocus.com/bid/1796/info The file sharing SMB service in Windows enables client applications to access and modify files from a server on the network. The SMB service within Windows 95/98 allocates 0x4004 bytes to sto...

Microsoft Windows 9x - File Handle Buffer Overflow

// source: https://www.securityfocus.com/bid/1796/info The file sharing SMB service in Windows enables client applications to access and modify files from a server on the network. The SMB service within Windows 95/98 allocates 0x4004 bytes to store file handles. Therefore, a file handle returned ...

Microsoft Windows SMB Service Enumeration

This plugin implements the SvcOpenSCManager and SvcEnumServices calls to obtain, using the SMB protocol, the list of active and inactive services of the remote host. An attacker may use this feature to gain better knowledge of the remote host. C Tenable Network Security, Inc. include"compat.inc";...

DoS против протокола SMB (Server) в WinNT/Win2K

Специально сконструированные SMB-Пакеты например с некорректной длинной пакета приводят к отказу службы сервера, а в некоторых случаях к полному отказу стека TCP/IP...

anonymous SMB service DoS on nt5 (and TCP DoS on nt4)

been aware of a DoS attack against NT that i originally thought was SMB-related, for well over a year, now. source code has been available for this length of time, too. what you do is send SMB requests without reading the responses back. i originally thought that you had to send SMBtrans IPC$...

anonymous SMBwriteX DoS

a new concept had to be invented for this one: "the BSOD". a problem that causes an nt5 server's screen to go black. here is a harmless SMB request, prepared earlier from a netmon capture: SMB C write & X, FID = 0x1801, Write 0x73 at 0x00000000 SMB: C write & X, FID = 0x1801, Write 0x73 at...

CVE-1999-0225

CVE-1999-0225 affects Windows NT 4.0. The vulnerability arises in the SMB logon handling where the actual data size does not match the size specified, enabling remote DoS. Connected documents corroborate the same description without adding new technical specifics, affected component is SMB logon ...

CVE-1999-0225

Windows NT 4.0 allows remote attackers to cause a denial of service via a malformed SMB logon request in which the actual data size does not match the specified size...

Microsoft Windows SMB Registry : Key Permissions Path Subversion Local Privilege Escalation

Some SYSTEM registry keys can be written by non administrator. These keys contain paths to common programs and DLLs. If a user can change a path, then he may put a trojan program into another location say C:/temp and point to it. C Tenable Network Security, Inc. include"compat.inc"; if descriptio...

Microsoft Windows SMB Registry : Winlogon Key Permission Weakness

The registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon is writeable by users who are not in the admin group. This key contains a value which defines which program should be run when a user logs on. As this program runs in the SYSTEM context, the users who have the right to...

Microsoft Windows SMB Registry : Key Permission Weakness Admin Privilege Escalation

The following keys contain the name of the program that shall be started when the computer starts. The users who have the right to modify them can easily make the admin run a Trojan program that will give them admin privileges. C Tenable Network Security, Inc. include"compat.inc"; if description...

Microsoft Windows SMB Registry Not Fully Accessible Detection

Nessus did not access the remote registry completely, because full administrative rights are required. If you want the permissions / values of all the sensitive registry keys to be checked, we recommend that you complete the 'SMB Login' options in the 'Windows credentials' section of the policy...

Microsoft Windows SMB Registry : Winreg Registry Key Detection

The registry key HKLM\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg is missing. This key allows you to define what can be viewed in the registry by non administrators. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10431; scriptversion"$Revision: 1.31 $";...

Microsoft Windows SMB Registry : Schedule Key Permission Weakness Local Privilege Escalation

The registry key SYSTEM\CurrentControlSet\Services\Schedule is writeable by users who are not in the admin group. Since the scheduler runs with SYSTEM privileges, this allow a malicious user to gain these privileges on this system. C Tenable Network Security, Inc. include"compat.inc"; if...

Microsoft Windows SMB Guessable User Credentials

This script attempts to log into the remote host using several login / password combinations. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10404; scriptversion"1.63"; scriptsetattributeattribute:"pluginmodificationdate", value:"2020/04/27";...

Microsoft Windows SMB LanMan Pipe Server Listing Disclosure

It was possible to obtain the browse list of the remote Windows system by sending a request to the LANMAN pipe. The browse list is the list of the nearest Windows systems of the remote host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10397; scriptversion"1.42";...

Microsoft Windows SMB LsaQueryInformationPolicy Function NULL Session Domain SID Enumeration

By making or emulating a call to LsaQueryInformationPolicy, it was possible to obtain the domain SID Security Identifier. The domain SID can then be used to get the list of users of the domain. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10398; scriptversion"1.59"...