Microsoft Windows - NetpIsRemote() Remote Overflow (MS06-040) (Metasploit)

Microsoft Windows - NetpIsRemote Remote Overflow MS06-040 Metasploit This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same license as the cor...

CVE-2006-3648: Undefined Security Weakness

Unspecified vulnerability in Microsoft Windows 2000 SP4, XP SP1 and SP2, Server 2003 and 2003 SP1, allows remote attackers to execute arbitrary code via unspecified vectors involving unhandled exceptions, memory resident applications, and incorrectly "unloading chained exception."...

CVE-2006-3441: Undefined Security Weakness

Buffer overflow in the DNS Client service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted record response. NOTE: while MS06-041 implies that there is a single issue, there are multiple vectors, and likely multiple...

CVE-2006-3439: Undefined Security Weakness

Buffer overflow in the Server Service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers, including anonymous users, to execute arbitrary code via a crafted RPC message, a different vulnerability than CVE-2006-1314...

CVE-2006-3649: Undefined Security Weakness

Buffer overflow in Microsoft Visual Basic for Applications VBA SDK 6.0 through 6.4, as used by Microsoft Office 2000 SP3, Office XP SP3, Project 2000 SR1, Project 2002 SP1, Access 2000 Runtime SP3, Visio 2002 SP2, and Works Suite 2004 through 2006, allows user-assisted attackers to execute...

CVE-2006-3440: Undefined Security Weakness

Buffer overflow in the Winsock API in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers to execute arbitrary code via unknown vectors, aka "Winsock Hostname Vulnerability."...

[Full-disclosure] 0-day XP SP2 wmf exploit (some details)

There is some details for wannabees : 1. 'Bad' wmf record: 07 00 00 00 length of record in words FC 02 type CreateBrushIndirect 08 00 00 00 00 00 00 80 'packed' good old Win16 days LOGBRUSH data: 08 00 - 'packed' lpStyle may be BSDIBPATTERNPT 6 or BSDIBPATTERN8X8 8 00 00 00 00 - COLORREF any 00 8...

[Full-disclosure] 0-day XP SP2 wmf exploit

Description: yet another 'windows meta file' WMF denial of service exploit. System affected: + Windows XP SP2, + Windows 2003 SP1, + Windows XP SP1, + Windows XP + Windows 2003 Tech info: page fault in gdi32!CreateBrushIndirect because invalid pointer access. Incorrect short to void sign extensio...

gdiplus.pl.txt

!/bin/perl 0-day crash poc gdiplus.dll by Mr.Niega Check out hex offset 2e play with the 2byte's, set it to 20 if you want a non crashing ico file Division by zero this POC tested with: win XP ENG sp2 And for SYS 49152 im that 0daysec guy ; Rename Poc.ico to Poc.png and have it as display picture...

Gdiplus.dll division by 0

!/bin/perl 0-day crash poc gdiplus.dll by Mr.Niega Check out hex offset 2e play with the 2byte's, set it to 20 if you want a non crashing ico file Division by zero this POC tested with: win XP ENG sp2 And for SYS 49152 im that 0daysec guy ; Rename Poc.ico to Poc.png and have it as display picture...

CVE-2006-3945

The CSS functionality in Opera 9 on Windows XP SP2 allows remote attackers to cause a denial of service crash by setting the background property of a DHTML element to a long http or https URL, which triggers memory corruption...

CVE-2006-3944

Microsoft Internet Explorer 6 on Windows XP SP2 is affected by CVE-2006-3944. The vulnerability concerns the Forms.ListBox.1 object, where the ListWidth property set to 0x7fffffff can trigger an integer overflow, and set to 0x7ffffffe can cause a null dereference, leading to a denial of service (...

CVE-2006-3943: Undefined Security Weakness

Stack-based buffer overflow in NDFXArtEffects in Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service crash via long 1 RGBExtraColor, 2 RGBForeColor, and 3 RGBBackColor properties...

CVE-2006-3945: Out-of-bounds Write

The CSS functionality in Opera 9 on Windows XP SP2 allows remote attackers to cause a denial of service crash by setting the background property of a DHTML element to a long http or https URL, which triggers memory corruption...

CVE-2006-3944: Undefined Security Weakness

Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service crash via a 1 Forms.ListBox.1 or 2 Forms.ListBox.1 object with the ListWidth property set to a 0x7fffffff, which triggers an integer overflow exception, or to b 0x7ffffffe, which triggers a null...

Microsoft PowerPoint 2003 SP2 Local Code Execution Exploit (french)

No description provided by source. / 30.07.2006 NSRocket presents Microsoft PowerPoint 2003 SP2 updated french version exploit tested on WinXP SP2 Microsoft PowerPoint is prone to a remote code execution issue which may be triggered when a malformed PPT file is closed. Code execution is possib...

Microsoft PowerPoint 2003 SP2 (French) - Local Code Execution

/ 30.07.2006 NSRocket presents Microsoft PowerPoint 2003 SP2 updated french version exploit tested on WinXP SP2 Microsoft PowerPoint is prone to a remote code execution issue which may be triggered when a malformed PPT file is closed. Code execution is possible only if these conditions are...

CVE-2006-3910: Undefined Security Weakness

Internet Explorer 6 on Windows XP SP2, when Outlook is installed, allows remote attackers to cause a denial of service crash by calling the NewDefaultItem function of an OVCtl OVCtl.OVCtl.1 ActiveX object, which triggers a null dereference...

CVE-2006-3915

CVE-2006-3915 affects Microsoft Internet Explorer 6 on Windows XP SP2. The vulnerability allows a remote actor to crash the browser by iterating over a native function (demonstrated with window.alert), triggering a null dereference and resulting in a denial of service. The provided sources docume...

CVE-2006-3915: Undefined Security Weakness

Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service crash by iterating over any native function, as demonstrated with the window.alert function, which triggers a null dereference...