CyberCop Scanner Smbgrind 5.5 - Buffer Overflow (PoC)

CyberCop Scanner Smbgrind 5.5 - Buffer Overflow PoC + Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/SMBGRIND-BUFFER-OVERFLOW.txt Vendor: ======================= Network Associates Inc. Product: =========================================...

NTPd ntp-4.2.6p5 - ctl_putdata() Buffer Overflow (PoC)

NTPd ntp-4.2.6p5 - ctlputdata Buffer Overflow PoC / Ntpd Based on: ntpq client from ntp package Provided for legal security research and testing purposes ONLY PoC DoS Denial of Service PoC. Will crash NTPd. You will need to know the KEY ID and MD5 password, for example put this in you ntp.conf...

yTree 1.94-1.1 - Local Buffer Overflow (PoC)

Exploit Author: Juan Sacco - http://www.exploitpack.com [email protected] Program affected: yTree - File manager for terminals v1.94-1.1 Description: yTree is prone to a stack-based overflow, an attacker could exploit this issue to execute arbitrary code in the context of the application...

Network Time Protocol Private Mode 'reslist' Stack Memory Exhaustion Vulnerability

CERT VU357792 Summary An unauthenticated ntpdc reslist command can cause a segmentation fault in ntpd by exhausting the call stack. The following conditions must be met: 1. Mode 7 must be enabled. By default, mode 7 is disabled. 2. A large enough number of entries must be in the restrict lists to...

Network Time Protocol Private Mode 'reslist' NULL Pointer Dereference Vulnerability

Summary An unauthenticated ntpdc reslist command can cause a segmentation fault in ntpd by causing a NULL pointer dereference. The following conditions must be met: 1. Mode 7 must be enabled. By default, mode 7 is disabled. 2. A large enough number of entries must exist in the restrict list to...

Mageia: Security Advisory (MGASA-2016-0023)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RTMPDump rtmpsrv PlayPath Null Pointer Dereference

Talos Vulnerability Report TALOS-2016-0068 RTMPDump rtmpsrv PlayPath Null Pointer Dereference January 7, 2016 CVE Number CVE-2015-8272 Description A vulnerability exists in rtmpsrv in which an attacker can entice a user to utilize rtmpsrv to save an RTMP media stream that is missing a playpath...

PHP 7.0.0 - Format String

Overview -------------------------------------------- A fun little format string vulnerability exists in PHP 7.0.0 due to how non-existent class names are handled. From my limited research I believe this issue is likely exploitable for full code execution see test script below. This issue does no...

Scientific Linux Security Update : squid on SL7.x x86_64 (20151119)

It was found that Squid configured with client-first SSL-bump did not correctly validate X.509 server certificate host name fields. A man-in- the-middle attacker could use this flaw to spoof a Squid server using a specially crafted X.509 certificate. CVE-2015-3455 This update fixes the following...

Scientific Linux Security Update : openldap on SL7.x x86_64 (20151119)

A flaw was found in the way OpenLDAP parsed OpenSSL-style cipher strings. As a result, OpenLDAP could potentially use ciphers that were not intended to be enabled. CVE-2015-3276 The openldap packages have been upgraded to upstream version 2.4.40, which provides a number of bug fixes and one...

Libnsgif 0.1.2 Stack Overflow / Out-Of-Bounds Read Exploit

Libnsgif version 0.1.2 suffers from stack overflow and out-of-bounds read vulnerabilities. Overview ======== Libnsgif1 is a decoding library for GIF images. It is primarily developed and used as part of the NetSurf project. As of version 0.1.2, libnsgif is vulnerable to a stack overflow...

Amazon Linux AMI : libxml2 (ALAS-2015-628)

A denial of service flaw was found in the way the libxml2 library parsed certain XML files. An attacker could provide a specially crafted XML file that, when parsed by an application using libxml2, could cause that application to use an excessive amount of memory. The xmlParseConditionalSections...

Apple Mac OSX 10.11 - FTS Deep Structure of the FileSystem Buffer Overflow

MacOS X 10.11 FTS Deep structure of the file system Buffer Overflow Credit: Maksymilian Arciemowicz CXSECURITY Website: http://cxsecurity.com/ http://cert.cx/ Affected software: - MACOS's Commands such as: ls, find, rm - iPhone 4s and later, - Apple Watch Sport, Apple Watch, Apple Watch Edition a...

Mac OS X 10.11 FTS Buffer Overflow

MacOS X 10.11 FTS Deep structure of the file system Buffer Overflow Credit: Maksymilian Arciemowicz CXSECURITY Website: http://cxsecurity.com/ http://cert.cx/ Affected software: - MACOS's Commands such as: ls, find, rm - iPhone 4s and later, - Apple Watch Sport, Apple Watch, Apple Watch Edition a...

OpenSSL 1.0.2 < 1.0.2e Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 1.0.2e. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.2e advisory. - The ASN1TFLGCOMBINE implementation in crypto/asn1/tasndec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, a...

Design/Logic Flaw

The ssl3getkeyexchange function in ssl/s3clnt.c in OpenSSL 1.0.2 before 1.0.2e allows remote servers to cause a denial of service segmentation fault via a zero p value in an anonymous Diffie-Hellman DH ServerKeyExchange message...

CVE-2015-1794

The ssl3getkeyexchange function in ssl/s3clnt.c in OpenSSL 1.0.2 before 1.0.2e allows remote servers to cause a denial of service segmentation fault via a zero p value in an anonymous Diffie-Hellman DH ServerKeyExchange message...

CVE-2015-1794

The ssl3getkeyexchange function in ssl/s3clnt.c in OpenSSL 1.0.2 before 1.0.2e allows remote servers to cause a denial of service segmentation fault via a zero p value in an anonymous Diffie-Hellman DH ServerKeyExchange message...

CVE-2015-1794

CVE-2015-1794 : OpenSSL 1.0.2 before 1.0.2e is vulnerable to a remote DoS (segmentation fault) when a ServerKeyExchange uses an anonymous DH with p = 0. The vulnerability is in ssl3_get_key_exchange (ssl/s3_clnt.c) and can be triggered by a zero p value in the DH parameters, allowing a server to ...

CVE-2015-1794

The ssl3getkeyexchange function in ssl/s3clnt.c in OpenSSL 1.0.2 before 1.0.2e allows remote servers to cause a denial of service segmentation fault via a zero p value in an anonymous Diffie-Hellman DH ServerKeyExchange message...