FreeBSD : zip -- long path buffer overflow (40549bbf-43b5-11d9-a9e7-0001020eed82)

A HexView security advisory reports : When zip performs recursive folder compression, it does not check for the length of resulting path. If the path is too long, a buffer overflow occurs leading to stack corruption and segmentation fault. It is possible to exploit this vulnerability by embedding...

Re: [Full-disclosure] Solaris 9/10 ld.so fun

Przemyslaw Frasunek wrote: ld.so from Solaris 9 and 10 doesn't check LDAUDIT environment variable when running sugid binaries, allowing to run arbitrary code with elevated privileges. Well, I can't belive, that such trivial vulnerability exists in modern OS... ... Oh, well, it's not the end of fu...

Solaris 10 /usr/sbin/traceroute vulnerabilities

/usr/sbin/traceroute from Solaris 10 is vulnerable to buffer overflow in handling -g argument. After supplying 10 -g parameters, return address is overwritten by IP address argument: atari:root:/home/venglin /usr/sbin/traceroute -g 1 -g 2 -g 3 -g 4 -g 5 -g 6 -g 7 -g 8 -g 9 -g 10 127.0.0.1...

traceSolaris.txt

/usr/sbin/traceroute from Solaris 10 is vulnerable to buffer overflow in handling -g argument. After supplying 10 -g parameters, return address is overwritten by IP address argument: atari:root:/home/venglin /usr/sbin/traceroute -g 1 -g 2 -g 3 -g 4 -g 5 -g 6 -g 7 -g 8 -g 9 -g 10 127.0.0.1...

eXtropia Shopping Cart web_store.cgi Remote Exploit

No description provided by source. !/usr/bin/perl -w Remote Command Execution Vulnerability In Webstore.cgi SegmentationFault Group Greetz to : Xsupr3mo - failed - Status-x - Stealh - P3S4D3L0 Greetz to : berhooz - nima - ehsan - Unknown OutLaw eutanasia www.ashiyane.com ok setp by setp to work :...

Gaim 1.2.1 - URL Handling Remote Stack Overflow

// Written by Ron // Friday, May 13, 2005 // // This is a very weak demonstration of Gaim 1.2.1's stack overflow vulnerability // when processing email addresses. What this basically does is segfault you when you // do a /vuln command in a conversation, and, if you're using a protocol that allows...

GLSA-200505-03 : Ethereal: Numerous vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200505-03 Ethereal: Numerous vulnerabilities There are numerous vulnerabilities in versions of Ethereal prior to 0.10.11, including: The ANSI A and DHCP dissectors are vulnerable to format string vulnerabilities. The DISTCC, FCELS...

CVE-2003-1139

Musicqueue 1.2.0 is affected. The vulnerability allows a local user to overwrite arbitrary files by triggering a segmentation fault and using a symlink attack on the resulting musicqueue.crash file, enabling potentially unauthorized modification of files. Root cause: a crash-generated file name (...

CVE-2003-1201

OpenLDAP prior to 2.1.13 is affected by a denial-of-service vulnerability in the back-ldbm backend. Specifically, ldbm_back_exop_passwd frees an uninitialized pointer when slap_passwd_parse does not return LDAP_SUCCESS, potentially causing a segmentation fault on remote attack. Affected versions ...

CVE-2004-1897

Administration interface in Monit 1.4 through 4.2 allows remote attackers to cause a denial of service segmentation fault by sending a Basic Authentication request without a password, which causes Monit to decrement a null pointer and perform an out-of-bounds read...

CVE-2003-1139

Musicqueue 1.2.0 allows local users to overwrite arbitrary files by triggering a segmentation fault and using a symlink attack on the resulting musicqueue.crash file...

CVE-2004-1897

The CVE describes a denial-of-service (segmentation fault) in Monit versions 1.4–4.2 triggered by sending a Basic Authentication request without a password. The underlying issue is a null pointer dereference leading to an out-of-bounds read when Monit decrements a null pointer. Affected software:...

CVE-2003-1163

hash.c in Ganglia gmond 2.5.3 allows remote attackers to cause a denial of service segmentation fault via a UDP packet that contains a single-byte name string, which is used as an out-of-bounds array index...

CVE-2003-1201

ldbmbackexoppasswd in the back-ldbm backend in passwd.c for OpenLDAP 2.1.12 and earlier, when the slappasswdparse function does not return LDAPSUCCESS, attempts to free an uninitialized pointer, which allows remote attackers to cause a denial of service segmentation fault...

CVE-2004-1897

Administration interface in Monit 1.4 through 4.2 allows remote attackers to cause a denial of service segmentation fault by sending a Basic Authentication request without a password, which causes Monit to decrement a null pointer and perform an out-of-bounds read...

Ethereal 0.10.10 - dissect_ipc_state Remote Denial of Service

Ethereal 0.10.10 - dissectipcstate Remote Denial of Service // / / / Ethereal / / / / From the Ethereal Security Advisory 19 : / / http://www.ethereal.com/appnotes/enpa-sa-00019.html / / / / "The SMB dissector could cause a segmentation fault and throw / / assertions. Versions affected: 0.9.0 to...

Ethereal 0.10.10 - 'dissect_ipc_state' Remote Denial of Service

// / / / Ethereal / / / / From the Ethereal Security Advisory 19 : / / http://www.ethereal.com/appnotes/enpa-sa-00019.html / / / / "The SMB dissector could cause a segmentation fault and throw / / assertions. Versions affected: 0.9.0 to 0.10.10" / / / // include include include include include...

[Full-disclosure] 64 bit qmail fun

Georgi Guninski security advisory 74, 2005 64 bit qmail fun Systems affected: qmail on 64 bit platforms with a lot of virtual memory 8GB Date: 6 May 2005 Legal Notice: This Advisory is Copyright c 2004 Georgi Guninski. You may not modify it and distribute it or distribute parts of it without the...

CVE-2005-1470

Multiple unknown vulnerabilities in the 1 TZSP, 2 MGCP, 3 ISUP, 4 SMB, or 5 Bittorrent dissectors in Ethereal before 0.10.11 allow remote attackers to cause a denial of service segmentation fault via unknown vectors...

PT-2005-2466 · Ethereal +1 · Ethereal +1

Name of the Vulnerable Software and Affected Versions: Ethereal versions prior to 0.10.11 Description: The issue is related to multiple unknown vulnerabilities in various dissectors, including TZSP, MGCP, ISUP, SMB, and Bittorrent, which can be exploited by remote attackers to cause a denial of...