sendmail 8.11.4 and 8.12.0.Beta10 available

Sendmail, Inc., and the Sendmail Consortium announce the availability of sendmail 8.11.4 and 8.12.0.Beta10. 8.11.4 revamps signal handling within the MTA in order to reduce the likelihood of a race condition that can lead to heap corruption as described in Michal Zalewski's advisory. The problems...

Unsafe Signal Handling in Sendmail

RAZOR advisory: Unsafe Signal Handling in Sendmail Issue Date: May 28, 2001 Contact: Michal Zalewski [email protected] Topic: Sendmail signal handlers used for dealing with specific signals are vulnerable to numerous race conditions. Affected Systems: Any systems running sendmail tested ...

insecure signal handler design

"Delivering Signals for Fun and Profit" Understanding, exploiting and preventing signal-handling related vulnerabilities. Michal Zalewski [email protected] C Copyright 2001 BindView Corporation 0 Introduction --------------- According to a popular belief, writing signal handlers has litt...

CVE-2001-1349

Sendmail before 8.11.4, and 8.12.0 before 8.12.0.Beta10, allows local users to cause a denial of service and possibly corrupt the heap and gain privileges via race conditions in signal handlers...

IMAP4rev1 12.26112.2642000.284 - lsub Remote Overflow

IMAP4rev1 12.26112.2642000.284 - lsub Remote Overflow / !!! Private !!! imapd IMAP4rev1 v12.261, v12.264 and 2000.284 Remote Exploit. Others? Yes! By: SkyLaZarT [email protected] .aka. Felipe Cerqueira Homepage: www.BufferOverflow.Org Thankz: cync, oldm and Jans. BufferOverflow.org Te...

IBM Websphere Application Server 3.0.2 Server Plugin - Denial of Service

source: https://www.securityfocus.com/bid/1691/info Large amounts of data ie 1092+ characters in the Host: request header may cause the web server process to fault on signal 11 SIGSEGV or signal 10 SIGBUS. GET /servletsnoop HTTP/1.0 Host: xxxxxxxxxxxxxxxxxxxxxxxx1092+ characters resulted in the...

IBM Websphere Application Server 3.0.2 Server Plugin - Denial of Service

IBM Websphere Application Server 3.0.2 Server Plugin - Denial of Service source: https://www.securityfocus.com/bid/1691/info Large amounts of data ie 1092+ characters in the Host: request header may cause the web server process to fault on signal 11 SIGSEGV or signal 10 SIGBUS. GET /servletsnoop...

ftp-ozone.c.txt

/ ftp-ozone.c Demonstrate a basic layer violation in "stateful" firewall inspection of application data within IP packets - @$@$!: http://www.checkpoint.com/techsupport/alerts/pasvftp.html Dug Song / include include include include include include include include include include include include...

Linux Kernel 2.0 / 2.1 Send SIGIO Signal

/ source: https://www.securityfocus.com/bid/111/info A vulnerability in the Linux kernel allows any user to send a SIGIO signal to any process. If the process does not catch or ignore the signal is will exit. / / On non-glibc systems you must add define OASYNC FASYNC / include include include...

Eric Allman Sendmail 8.8.x - Socket Hijack

Eric Allman Sendmail 8.8.x - Socket Hijack // source: https://www.securityfocus.com/bid/774/info Through exploiting a combination of seemingly low-risk vulnerabilities in sendmail, it is possible for a malicious local user to have an arbitrary program inherit or "hijack" the file descriptor for t...

Eric Allman Sendmail 8.8.x - Socket Hijack

// source: https://www.securityfocus.com/bid/774/info Through exploiting a combination of seemingly low-risk vulnerabilities in sendmail, it is possible for a malicious local user to have an arbitrary program inherit or "hijack" the file descriptor for the socket listening on priviliged port 25...

CVE-1999-0035

Race condition in signal handling routine in ftpd, allowing read/write arbitrary files...

CVE-1999-0035

Race condition in signal handling routine in ftpd, allowing read/write arbitrary files...

CVE-1999-0035: Signal Handler Race Condition

Race condition in signal handling routine in ftpd, allowing read/write arbitrary files...

solaris.2.5.su.expect.txt

Date: Thu, 10 Jun 1999 14:13:06 -0500 From: Dr. Mudge To: [email protected] Subject: Solaris 2.5 /bin/su was: vulnerability in su/PAM in redhat The same sort of problem existed in solaris /bin/su on 2.5 and below. The comments in the quick proof of concept sploit below should explain further h...

redhat.su.ghost.bug.txt

Date: Wed, 16 Jun 1999 13:47:52 +0200 From: Roman Ramirez Reply-To: [email protected] Organization: Intercomputer, S.A. To: [email protected] Hello: I think I have found some kind of bug in "su" in Redhat linux versions tested on Redhat 5.2 y Redhat 6.0 The problem seems to be when you...

conceal.1.3x.txt

Date: Thu, 4 Mar 1999 14:11:47 -0600 From: [email protected] To: [email protected] Subject: S9S ConSeal PC FIREWALL for Windows NT Security Update Just got this from Signal9. [email protected] on 03/04/99 11:41:12 AM To: [email protected] cc: bcc: Bill...

Linux Kernel 2.02.1 - Send a SIGIO Signal To Any Process

Linux Kernel 2.02.1 - Send a SIGIO Signal To Any Process / source: https://www.securityfocus.com/bid/111/info A vulnerability in the Linux kernel allows any user to send a SIGIO signal to any process. If the process does not catch or ignore the signal is will exit. / / On non-glibc systems you mu...

Linux Kernel 2.0/2.1 - Send a SIGIO Signal To Any Process

/ source: https://www.securityfocus.com/bid/111/info A vulnerability in the Linux kernel allows any user to send a SIGIO signal to any process. If the process does not catch or ignore the signal is will exit. / / On non-glibc systems you must add define OASYNC FASYNC / include include include...

ISC BIND 4.9.7 -T1B - named SIGINT SIGIOT Symlink

ISC BIND 4.9.7 -T1B - named SIGINT SIGIOT Symlink source: https://www.securityfocus.com/bid/80/info The named daemon will dump the named database to /var/tmp/nameddump.db when it receives a SIGINT signal. It does not check for symbolic links while doing so and can be made to overwrite any file in...