[AP] Cisco vpnclient buffer overflow

-- ------------------------- -- - AngryPacket Security Advisory - -- ------------------------- -- - +--------------------- -- - + advisory information +------------------ -- - author: methodic [email protected] release date: 05/28/2002 homepage: http://sec.angrypacket.com advisory...

Apache web servers fail to handle chunks with a negative size

Overview There is a remotely exploitable vulnerability in the way that Apache web servers or other web servers based on their source code handle data encoded in chunks. This vulnerability is present by default in configurations of Apache web server versions 1.2.2 and above, 1.3 through 1.3.24, an...

Cisco 12000 Series Router ICMP Unreachable DoS

The remote device appears to be a Cisco 12000 Series router. According to its version number, it is vulnerable to a denial of service issue. Forcing it to send a large number of ICMP unreachable packets can slow down throughput. A remote attacker could use this to degrade the performance of the...

Yahoo! Messenger is vulnerable to DoS via multiple messages from spoofed names

Overview Yahoo! Messenger is an instant messaging client. A report indicates that there is a vulnerability that permits an attacker to spoof the source user name of a Yahoo! Messenger message. Description Yahoo! Messenger permits a user to place users on an ignore list. A vulnerability exists tha...

Nortel Networks CVX 1800 discloses privileged information

Overview The Nortel Networks CVX 1800 Multi-Service Access Switch discloses privileged information. Description The CVX 1800 Multi-Service Access Switch is a large modem bank typically used by large carriers and ISP's. When the CVX 1800 is queried with a specially crafted snmpwalk, it will respon...

Quake 3 Arena Malformed Connection Packet DoS

It was possible to crash the Quake3 Arena daemon by sending a specially crafted login string. An attacker may use this attack to make this service crash continuously, preventing you from playing. C Tenable Network Security, Inc. Script audit and contributions from Carmichael Security Erik Anderso...

Apache Tomcat Nonexistent File Error Message Path Disclosure

Tomcat will reveal the physical path of the webroot when asked for a nonexistent .jsp file. An unauthenticated, remote attacker can exploit this via a specially crafted request. An attacker can use this flaw to gain further knowledge about the remote filesystem layout. %NASLMINLEVEL 70300 C Tenab...

Cayman gateways are vulnerable to a denial of service via a portscan

Overview Cayman gateways are vulnerable to a denial of service. An attacker can send a number of TCP connect requests or SYN packets, in conjunction with a "Bouncing" vulnerability, and can cause a denial of service to the gateway. Description The gateway will crash after receiving a number of TC...

gpm-root fails to correctly release GID 0 membership for user defined menus

Overview gpm-root does not properly drop group privileges. Local users can gain group privileges by starting a utility from gpm-root. The gpm package is usually included in Linux distributions, and can be started from the command line or in the startup script /etc/rc.d/rc.local. Description gpm...

BubbleMon 1.31

VULNERABILITY DESCRIPTION Users can execute programs/shellscript by clicking on the bubblemon app. bubblemon is installed sgid kmem on FreeBSD and does not drop its egid before executing programs. VERSIONS AFFECTED All versions of BubbleMon up to 1.32 installed on FreeBSD . EXAMPLE $ id...

Cisco Security Advisory: Cisco Content Services Switch User Account Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Cisco Security Advisory: Cisco Content Services Switch User Account Vulnerability ========================================================================== Revision 1.0 For Public Release 2001 April 04 08:00 UTC -0700...

Cisco Security Advisory: Cisco Catalyst SSH Protocol Mismatch Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Cisco Security Advisory: VPN3000 Concentrator TELNET Vulnerability ========================================================================== Revision 1.0 For Public Release 2001 March 28 08:00 UTC -0800...

MERCUR SMTP Server EXPN Command Remote Overflow

It was possible to make the remote mail server crash when issuing a very long argument to the EXPN command. A remote attacker could exploit this flaw to crash the service, or possibly execute arbitrary code. C Tenable Network Security, Inc. Script audit and contributions from Carmichael Security...

GoodTech FTP Server Denial of Service

Description GoodTech FTP Server is subject to a denial of service. If an attacker successfully makes an unusually large number of connections, the server will crash. Technologies Affected GoodTech FTP Server 95/98 3.0.1 GoodTech FTP Server NT/2000 3.0.1 GoodTech has addressed this issue in a new...

Master Index search.cgi Traversal Arbitrary File/Directory Access

The version of Master Index running on the remote web server has a directory traversal vulnerability. Input to the 'catigory' parameter of search.cgi is not properly sanitized. A remote attacker could exploit this to read arbitrary files from the system. %NASLMINLEVEL 70300 C Tenable Network...

glftpd.privpath.txt

Glftpd 1.18 till 1.21b8 current beta have a serious problem with the privpath directives.... It will probably be fixed in the comming 1.21b9 but i have included a quick fix in this one to prevent exploits of this bug. Thanx for Hoopy for the quick fix glftpd dev team. Problem: When you know the...

Possible root exploit in ISC DHCP client.

Somebody at OpenBSD discovered a possible root exploit in the ISC DHCP client. This exploit is present in all versions of the ISC DHCP client prior to 2.0pl1 and 3.0b1pl14, which I just released this evening. Anybody who is using versions of the ISC DHCP client other than these is strongly urged ...

Conectiva Linux Security Announcement - ZOPE

---------------------------------------------------------------------- CONECTIVA LINUX SECURITY ANNOUNCEMENT ---------------------------------------------------------------------- PACKAGE: zope SUMMARY : Security problems in DocumentTemplate DATE : 2000-06-16 AFFECTED CONECTIVA VERSIONS : 4.2, 5....

FreeBSD-SA-00:22.apsfilter

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:22 Security Advisory FreeBSD, Inc. Topic: apsfilter allows users to execute arbitrary commands as user lpd Category: ports Module: apsfilter Announced: 2000-06-07 Credits...

RFP2K05 - NetProwler "Fragmentation" Issue

NetProwler 3.0 will crash if the Man-in-the-Middle signature encounters a packet for which the following expression evaluates to true: IPHEADERLENGTH + TCPHEADERLENGTH IPTOTALLENGTH This is not a packet fragmentation problem. It is an issue with specific malformed packets. This problem has been...