@stake Advisory Notification: NetDDE Message Vulnerability (A020501-1)

@stake Inc. www.atstake.com Security Advisory Notification Advisory Name: NetDDE Message Vulnerability Release Date: 02/05/2001 Application: Network DDE system component Platform: Windows 2000 up to and including Service Pack 1 Severity: Any local user can obtain SYSTEM privileges Author: DilDog...

Очередный проблемы с разрешениями в реестре Windows NT

Возможность записи различных ключей реестра позволяют получить привилегии Local System...

Microsoft SQL Server 7.02000 Data Engine 1.02000 - xp_displayparamstmt Buffer Overflow

Microsoft SQL Server 7.02000 Data Engine 1.02000 - xpdisplayparamstmt Buffer Overflow // source: https://www.securityfocus.com/bid/2030/info The API Srvparaminfo, which is implemented by Extended Stored Procedures XPs in Microsoft SQL Server and Data Engine, is susceptible to a buffer overflow...

Microsoft SQL Server 7.0/2000 / Data Engine 1.0/2000 - xp_displayparamstmt Buffer Overflow

// source: https://www.securityfocus.com/bid/2030/info The API Srvparaminfo, which is implemented by Extended Stored Procedures XPs in Microsoft SQL Server and Data Engine, is susceptible to a buffer overflow vulnerability which may cause the application to fail or arbitrary code to be executed o...

Microsoft SQL Server 7.02000 Data Engine 1.02000 - xp_showcolv Buffer Overflow

Microsoft SQL Server 7.02000 Data Engine 1.02000 - xpshowcolv Buffer Overflow // source: https://www.securityfocus.com/bid/2038/info The API Srvparaminfo, which is implemented by Extended Stored Procedures XPs in Microsoft SQL Server and Data Engine, is susceptible to a buffer overflow...

Microsoft Windows NT 4.0 - MSIEXEC Registry Permissions

Microsoft Windows NT 4.0 - MSIEXEC Registry Permissions // source: https://www.securityfocus.com/bid/1835/info Due to weak permission settings for the registry key that handles the Microsoft Installer Service MSIEXEC, it is possible for a local user on Windows NT to escalate their privilege level...

Microsoft Windows NT 4.0 - MSIEXEC Registry Permissions

// source: https://www.securityfocus.com/bid/1835/info Due to weak permission settings for the registry key that handles the Microsoft Installer Service MSIEXEC, it is possible for a local user on Windows NT to escalate their privilege level. The file extension associated with the Microsoft...

MediaHouse Software Statistics Server LiveStats 5.2 - Remote Buffer Overflow

source: https://www.securityfocus.com/bid/1568/info Mediahouse Statistics Server LiveStats is susceptible to a buffer overflow attack if a URL in a GET request contains over 2030 bytes. Depending on the data inserted into the request, the application will crash or can be forced to execute arbitra...

Microsoft Windows SMB Registry : Key Permissions Path Subversion Local Privilege Escalation

Some SYSTEM registry keys can be written by non administrator. These keys contain paths to common programs and DLLs. If a user can change a path, then he may put a trojan program into another location say C:/temp and point to it. C Tenable Network Security, Inc. include"compat.inc"; if descriptio...

Microsoft Windows SMB Registry : Winlogon Key Permission Weakness

The registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon is writeable by users who are not in the admin group. This key contains a value which defines which program should be run when a user logs on. As this program runs in the SYSTEM context, the users who have the right to...

CISADV000524a.txt

Cerberus Information Security Advisory CISADV000524a http://www.cerberus-infosec.co.uk/advisories.shtml Released : 24th May 2000 Name : Rockliffe Mailsite Buffer Overflow Affected Systems : Windows NT running MailSite-HTTPMA/4.2.1.0 Issue : Remote attackers can execute arbitrary code Author : Dav...

Alert: Buffer overflow in Rockliffe's MailSite

Cerberus Information Security Advisory CISADV000524a http://www.cerberus-infosec.co.uk/advisories.shtml Released : 24th May 2000 Name : Rockliffe Mailsite Buffer Overflow Affected Systems : Windows NT running MailSite-HTTPMA/4.2.1.0 Issue : Remote attackers can execute arbitrary code Author : Dav...

Microsoft Systems Management Server 2.0 - Default Permissions

Microsoft Systems Management Server 2.0 - Default Permissions source: https://www.securityfocus.com/bid/945/info The default permissions applied to the directory containing the SMS Remote Control executable allow any user to replace the executable with any other executable. The new executable wil...

Microsoft Systems Management Server 2.0 - Default Permissions

source: https://www.securityfocus.com/bid/945/info The default permissions applied to the directory containing the SMS Remote Control executable allow any user to replace the executable with any other executable. The new executable will run with System privileges after the next reboot. Replace...

CVE-1999-0412

In IIS and other web servers, an attacker can attack commands as SYSTEM if the server is running as SYSTEM and loading an ISAPI extension...

Microsoft Windows NT 4.0SP1SP2SP3SP4SP5 - RASMAN Privilege Escalation

Microsoft Windows NT 4.0SP1SP2SP3SP4SP5 - RASMAN Privilege Escalation source: https://www.securityfocus.com/bid/645/info Any authenticated NT user ie domain user can modify the pathname for the RASMAN binary in the Registry. The next time the RAS Service is started, the trojan service referenced ...

Microsoft Data Access Components (MDAC) 2.1 / Microsoft IIS 3.0/4.0 / Microsoft Index Server 2.0 / Microsoft Site Server Commerce Edition 3.0 i386 MDAC - RDS (1)

source: https://www.securityfocus.com/bid/529/info MDAC Microsoft Data Access Components is a package used to integrate web and database services. It includes a component named RDS Remote Data Services. RDS allows remote access via the internet to database objects through IIS. Both are included i...

Microsoft IIS 2.03.04.0 - ISAPI GetExtensionVersion()

Microsoft IIS 2.03.04.0 - ISAPI GetExtensionVersion source: https://www.securityfocus.com/bid/501/info IIS and potentially other NT web servers have a vulnerability that could allow arbitrary code to be run as SYSTEM. This works because of the way the server calls the GetExtensionVersion function...

Microsoft IIS 2.0/3.0/4.0 - ISAPI GetExtensionVersion()

source: https://www.securityfocus.com/bid/501/info IIS and potentially other NT web servers have a vulnerability that could allow arbitrary code to be run as SYSTEM. This works because of the way the server calls the GetExtensionVersion function the first time an ISAPI extension is loaded. Any us...

CVE-1999-0412

In IIS and other web servers, an attacker can attack commands as SYSTEM if the server is running as SYSTEM and loading an ISAPI extension...