CVE-2005-1794

Microsoft Terminal Server using Remote Desktop Protocol RDP 5.2 stores an RSA private key in mstlsapi.dll and uses it to sign a certificate, which allows remote attackers to spoof public keys of legitimate servers and conduct man-in-the-middle attacks...

CVE-1999-1579

CVE-1999-1579 affects the Cenroll ActiveX control (xenroll.dll) used in Terminal Server Editions of Windows NT 4.0 and Windows NT Server 4.0 prior to SP6. The vulnerability enables remote attackers to cause a denial of service via resource consumption by creating a large number of arbitrary files...

CVE-2002-0444

Technical details about CVE-2002-0444 are not provided in the supplied documents. The description notes that Windows 2000 Terminal Server SYSVOL policy application can fail when connections exceed a maximum; monitor for official updates.

CVE-2002-0444

Microsoft Windows 2000 running the Terminal Server 90-day trial version, and possibly other versions, does not apply group policies to incoming users when the number of connections to the SYSVOL share exceeds the maximum, e.g. with a maximum number of licenses, which can allow remote authenticate...

Microsoft Windows Terminal Server Patch Unspecified Denial Of Service Vulnerability

Description The Terminal Server patch issued in Microsoft advisory MS01-052 has been found to be prone to an unspecified denial of service vulnerability. The affected patch was originally issued to deal with the issue outlined in the Microsoft Windows 2000/NT Terminal Server Service RDP DoS...

consroot.exp

Hi there, here is a fully automated script for getting a root shell using a normal user account and remote-console acces. The Script was written by me based on an article from phrack.com article 53 - hacking forth by mudge ---snip--- --- consroot.exp " puts "\twhere MODE is one of:" puts "\t\tT =...

DoS attack on Windows 2000 Terminal Server

This one's short and simple.. Description ----------- Any user with sufficient permission to log on to a Windows 2000 Terminal Server via RDP or ICA and access its filesystem can reboot the server at will. Exploit ------- - Open SYSTEMROOTSYSTEM32MSGINA.DLL for exclusive access read lock. I used...

Nortel/Bay Networks/Xylogics Annex Default Password

The remote terminal server has the default password set. This means that anyone who has downloaded a user manual can telnet to it and gain administrative access. If modems are attached to this terminal server, it may allow unauthenticated, remote access to the network. This script was written by...

Microsoft Terminal Server Client Buffer Overrun (A082802-1)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 @stake, Inc. www.atstake.com Security Advisory Advisory Name: Microsoft Terminal Server Client Buffer Overrun Release Date: 08/28/2002 Application: Microsoft Terminal Server ActiveX Client v5.02221.1 Platform: Windows 95/98/NT 4.0/2000/XP Severity:...

Crashing any Windows NT TSE running MetaFrame 1.8

PreScriptum: I posted this at thin-world.community.everyone.net first. -------------------------------------------------------------------------------- I tried to contact Citrix about this bug i found, but they warn't interested. Haven't heared from them. So i'm posting it on a public forum for...

CVE-2002-0444

Microsoft Windows 2000 running the Terminal Server 90-day trial version, and possibly other versions, does not apply group policies to incoming users when the number of connections to the SYSVOL share exceeds the maximum, e.g. with a maximum number of licenses, which can allow remote authenticate...

CVE-2001-0663

Terminal Server in Windows NT and Windows 2000 allows remote attackers to cause a denial of service via a sequence of invalid Remote Desktop Protocol RDP packets...

Citrix Client Access Verification

Your professional opinions are appreciated. About a month ago I had posted the below as a Citrix Client Access Advisory and got several responses to the fact that it either it was not a valid vulnerabilty or that it was a default configuration problem. which may be true. but consider this. The...

CVE-1999-1257

Xyplex terminal server 6.0.1S1 (and possibly other versions) is affected by an authentication bypass vulnerability. Remote attackers can bypass the password prompt by entering either a CTRL-Z character or a question mark (?), as described in CVE-1999-1257. The available documents confirm the affe...

CVE-1999-1257

Xyplex terminal server 6.0.1S1, and possibly other versions, allows remote attackers to bypass the password prompt by entering 1 a CTRL-Z character, or 2 a ? question mark...

CVE-2000-1149

Buffer overflow in RegAPI.DLL used by Windows NT 4.0 Terminal Server allows remote attackers to execute arbitrary commands via a long username, aka the "Terminal Server Login Buffer Overflow" vulnerability...

CVE-2000-1149

The CVE-2000-1149 issue affects Microsoft Windows NT 4.0 Terminal Server, where a buffer overflow in RegAPI.DLL allows remote code execution via a specially crafted username. The vulnerability can be exploited by anyone with access to port 3389/TCP and could grant the attacker the privileges of a...

CVE-2000-1149

Buffer overflow in RegAPI.DLL used by Windows NT 4.0 Terminal Server allows remote attackers to execute arbitrary commands via a long username, aka the "Terminal Server Login Buffer Overflow" vulnerability...

Windows NT 4.0 Terminal Server RegAPI.DLL Buffer Overflow

CORE SDI http://www.core-sdi.com Vulnerability Report For Microsoft Windows NT 4.0 Terminal Server GINA Date Published: 2000-11-08 Advisory ID: CORE-20001108 Bugtraq ID: 1924 CVE CAN: Non currently assigned. Title: Windows NT 4.0 Terminal Server RegAPI.DLL Buffer Overflow Class: Boundary Error...

Security Bulletin (MS00-087)

Microsoft Security Bulletin MS00-087 - -------------------------------------- Patch Available for "Terminal Server Login Buffer Overflow" Vulnerability Originally posted: November 08, 2000 Summary ======= Microsoft has released a patch that eliminates a security vulnerability in Microsoftr Window...