Windows NetBIOS Remote Host Information Disclosure

The remote host listens on udp port 137 and replies to NetBIOS nbtscan requests. By sending a wildcard request it is possible to obtain the name of the remote system and the name of its domain. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid42409; scriptversion "1.11"...

SIPfoundry sipXphone 2.6.0.27 CSeq Buffer Overflow

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'SIPfoundry...

Microsoft SQL Server Resolution Overflow

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'Microsoft SQ...

Mac OS X mDNSResponder UPnP Location Overflow

require 'msf/core' class Metasploit3 'Mac OS X mDNSResponder UPnP Location Overflow', 'Platform' = 'osx', 'DefaultOptions' = 'SRVPORT' = 1900, 'RPORT' = 0 , 'Targets' = '10.4.8 x86', mDNSResponder-108.2 'Arch' = ARCHX86, Offset to mDNSStorage structure 'Offset' = 21000, 'Magic' = 0x8fe510a0,...

mDNSResponder 10.4.0 10.4.8 UPnP Location Overflow (OS X)

No description provided by source. require 'msf/core' class Metasploit3 Msf::Exploit::Remote include Exploit::Remote::Udp def initializeinfo = superupdateinfoinfo, 'Name' = 'Mac OS X mDNSResponder UPnP Location Overflow', 'Platform' = 'osx', 'DefaultOptions' = 'SRVPORT' = 1900, 'RPORT' = 0 ,...

mDNSResponder 10.4.0/10.4.8 (OSX) - UPnP Location Overflow (Metasploit)

require 'msf/core' class Metasploit3 'Mac OS X mDNSResponder UPnP Location Overflow', 'Platform' = 'osx', 'DefaultOptions' = 'SRVPORT' = 1900, 'RPORT' = 0 , 'Targets' = '10.4.8 x86', mDNSResponder-108.2 'Arch' = ARCHX86, Offset to mDNSStorage structure 'Offset' = 21000, 'Magic' = 0x8fe510a0,...

NTPd Buffer Overflow

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'NTP daemon...

Unreal Tournament 2004 Overflow

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'Unreal...

XTACACSD 4.1.2 Buffer Overflow

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'XTACACSD %q...

Snort Back Orifice Stack Overflow

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'Snort Back...

Anonymous Remote Arbitrary Code Execution in Alien Arena 7.30

Anonymous Remote Arbitrary Code Execution in Alien Arena 7.30 ------------------------------------------------------------- October 21st, 2009 ======= Summary ======= Name: Anonymous Remote Arbitrary Code Execution in Alien Arena 7.30 Release Date: October 21st, 2009 Discoverer: Jason Geffner...

AlienArena game buffer overflow

Buffer overflow on UDP/27901 packet parsing...

Information disclosure

npvmgr.exe in BakBone NetVault Backup 8.22 Build 29 allows remote attackers to cause a denial of service daemon crash via a packet to 1 TCP or 2 UDP port 20031 with a large value in an unspecified size field, which is not properly handled in a malloc operation. NOTE: some of these details are...

CVE-2009-3448

npvmgr.exe in BakBone NetVault Backup 8.22 Build 29 allows remote attackers to cause a denial of service daemon crash via a packet to 1 TCP or 2 UDP port 20031 with a large value in an unspecified size field, which is not properly handled in a malloc operation. NOTE: some of these details are...

CVE-2009-3448

CVE-2009-3448 affects BakBone NetVault Backup 8.22 Build 29 (npvmgr.exe). A remote attacker can cause a denial-of-service (daemon crash) by sending a packet to either TCP or UDP port 20031 containing a large value in an unspecified size field, which is not properly handled in a malloc operation. ...

RedHat Security Advisory RHSA-2009:1457

The remote host is missing updates announced in advisory RHSA-2009:1457. The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issues: Michael Tokarev reported a flaw in the Realtek r8169 Ethernet driver in the Linux kernel...

Motorola Timbuktu Service Detection

This module simply sends a packet to the Motorola Timbuktu service for detection. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Motorola Timbuktu Service Detection', 'Description' = %q This...

BakBone NetVault: Backup npvmgr.exe服务远程拒绝服务漏洞

BUGTRAQ ID: 36489 NetVault: Backup是一款实时备份和灾难恢复软件。 NetVault: Backup的npvmgr.exe进程没有执行长度检查便将从网络报文中获得的字段传送给了malloc，远程攻击者可以通过向20031端口发送特制的UDP或TCP报文导致服务崩溃。 BakBone NetVault: Backup 8.22 Build 29 厂商补丁： BakBone ------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.bakbone.com/...

kernel: udp socket NULL ptr dereference

The udpsendmsg function in the UDP implementation in 1 net/ipv4/udp.c and 2 net/ipv6/udp.c in the Linux kernel before 2.6.19 allows local users to gain privileges or cause a denial of service NULL pointer dereference and system crash via vectors involving the MSGMORE flag and a UDP socket...

dhcp-discover NSE Script

Sends a DHCPINFORM request to a host on UDP port 67 to obtain all the local configuration parameters without allocating a new address. DHCPINFORM is a DHCP request that returns useful information from a DHCP server, without allocating an IP address. The request sends a list of which fields it wan...