Heap overflow in Skulltag 0.97d-beta4.1

Luigi Auriemma Application: Skulltag http://www.skulltag.com Versions: = 0.97d-beta4.1 Platforms: Windows and Linux Bug: heap-overflow Exploitation: remote, versus server Date: 23 Aug 2007 Author: Luigi Auriemma e-mail: [email protected] web: aluigi.org 1 Introduction 2 Bug 3 The Code 4 Fix...

Skulltag game buffer overflow

Buffer overflow on UDP datagram parsing...

Exploits Remote eavesdropping with SIP Phone GXV-3000

No description provided by source. !/usr/bin/perl use IO::Socket::INET; die "Usage $0 dst port username src port username" unless $ARGV5; $socket=new IO::Socket::INET-new Proto='udp', LocalPort = $ARGV4, PeerPort=$ARGV1, PeerAddr=$ARGV0; $sdp= "v=0\r o=username 0 0 IN IP4 $ARGV3\r s=The Funky...

CVE-2007-4532

Soldat game server 1.4.2 and earlier, and dedicated server 2.6.2 and earlier, allows remote attackers to cause a denial of service client lockout via a series of UDP join packets from a spoofed IP address, which triggers temporary blacklisting of this IP address...

CVE-2007-4532

CVE-2007-4532 (Soldat) affects Soldat game server 1.4.2 and earlier and dedicated server 2.6.2 and earlier. The issue allows remote attackers to cause a denial-of-service (client lockout) by sending a sequence of UDP join packets from a spoofed IP, which triggers temporary blacklisting of that IP...

Vavoom 1.24 - str.cpp VStr::Resize Function Crafted UDP Packet Remote Denial of Service

source: https://www.securityfocus.com/bid/25436/info Vavoom is prone to multiple remote vulnerabilities, including a buffer-overflow issue, a format-string issue, and a denial-of-service issue. An attacker can exploit these issues to execute arbitrary code within the context of the affected...

Skulltag Huffman报文解压远程堆溢出漏洞

BUGTRAQ ID: 25423 Skulltag是一个在外国很流行的DOOM在线游戏的扩展平台。 Skulltag游戏平台负责huffman解压入站报文的函数存在堆溢出漏洞，远程攻击者可以通过发送单包UDP报文触发这个溢出，导致执行任意指令。 Skulltag Team Skulltag = 0.97d-beta4.1 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.skulltag.com/...

Vavoom 1.24 - str.cpp VStr::Resize Function Crafted UDP Packet Remote Denial of Service

Vavoom 1.24 - str.cpp VStr::Resize Function Crafted UDP Packet Remote Denial of Service source: https://www.securityfocus.com/bid/25436/info Vavoom is prone to multiple remote vulnerabilities, including a buffer-overflow issue, a format-string issue, and a denial-of-service issue. An attacker can...

Design/Logic Flaw

Image Space rFactor 1.250 and earlier allows remote attackers to cause a denial of service daemon crash via 1 an ID 0x30 packet, 2 an ID 0x38 packet, and an invalid 13-bit integer in 3 an ID 0x60 packet and 4 an ID 0x68 packet; and a denial of service UDP port block via 5 an ID 0x20 packet and 6 ...

CVE-2007-4444

Multiple buffer overflows in Image Space rFactor 1.250 and earlier allow remote attackers to execute arbitrary code via a packet with ID 1 0x80 or 2 0x88 to UDP port 34297, related to the buffer containing the server version number...

Buffer overflow

Multiple buffer overflows in Image Space rFactor 1.250 and earlier allow remote attackers to execute arbitrary code via a packet with ID 1 0x80 or 2 0x88 to UDP port 34297, related to the buffer containing the server version number...

CVE-2007-4445

Image Space rFactor 1.250 and earlier allows remote attackers to cause a denial of service daemon crash via 1 an ID 0x30 packet, 2 an ID 0x38 packet, and an invalid 13-bit integer in 3 an ID 0x60 packet and 4 an ID 0x68 packet; and a denial of service UDP port block via 5 an ID 0x20 packet and 6 ...

CVE-2007-4445

Image Space rFactor 1.250 and earlier allows remote attackers to cause a denial of service daemon crash via 1 an ID 0x30 packet, 2 an ID 0x38 packet, and an invalid 13-bit integer in 3 an ID 0x60 packet and 4 an ID 0x68 packet; and a denial of service UDP port block via 5 an ID 0x20 packet and 6 ...

Cisco IP Phone 7940 - 3 SIP Messages Remote Denial of Service

Cisco IP Phone 7940 - 3 SIP Messages Remote Denial of Service !/usr/bin/perl use IO::Socket::INET; die "Usage $0 " unless $ARGV2; $socket=new IO::Socket::INET-newPeerPort=$ARGV1, Proto='udp', PeerAddr=$ARGV0; $msg = "INVITE sip:$ARGV2@$ARGV0 SIP/2.0\r\nVia:...

CVE-2007-4444

Multiple buffer overflows in Image Space rFactor 1.250 and earlier allow remote attackers to execute arbitrary code via a packet with ID 1 0x80 or 2 0x88 to UDP port 34297, related to the buffer containing the server version number...

Cisco IP Phone 7940 - 3 SIP Messages Remote Denial of Service

!/usr/bin/perl use IO::Socket::INET; die "Usage $0 " unless $ARGV2; $socket=new IO::Socket::INET-newPeerPort=$ARGV1, Proto='udp', PeerAddr=$ARGV0; $msg = "INVITE sip:$ARGV2@$ARGV0 SIP/2.0\r\nVia: SIP/2.0/UDP\t192.168.1.2;rport;branch=00\r\nFrom: ;tag=00\r\nTo: ;tag=00\r\nCall-ID:...

Cisco IP Phone 7940 - 10 SIP Messages Remote Denial of Service

!/usr/bin/perl use IO::Socket::INET; die "Usage $0 " unless $ARGV3; $socket=new IO::Socket::INET-newPeerPort=$ARGV1, Proto='udp', PeerAddr=$ARGV0; $msg = "INVITE sip:$ARGV2@$ARGV0 SIP/2.0\r\nVia: SIP/2.0/UDP $ARGV3;branch=01;rport\r\nFrom: ;tag=01\r\nTo: \r\nCall-ID: 01@$ARGV3\r\nCSeq: 7532...

CVE-2007-4444

CVE-2007-4444 involves multiple buffer overflows in Image Space rFactor 1.250 and earlier. The issue allows remote attackers to execute arbitrary code by sending a UDP packet to port 34297 with ID 0x80 or 0x88, related to the buffer containing the server version number. Affected software: Image S...

rFactor多个拒绝服务和代码执行漏洞

BUGTRAQ ID: 25358 rFactor是一款电脑赛车模拟游戏。 rFactor处理ID 0x80或0x88报文的函数中存在缓冲区溢出，但这个溢出不会覆盖返回地址，只能修改服务器的某些缓冲区。如果要利用这个漏洞，攻击者必须查询服务器UDP 34297端口，通过设置超长的服务器版本创建回复，触发第二次溢出，然后才能覆盖返回地址。 如果向发送了ID 0x30或0x38的报文的话，就会导致服务器出现Connection lost消息后崩溃。 如果所发送的ID...

Code injection

Babo Violent 2 2.08.00 and earlier allows remote attackers to cause a denial of service application crash via 1 a value greater than 0x27 for the a 0xca, b 0xcb, c 0xcc, d 0xce, e 0xcf, or f 0xd0 data ID; 2 a nonexistent map name; or 3 a UDP packet that specifies a large data size...