Potential DoS Attack on RSA's ACE/Server

Hi folks, RSA Security http://www.rsasecurity.com/ produce a 2 factor secure authentication solution called ACE/Server. This uses SecurID tokens to enforce authentication and runs on NT/2000 and Solaris. It is possible for a nonprivileged user on the same network as the ACE/Server to trivially...

DoS против ACE/Server

большое число случайных UDP-данных в порт авторизации приводит к аварийному завершению приложения...

kill_sntsd.pl

I noticed an uncommon scanf overflow in the Simple Network Time Sync daemon and client version 1.0, tested on Redhat 6.1. I haven't looked into this fully yet, but it looks as tho it could be root comprimising as it sits on a priveledged udp port and seems to coredump, but looks like it only give...

Проблемы со службой обзора (Browser)

Служба обзора сети базируется на UDP и не поддерживает авторизации. В спецификации службы есть описания пакетов, кторые служат для остановки службы обзора. Таким образом можно остановить все обозреватели сети. Кроме того, можно вызвать перегрузку сети зарегестрировав чрезвычайно большой список...

Удаленная дырка в gdm (Gnome)

Классическое переполнение буфера, позволяет получить привелегии root если gdm прослушивает порт UDP/177 по-умолчанию выключено в большинстве систем...

disable.tcpdump

Greetings. There is a way to disable tcpdump running on a remote host. By sending a carefully crafted UDP packet on the network which tcpdump monitors, it is possible, under certain circonstances, to make tcpdump fall into an infinite loop. This undesired behaviour has serious consequences for an...

Denial of service attack against tcpdump

Greetings. There is a way to disable tcpdump running on a remote host. By sending a carefully crafted UDP packet on the network which tcpdump monitors, it is possible, under certain circonstances, to make tcpdump fall into an infinite loop. This undesired behaviour has serious consequences for an...

CVE-2000-0339

ZoneAlarm 2.1.10 and earlier does not filter UDP packets with a source port of 67, which allows remote attackers to bypass the firewall rules...

CVE-2000-0221

The Nautica Marlin bridge allows remote attackers to cause a denial of service via a zero length UDP packet to the SNMP port...

CVE-2000-0221

The CVE-2000-0221 entry concerns the Nautica Marlin bridge, where remote attackers can cause a denial of service by sending a UDP packet of zero length to the SNMP port. The core issue is a zero-length UDP packet handling on SNMP, leading to DoS. Public details in connected sources describe the v...

Objectserver vulnerability

Since the patches are now officially released, I feel I can finally release the details of the SGI objectserver vulnerability. This vulnerability was initailly reported to CERT and SGI Security on October 6, 1997. A beta version of patch 2849 was provided in February 1998. Howard ----- Forwarded...

Security Problems with Linux 2.2.x IP Masquerading

Security Problems with Linux 2.2.x IP Masquerading Summary: Due to lax checking in the masquerading kernel code, an attacker is able to rewrite a linux masq gateway's UDP masquerading entries so that the remote host and port are whatever they choose. This creates a tunnel between whatever host an...

Be BeOS 4.04.55.0 - IP Packet Length Field

Be BeOS 4.04.55.0 - IP Packet Length Field source: https://www.securityfocus.com/bid/1100/info The networking process in BeOS can crash if certain malformed packets are transmitted to it. If the length field is set to a number less than the total length of the IP and protocol TCP or UDP headers...

Be BeOS 4.0/4.5/5.0 - IP Packet Length Field

source: https://www.securityfocus.com/bid/1100/info The networking process in BeOS can crash if certain malformed packets are transmitted to it. If the length field is set to a number less than the total length of the IP and protocol TCP or UDP headers alone, the process will halt and require...

linux-masq-udp.txt

Security Problems with Linux 2.2.x IP Masquerading Summary: Due to lax checking in the masquerading kernel code, an attacker is able to rewrite a linux masq gateway's UDP masquerading entries so that the remote host and port are whatever they choose. This creates a tunnel between whatever host an...

Проблемы с маскарадингом в Linux

анализируя ICMP-ответы при сканировании портов, отведенных под маскарадинг по-умолчанию 61000 - 65096 можно обнаружить и перехватить активные UDP-сеансы...

CVE-2000-0289

IP masquerading in Linux 2.2.x allows remote attackers to route UDP packets through the internal interface by modifying the external source IP address and port number to match those of an established connection...

CVE-1999-0189

Solaris rpcbind exposes the RPC portmapper on a non-standard high UDP port in addition to the expected port 111. This port discovery can enable attackers to bypass basic firewall rules by querying the portmapper for the port numbers of RPC services. The issue is documented across multiple sources...

CVE-1999-0189

Solaris rpcbind listens on a high numbered UDP port, which may not be filtered since the standard port number is 111...

Talk Service (talkd, in.talk, ntalk) Detection

The remote service responded to a talk request. A talk server also known as 'talkd', 'in.talk', or 'ntalk' is a service that works over UDP and notifies a user when someone wants to initiate a conversation. Note that talk is nowadays considered by many to be obsolete. C Tenable Network Security,...