SonicWALL Global VPN客户端日志文件远程格式串漏洞

Bugraq ID: 35093 CNCAN ID：CNCAN-2009052706 SonicOS Enhanced SonicOSe是SonicWALL sonicOS操作系统最新版本，设计用于下一代SonicWALL firewall/VPN应用设备。 SonicOS的日志文件解析函数存在格式串问题，远程攻击者可以利用漏洞通过注入格式串字符到日志文件使系统崩溃或执行任意代码。 可通过多种方法注入格式串字符到日志中，当管理员使用SonicOS GUI查看日志时可触发此漏洞。 如下方法可测试此漏洞： 1，CFS:增加ebay.com到"Forbidden...

BlackBerry附件服务PDF处理器多个未明安全漏洞

Bugraq ID: 35102 CNCAN ID：CNCAN-2009052702 BlackBerry企业服务器的BlackBerry附件服务组件处理恶意PDF文件时存在多个安全问题，远程攻击者可以利用漏洞以应用服务进程权限执行任意指令，或导致拒绝服务攻击。 攻击者可以通过发送包含特殊构建的PDF文件的EMAIL消息来触发，目前没有详细漏洞细节提供。 Symantec Clientless VPN Gateway 4400 Series 4.0 SP3 Symantec Clientless VPN Gateway 4400 Series 4.0 SP2 Symantec...

SonicWALL Global VPN Client Privilege Escalation

SEC Consult Security Advisory ========================================================================== title: SonicWALL Global VPN Client Local Privilege Escalation Vulnerability program: SonicWALL Global VPN Client vulnerable version: Global VPN Client = 4.0.0.835 possibly other versions...

SonicWALL Global VPN Client weak file permissions

Everyone:Full Control permission on application folder...

SEC Consult SA-20090525-3 :: SonicWALL Global VPN Client Local Privilege Escalation Vulnerability

SEC Consult Security Advisory 20090525-3 ========================================================================== title: SonicWALL Global VPN Client Local Privilege Escalation Vulnerability program: SonicWALL Global VPN Client vulnerable version: Global VPN Client = 4.0.0.835 possibly other...

SEC Consult SA-20090525-4 :: SonicOS Format String Vulnerability

SEC Consult Security Advisory 20090525-4 ========================================================================== title: SonicOS Format String Vulnerability program: SonicWALL Global VPN Client vulnerable version: PRO 4100 SonicOS 4.0.0.2-51e Standard and Enhanced possibly other versions...

SonicOS Format String

SEC Consult Security Advisory ========================================================================== title: SonicOS Format String Vulnerability program: SonicWALL Global VPN Client vulnerable version: PRO 4100 SonicOS 4.0.0.2-51e Standard and Enhanced possibly other versions homepage:...

SonicWALL Global VPN Client < 4.0.0.830 Format String Vulnerabilities

The version of the SonicWALL Global VPN Client software installed on the remote Windows host fails to sanitize the 'name' attribute of the 'Connection' tag and the content of the 'Hostname' tag in the configuration file of format strings. If an attacker can trick a user on the affected host into...

SonicWALL Global VPN Client 4.0 - Log File Remote Format String

SonicWALL Global VPN Client 4.0 - Log File Remote Format String source: https://www.securityfocus.com/bid/35093/info SonicWALL Global VPN Client is prone to a remote format-string vulnerability because it fails to properly sanitize user-supplied input before passing it as the format specifier to ...

SonicWALL Global VPN Client 4.0 - Log File Remote Format String

source: https://www.securityfocus.com/bid/35093/info SonicWALL Global VPN Client is prone to a remote format-string vulnerability because it fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function. Successfully exploiting this issu...

Cisco Adaptive Security Appliance 8.x - Web VPN FTP or CIFS Authentication Form Phishing

source: https://www.securityfocus.com/bid/35475/info Cisco Adaptive Security Appliance ASA is prone to a vulnerability that can aid in phishing attacks. An attacker can exploit this issue to display a fake login window that's visually similar to the device's login window, which may mislead users...

NuPoint Messenger server transmits authentication credentials in plain text

Overview NuPoint Messenger is a unified communications product that connects to a Microsoft Exchange server. When communicating with the mail server, the NuPoint Messenger server transmits Exchange usernames and passwords in cleartext. Description The NuPoint Messenger server can connect to a...

Solaris 5.4 (x86) : 104750-01

Solstice FireWall-1 2.1c: FD leak in fwd VPN. Date this patch was last updated by Sun : Mar/28/97 %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a recommended security fix. Disabled on 2011/09/17. C Tenable Network Security, Inc. if !...

Solaris 5.3 (x86) : 104077-01

Firewall-1 2.1: Unix FW-1 VPN manager module creates zombie proces. Date this patch was last updated by Sun : Oct/04/96 %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a recommended security fix. Disabled on 2011/09/17. C Tenable Network...

MDVA-2008:002 : drakx-net

The VPN connection wizard failed to setup OpenVPN connections with username and password, because of a missing requirement in the package. This update package adds the perl-Net-Telnet dependency to solve the issue. %NASLMINLEVEL 70300 @DEPRECATED@ This script has been deprecated as the associated...

Solaris 5.4 (sparc) : 104075-01

Firewall-1 2.1: Unix FW-1 VPN manager module creates zombie proces. Date this patch was last updated by Sun : Oct/03/96 %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a recommended security fix. Disabled on 2011/09/17. C Tenable Network...

Solaris 5.4 (sparc) : 104748-01

Solstice FireWall-1 2.1c: FD leak in fwd VPN. Date this patch was last updated by Sun : Mar/28/97 %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a recommended security fix. Disabled on 2011/09/17. C Tenable Network Security, Inc. if !...

Solaris 5.3 (x86) : 104750-01

Solstice FireWall-1 2.1c: FD leak in fwd VPN. Date this patch was last updated by Sun : Mar/28/97 %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated as the associated patch is not currently a recommended security fix. Disabled on 2011/09/17. C Tenable Network Security, Inc. if !...

Microsoft IAG 2007 ActiveX控件栈缓冲区溢出漏洞

BUGTRAQ ID: 34532 CVE ID：CVE-2007-2238 CNCVE ID：CNCVE-20072238 Microsoft Intelligent Application Gateway是一款智能应用程序网关，提供SSL VPN功能。 Microsoft Whale Intelligent Application Gateway Whale客户端组件ActiveX控件存在缓冲区溢出，远程攻击者可以利用漏洞以应用程序权限执行任意指令。...

Microsoft Whale Intelligent Application Gateway Whale Client Components ActiveX control stack buffer overflows

Overview The Microsoft Whale Intelligent Application Gateway Whale Client Components ActiveX control contains multiple stack buffer overflows, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Whale Communications Intelligent...