CVE-2004-1909

Claim Anti-Virus ClamAV 0.68 and earlier allows remote attackers to cause a denial of service crash via certain RAR archives, such as those generated by the Beagle/Bagle worm...

CVE-2004-1762

Unknown vulnerability in F-Secure Anti-Virus FSAV 4.52 for Linux before Hotfix 3 allows the Sober.D worm to bypass FASV...

PhpInclude.Worm - PHP Scripts Automated Arbitrary File Inclusion

No description provided by source. !/usr/bin/perl use LWP::Simple; use IO::Socket::INET; while1 $numr = int rand9999; $caxe = "."; $caxe1 = "."; $caxe .= rand9999; $caxe1 .= rand9999; $arq = "."; $arq = int rand9999; opensites,"$arq"; print sites ""; closesites; $procura = 'inurl:.php?=' . $numr;...

phpBB 2.0.10 - Santy.A Worm highlight Arbitrary File Upload

phpBB 2.0.10 - Santy.A Worm highlight Arbitrary File Upload Santy.A - phpBB 3; open IN, $0 or exit; my $self = join '', ; close IN; unlink $0; while!GrabURL'http://www.google.com/advancedsearch' if$generation 3 PayLoad ; else exit; $self = s/my $generation = \d+;/'my $generation = ' . $1 + 1...

phpBB highlight Arbitrary File Upload (Santy.A)

No description provided by source. Santy.A - phpBB = 2.0.10 Web Worm Source Code Proof of Concept -SECU For educational purpose See : http://isc.sans.org/diary.php?date=2004-12-21 http://www.f-secure.com/v-descs/santya.shtml !/usr/bin/perl use strict; use Socket; sub PayLoad; sub DoDir$; sub DoFi...

phpBB < 2.0.10 - 'Santy.A Worm' 'highlight' Arbitrary File Upload

Santy.A - phpBB 3; open IN, $0 or exit; my $self = join '', ; close IN; unlink $0; while!GrabURL'http://www.google.com/advancedsearch' if$generation 3 PayLoad ; else exit; $self = s/my $generation = \d+;/'my $generation = ' . $1 + 1 . ';'/e; my $selfFileName = 'm1ho2of'; my $markStr =...

Microsoft IE FRAME/IFRAME/EMBED Tag Overflow (Bofra Worm Detection)

The remote host seems to have been infected with the Bofra worm or one of its variants, which infects machines via an Internet Explorer IFRAME exploit. It is very likely this system has been compromised. Bofra virus detection Author: Brian Smith-Sweeney [email protected]...

CVE-2004-1315

viewtopic.php in phpBB 2.x before 2.0.11 improperly URL decodes the highlight parameter when extracting words and phrases to highlight, which allows remote attackers to execute arbitrary PHP code by double-encoding the highlight value so that special characters are inserted into the result, which...

w32.spybot.fcd Worm Infection Detection

The remote system is infected with a variant of the worm w32.spybot.fcd. Infected systems will scan systems that are vulnerable in the same subnet in order to spread, creating a botnet that has been used for purposes such as DDoS attacks. This script was written by Jorge E Rodriguez - check the...

Witty Worm Detection

Binary data 1182.prm...

Trojan/Backdoor Detection - Sasser Worm

Binary data 1215.prm...

Zincite.A (MyDoom.M) Backdoor Detection

The backdoor 'BackDoor.Zincite.A' is installed on the remote host. It has probably been installed by the 'MyDoom.M' virus. This backdoor may allow an attacker to gain unauthorized access on the remote host. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid14184;...

W32.Dabber Worm Detection

The W32.Dabber worm is listening on this port. W32.Dabber propagates by exploiting a vulnerability in the FTP server component of W32.Sasser.Worm and its variants. It installs a backdoor on infected hosts and tries to listen on port 9898. If the attempt fails, it tries to listen on ports 9899...

Korgo Worm Detection

Nessus found that TCP ports 113 and 3067 are open. The Korgo worm is known to open a backdoor on these ports. It propagates by exploiting the LSASS vulnerability on TCP port 445 as described in Microsoft Security Bulletin MS04-011 Note that Nessus did not try to talk to the backdoor, so this migh...

Sasser Worm ftpd - Remote Buffer Overflow (port 5554)

Sasser Worm ftpd - Remote Buffer Overflow port 5554 / / // / / / / \ / / / / / / / // // / // / // //// - ROMANIAN SECURITY RESEARCH 2004 - sasser va-e exploit of its ftpd server exploit version 1.4, public author: mandragore date: Mon May 10 16:13:31 2004 vuln type: SEH ptr overwriting greets:...

Sasser Worm ftpd - Remote Buffer Overflow (port 5554)

/ / // / / / / \ / / / / / / / // // / // / // //// - ROMANIAN SECURITY RESEARCH 2004 - sasser va-e exploit of its ftpd server exploit version 1.4, public author: mandragore date: Mon May 10 16:13:31 2004 vuln type: SEH ptr overwriting greets: rosecurity team discovery: edcba note: sasser.e has...

Sasser Worm avserve FTP PORT Buffer Overflow

This module exploits the FTP server component of the Sasser worm. By sending an overly long PORT command the stack can be overwritten. Module Options msf use exploit/windows/ftp/sasser/ftpdport msf undefinedftpdport show actions ...actions... msf undefinedftpdport set ACTION msf undefinedftpdport...

CVE-2003-0533

A stack-based buffer overflow vulnerability exists in the LSASRV.DLL component of the Local Security Authority Subsystem Service (LSASS) in several Microsoft Windows versions, including Windows NT 4.0 SP6a, 2000 SP2-SP4, XP SP1, Server 2003, Windows 98, and Windows ME . The root cause is located ...

CVE-2003-0533

Stack-based buffer overflow in certain Active Directory service functions in LSASRV.DLL of the Local Security Authority Subsystem Service LSASS in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute...

CVE-2004-0362

Multiple stack-based buffer overflows in the ICQ parsing routines of the ISS Protocol Analysis Module PAM component, as used in various RealSecure, Proventia, and BlackICE products, allow remote attackers to execute arbitrary code via a SRVMULTI response containing a SRVUSERONLINE response packet...