Kibuv worm detection

A fake FTP server was installed by the KIBUV.B worm on this port. This worm uses known security flaws to infect the system. This machine may already be a 'zombi' used by crackers to perform distributed denial of service...

Internet Security Systems Protection Advisory: Snort Back Orifice Parsing Remote Code Execution

Internet Security Systems Protection Advisory October 18, 2005 Snort Back Orifice Parsing Remote Code Execution Summary: ISS X-Force has discovered a remotely exploitable vulnerability in Snort’s Back Orifice pre-processor. A stack-based overflow can be triggered with a single UDP packet, allowin...

Zotob Worm Infection (FTP)

Binary data 3165.prm...

Zotob Worm Infection (Shell)

Binary data 3166.prm...

CVE-2004-2348

CVE-2004-2348 affects Sybari AntiGen for Domino 7.0 Build 722 SR2. The vulnerability allows remote attackers to cause a denial of service (hang) by processing an encrypted ZIP file with the “include full path info” option, as observed in variants of the Beagle/Bagle worm. The available documents ...

CVE-2004-2348

Sybari AntiGen for Domino 7.0 Build 722 SR2 allows remote attackers to cause a denial of service hang via an encrypted ZIP file with the "include full path info" option set, as used by certain variants of the Beagle/Bagle worm...

Zotob Worm Infection (Microsoft)

Binary data 3164.prm...

Zotob Worm Detection

A Microsoft Windows shell is running on port 8888. This may indicate an infection by the Zotob worm, although other worms may also create a shell on this port. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid19429; scriptversion"1.10"; scriptnameenglish:"Zotob Worm...

CVE-2005-1983

CVE-2005-1983 involves a stack-based buffer overflow in the Windows Plug and Play (PnP) service. Public details in connected sources describe a remote-code-execution vulnerability that can be triggered by a crafted PnP RPC packet, affecting Windows 2000 and Windows XP with SP1, and was notably ex...

CVE-2005-1983

Stack-based buffer overflow in the Plug and Play PnP service for Microsoft Windows 2000 and Windows XP Service Pack 1 allows remote attackers to execute arbitrary code via a crafted packet, and local users to gain privileges via a malicious application, as exploited by the Zotob aka Mytob worm...

CVE-2005-1983

Stack-based buffer overflow in the Plug and Play PnP service for Microsoft Windows 2000 and Windows XP Service Pack 1 allows remote attackers to execute arbitrary code via a crafted packet, and local users to gain privileges via a malicious application, as exploited by the Zotob aka Mytob worm...

VulnCheck KEV: CVE-2005-1983

Stack-based buffer overflow in the Plug and Play PnP service for Microsoft Windows 2000 and Windows XP Service Pack 1 allows remote attackers to execute arbitrary code via a crafted packet, and local users to gain privileges via a malicious application, as exploited by the Zotob aka Mytob worm...

Kibuv Worm Detection

The welcome message on this port matches the banner of a known backdoor. This is highly suspicious. The host is probably infected by a backdoor and is probably under the control of malicious attackers. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid18367; scriptversio...

TFTP Backdoor Detection

A TFTP server is running on this port. However, while trying to fetch a random file, we got an executable file. Many worms are known to propagate through TFTP. This is probably a backdoor. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid18263; scriptversion "$Revision:...

CVE-2004-1909

The CVE-2004-1909 instance concerns ClamAV (0.68 and earlier) where processing certain RAR archives, such as those created by Beagle/Bagle variants, can crash the clamav process leading to a denial of service. Public references in Gentoo GLSA-200404-07 confirm the remote impact vector (RAR archiv...

CVE-2004-1909

Claim Anti-Virus ClamAV 0.68 and earlier allows remote attackers to cause a denial of service crash via certain RAR archives, such as those generated by the Beagle/Bagle worm...

CVE-2004-1909

Claim Anti-Virus ClamAV 0.68 and earlier allows remote attackers to cause a denial of service crash via certain RAR archives, such as those generated by the Beagle/Bagle worm...

ZeroBoard Worm Source Code

No description provided by source. / The worm exploits a vulnerability in ZeroBoard, allowing an attacker to inject arbitrary PHP code. /str0ke / / ZeroBoard -1day INE w0rm / include stdio.h include unistd.h include stdlib.h include sys/socket.h include netdb.h include netinet/in.h include signal...

ZeroBoard - Worm Source Code

ZeroBoard - Worm Source Code / The worm exploits a vulnerability in ZeroBoard, allowing an attacker to inject arbitrary PHP code. /str0ke / / ZeroBoard -1day INE w0rm / include include include include include include include include include ifdef sun include endif / SunOS / define DEBUGING undef...

ZeroBoard Worm Source Code

Exploit for unknown platform in category web applications ========================== ZeroBoard Worm Source Code ========================== / The worm exploits a vulnerability in ZeroBoard, allowing an attacker to inject arbitrary PHP code. /str0ke / / ZeroBoard -1day INE w0rm / include include...