ISS Security Brief: Multiple Vulnerabilities in Microsoft RPC Service

-----BEGIN PGP SIGNED MESSAGE----- Internet Security Systems Security Brief September 10, 2003 Multiple Vulnerabilities in Microsoft RPC Service Synopsis: Microsoft has released a security bulletin MS03-039 detailing three distinct vulnerabilities in the Windows RPC Remote Procedure Call...

MS Blaster Worm (msblast.exe) Infection Detection

The remote host seems to be infected by the MS Blaster worm, or the Nachi worm, which may make this host attack random hosts on the internet. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid11818; scriptversion"1.28"; scriptcvsdate"Date: 2018/11/15 20:50:28";...

CVE-2003-0352

CVE-2003-0352 describes a buffer overflow vulnerability in the DCOM RPC interface (RPCSS) of Windows NT 4.0 SP3-6a, Windows 2000, XP, and Server 2003. The issue is a stack/heap buffer overflow triggered by a malformed DCERPC DCOM object activation request with modified length fields, allowing rem...

PT-2003-1555 · Microsoft · Windows 2000 +3

Name of the Vulnerable Software and Affected Versions: Microsoft Windows NT 4.0, 2000, XP, and Server 2003 Description: A buffer overflow issue in a certain DCOM interface for RPC allows remote attackers to execute arbitrary code via a malformed message. This issue has been exploited by the...

Bugbear.B Worm Detection

The BugBear.B backdoor appears to be listening on this port. An attacker may connect to it to retrieve secret information such as passwords, credit card numbers, etc. The BugBear.B worm includes a keylogger and can kill antivirus and firewall software. It propagates through email and open Windows...

Microsoft IIS 5.0 (Windows XP2000NT 4.0) - WebDAV ntdll.dll Remote Buffer Overflow (3)

Microsoft IIS 5.0 Windows XP2000NT 4.0 - WebDAV ntdll.dll Remote Buffer Overflow 3 E-DB Note: Updated Exploit https://www.exploit-db.com/exploits/22368/ source: https://www.securityfocus.com/bid/7116/info The Windows library ntdll.dll includes a function that does not perform sufficient bounds...

Microsoft Windows Administrator Default Password Detection (W32/Deloder Worm Susceptibility)

W32/Deloder is a worm that tries to connect to a remote share by using a list of built-in administrator passwords. Nessus was able to connect to this host with one of these credentials. The worm W32/Deloder may use it to break into the remote host and upload infected data in the remote shares. C...

MS SQL Worm Mitigation Recommendations

...

Bugbear Worm Detection

The BugBear backdoor is listening on this port. An attacker may connect to it to retrieve secret information such as passwords, credit card numbers, etc. The BugBear worm includes a keylogger and can kill antivirus and firewall software. It propagates through email and open Windows shares...

CVE-2002-0649

CVE-2002-0649 describes a remote buffer-overflow in the SQL Server Resolution Service of Microsoft SQL Server 2000 and MSDE (port 1434/UDP). The vulnerability is triggered by UDP packets beginning with 0x04 (long registry key name) or 0x08 (long string), which can cause a denial of service or arb...

CVE-2002-0649

Multiple buffer overflows in the Resolution Service for Microsoft SQL Server 2000 and Microsoft Desktop Engine 2000 MSDE allow remote attackers to cause a denial of service or execute arbitrary code via UDP packets to port 1434 in which 1 a 0x04 byte that causes the SQL Monitor thread to generate...

FreeBSD Security Advisory FreeBSD-SA-02:26.accept

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-02:26.accept Security Advisory The FreeBSD Project Topic: Remote denial-of-service when using accept filters Category: core Module: kernel Announced: 2002-05-29 Credits: Mik...

CVE-2001-1134

Xerox DocuPrint N40 Printers allow remote attackers to cause a denial of service via malformed data, such as that produced by the Code Red worm...

Microsoft Windows NT 4.0/2000 - Process Handle Local Privilege Escalation

source: https://www.securityfocus.com/bid/4287/info A vulnerability in Microsoft Windows 2000 and NT 4 could allow a user to gain SYSTEM-level privileges on the local host. The debugging subsystem, which is available to all users, may be used to create duplicate handles to a privileged process...

Nimda Worm Infected HTML File Detection

The remote web server appears to have been compromised by the Nimda mass mailing worm. It uses various known IIS vulnerabilities to compromise the server. Visitors to such a compromised web server may be prompted to download an .eml Outlook Express email file, which contains the worm as an...

LPRng/rhs-printfilters - remote execution of commands

posted to vendor security ppl, no reply, no patch, so posting here. --begin forwarded message-- RedHat 7.0 possibly others If the lpd is listening on 0.0.0.0 and no access controls are in place, it is possible to execute commands as the lp user, assuming tetex-dvips is installed. From man dvips...

Microsoft Internet Information Server 4.0 (IIS) vulnerable to DoS when URL redirecting is enabled

Overview A vulnerability in IIS 4.0 may permit intruders to crash vulnerable IIS servers with URL redirection enabled. Description A vulnerability in Microsoft IIS 4.0 allows an attacker to crash IIS 4.0 servers if they are configured to use URL redirection. URL redirection is not used by default...

CVE-2001-1134

Xerox DocuPrint N40 Printers allow remote attackers to cause a denial of service via malformed data, such as that produced by the Code Red worm...

"Code Red" Worm - Customer Impact

...

Microsoft Index Server 2.0 / Indexing Service (Windows 2000) - ISAPI Extension Buffer Overflow (2)

/ source: https://www.securityfocus.com/bid/2880/info Windows Index Server ships with Windows NT 4.0 Option Pack; Windows Indexing Service ships with Windows 2000. An unchecked buffer resides in the 'idq.dll' ISAPI extension associated with each service. A maliciously crafted request could allow...