Alcatel Operating System (AOS) does not require a password for accessing the telnet server

Overview The OmniSwitch 7700/7800 running Alcatel Operating System AOS version 5.1.1 has TCP port 6778 listening as a telnet server. This gives anyone access to the OmniSwitch's Vx-Works operating system without requiring a password. Description During an NMAP audit of the AOS 5.1.1 code that run...

Apache 1.3.26

I recently did a very brief and non-exhaustive security audit of Apache 1.3.26, and noticed some small potential bugs in some of the helper programs that come with the distribution. Apache maintainers have been notified, and the most serious of these bugs have been fixed in 1.3.27. I'm sending th...

alya.cgi CGI Backdoor Detection

alya.cgi was found on the remote system. This script is likely a CGI based backdoor distributed with multiple rootkits. This script was written by Jason Lidow Changes by Tenable: - Overhauled description, added Synopsis/Reference/Solution 12/8/2008 include"compat.inc"; if description scriptid1111...

Tiny Personal Firewall DoS

DoS against audit subsystem on large amount of audit info, problem hadling spoofed packets with IP's from FW itself...

CVE-2002-0725

NTFS file system in Windows NT 4.0 and Windows 2000 SP2 allows local attackers to hide file usage activities via a hard link to the target file, which causes the link to be recorded in the audit trail instead of the target file...

PT-2002-1747 · Microsoft · Windows 2000 +1

Name of the Vulnerable Software and Affected Versions: Windows NT versions prior to 4.0 SP3 Windows 2000 versions prior to SP3 Description: The issue allows local attackers to hide file usage activities by creating a hard link to the target file. This causes the link to be recorded in the audit...

DSA-136 openssl - multiple remote exploits

Bulletin has no description...

Multiple Server Crafted Request WEB-INF Directory Information Disclosure

By making a specially-formatted request to the remote web server, it is possible to retrieve files located under the 'WEB-INF' directory. Note that this vulnerability is known to affect the Win32 versions of multiple J2EE servlet containers / application servers. %NASLMINLEVEL 70300 This script w...

latest Progress patch has suid issues AGAIN.

Progress 9.1C11 Patch date 2002/04/26 http://www.progress.com/patches/patchlst/91C-178v.htm Once again by ignoring my warnings and suggestions and even offers to audit code prior to release for the public, Progress Software has happened upon a security hole. If you will recall from last month...

Compaq tru64 setuids /usr/bin/at and /usr/dt/bin/mailcv

Heres some the results of my latenight audit on Tru64. Its too late for me to mess with Compaqs web site to get the security contact I am tired and don't care or something. If someone has TRU64 gdb binaries I would love them... its too late for me to be playing with the Tru64 ladebug also... get ...

Microsoft Windows 'Domain Administrators' Group User List

Using the supplied credentials, it is possible to extract the member list of the 'Domain Administrators' group. Members of this group have complete access to the Windows Domain. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10908; scriptversion"1.24";...

Переполнение буфера в dlvr_audit под OpenServer (buffer overflow)

Классическое переполнение буфера...

Обход аудита в blackice (audit bypass)

Не логаются пакеты имеющие флаг URG...

CVE-2001-0831

Unknown vulnerability in Oracle Label Security in Oracle 8.1.7 and 9.0.1, when audit functionality, SETLABEL, or SQLPredicate is being used, allows local users to gain additional access...

CVE-2001-0831

Unknown vulnerability in Oracle Label Security in Oracle 8.1.7 and 9.0.1, when audit functionality, SETLABEL, or SQLPredicate is being used, allows local users to gain additional access...

Weak authentication in iBill's Password Management CGI

Vulnerable Program: ibillpm.pl Perl CGI script Distributed by: iBill Internet Billing Company, http://www.ibill.com Problem: iBill hard codes a weak password for the user management script, ibillpm.pl, installed for clients that use the Password Management system. The weak password is the client'...

results of semi-automatic source code audit

/ results of semi-automatic source code audit of a majority of php based open-source projects registered at Freshmeat.net or Sourceforge.net release date: 2001-10-02 authors: atil [email protected] genetics [email protected] yaht@ircnet, Yet Another Hacker Team / --=introduction=-- ph...

NetBSD Security Advisory 2001-015: Insufficient checking of lengths passed to kernel

-----BEGIN PGP SIGNED MESSAGE----- NetBSD Security Advisory 2001-015 ================================= Topic: Insufficient checking of lengths passed from userland to kernel Version: NetBSD-current: source prior to August 5, 2001 NetBSD-1.5.1: affected NetBSD-1.5: affected NetBSD-1.4.: affected...

Многочисленные ошибки в xinetd (multiple bugs)

Проведенный аудит кода выявил многочисленные ошибки...

xinetd 2.3.0 audit status

Hi, As some of you may know, I've performed an audit of the xinetd 2.3.0 source code for certain classes of vulnerabilities. The audit has resulted in a significant number of fixes many are for non-security issues. The patch was over 100 KB large and got incorporated into xinetd starting with...