D-Link DCS-900 Camera - Remote IP Address Changer

/ dlinkdown.c - miscname.com change ip address on all dlink dcs-900 cameras on the local network without authentication dlink dcs-900 ip cameras use a broadcast/listen method of configuration ... rather than a static ip addr out of the box, it listens for a 62976/udp broadcast packet telling it...

CVE-2004-0593

Sygate Enforcer 3.5MR1 and earlier passes broadcast traffic before authentication, which could allow remote attackers to bypass filtering rules...

CVE-2004-0593: Undefined Security Weakness

Sygate Enforcer 3.5MR1 and earlier passes broadcast traffic before authentication, which could allow remote attackers to bypass filtering rules...

Sygate Enforcer broadcast protection bypass and DoS

Broadcast packets are not filtered. It's possible to cause device shutdown by sending malformed broadcast packet to UDP/39999...

Corsaire Security Advisory - Sygate Enforcer unauthenticated broadcast issue

-- Corsaire Security Advisory -- Title: Sygate Enforcer unauthenticated broadcast issue Date: 20.11.03 Application: Sygate Enforcer prior to 3.5MR1 Environment: Windows NT, 2000, 2003 Author: Martin O'Neal [email protected] Audience: General distribution Reference: c031120-003 -- Scope --...

Unreal Tournament 2004 "secure" Overflow (Linux)

This is an exploit for the GameSpy secure query in the Unreal Engine. This exploit only requires one UDP packet, which can be both spoofed and sent to a broadcast address. Usually, the GameSpy query server listens on port 7787, but you can manually specify the port as well. The RunServer.sh scrip...

Colin McRae Rally 04 broadcast clients crash

Luigi Auriemma Application: Colin McRae Rally 04 http://www.codemasters.com/colinmcraerally04/ Versions: 1.0 Platforms: Windows Bug: bad allocation ? Risk: medium Exploitation: remote, versus clients broadcast Date: 04 June 2004 Author: Luigi Auriemma e-mail: [email protected] web:...

Chatman <= 1.5.1 RC1 Broadcast Crash Exploit

No description provided by source. / by Luigi Auriemma / include stdio.h include stdlib.h include string.h ifdef WIN32 include winsock.h include string.h include errno.h void stderrvoid char error; switchWSAGetLastError case 10004: error = "Interrupted system call"; break; case 10009: error = "Ba...

Chatman <= 1.5.1 RC1 Broadcast Crash Exploit

Exploit for unknown platform in category dos / poc ============================================ Chatman include include ifdef WIN32 include include include void stderrvoid char error; switchWSAGetLastError case 10004: error = "Interrupted system call"; break; case 10009: error = "Bad file number"...

CVE-2002-0381

The TCP implementation in various BSD operating systems tcpinput.c does not properly block connections to broadcast addresses, which could allow remote attackers to bypass intended filters via packets with a unicast link layer address and an IP broadcast address...

CVE-2002-0381

The CVE-2002-0381 entry concerns the TCP implementation in various BSD operating systems (tcp_input.c) that fails to properly block connections to broadcast addresses. This allows remote attackers to bypass filters by sending packets with a unicast link-layer address to an IP broadcast address. A...

CVE-2002-0381: Undefined Security Weakness

The TCP implementation in various BSD operating systems tcpinput.c does not properly block connections to broadcast addresses, which could allow remote attackers to bypass intended filters via packets with a unicast link layer address and an IP broadcast address...

CVE-2002-0381

The TCP implementation in various BSD operating systems tcpinput.c does not properly block connections to broadcast addresses, which could allow remote attackers to bypass intended filters via packets with a unicast link layer address and an IP broadcast address...

Cisco IOS ARP Table Overwrite DoS (CSCdu81936)

It is possible to send an Address Resolution Protocol ARP packet on a local broadcast interface for example, Ethernet, cable, Token Ring, FDDI which could cause a router or switch running specific versions of Cisco IOS Software Release to stop sending and receiving ARP packets on the local router...

CVE-2001-1261

Avaya Argent Office 2.1 may allow remote attackers to change hold music by spoofing a legitimate server's response to a TFTP broadcast and providing an alternate HoldMusic file...

CVE-2001-1261: Undefined Security Weakness

Avaya Argent Office 2.1 may allow remote attackers to change hold music by spoofing a legitimate server's response to a TFTP broadcast and providing an alternate HoldMusic file...

Broadcast IP TCP connection in BSD systems

TCP SYN packets to broadcast address are accepted...

CVE-2001-1261

Avaya Argent Office 2.1 may allow remote attackers to change hold music by spoofing a legitimate server's response to a TFTP broadcast and providing an alternate HoldMusic file...

ARPNuke - 80 kb/s kills a whole subnet

Hi ppl, It is time for a new ґnukeґ - ARPNuke. There is an ARP table handling bug in Microsoft Windows protocoll stacks. It seems that the arp handling code uses some inefficient data structure maybe a simple linear table? to manage the ARP entries. Sending a huge amount of ґrandomґ that is rando...

CVE-2000-0742: Undefined Security Weakness

The IPX protocol implementation in Microsoft Windows 95 and 98 allows remote attackers to cause a denial of service by sending a ping packet with a source IP address that is a broadcast address, aka the "Malformed IPX Ping Packet" vulnerability...