Multiple vendors' Domain Name System (DNS) stub resolvers vulnerable to buffer overflows

Overview Buffer overflow vulnerabilities exists in the DNS stub resolver library used by BSD, ISC BIND, and GNU glibc. Other systems that use DNS resolver code derived from ISC BIND may also be affected. An attacker who is able to control DNS responses could exploit arbitrary code or cause a deni...

CVE-2002-0381

The TCP implementation in various BSD operating systems tcpinput.c does not properly block connections to broadcast addresses, which could allow remote attackers to bypass intended filters via packets with a unicast link layer address and an IP broadcast address...

procmail heap overflow

hi, i found a heap overflow in procmail up until latest some time ago. flatline@intra:/usr/bin$ ls -la procmail -rwsr-xr-x 1 root mail 64344 Jun 3 2001 procmail flatline@intra:/usr/bin$ ./procmail perl -e 'print "A"x10240'=A procmail: Exceeded LINEBUF Segmentation fault flatline@intra:/usr/bin$ a...

[CERT-intexxia] mmftpd FTP Daemon Format String Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SECURITY ADVISORY INTEXXIAc 04 06 2002 ID 1053-040602 TITLE : mmftpd FTP Daemon Format String Vulnerability CREDITS : Guillaume Pelat / INTEXXIA SYSTEM AFFECTED =============== mmftpd = 0.0.7 DESCRIPTION =========== "mmftpd is a secure FTP server that...

CVE-2002-0572

CVE-2002-0572 affects BSD-based systems (notably FreeBSD 4.5 and earlier); the issue arises when a local user closes standard input/output/error (FDs 0–2) and a subsequent setuid-invoked I/O operation reuses those descriptors, allowing read/write access to restricted files. Connected records corr...

Apple Mac OSX 10.x FreeBSD 4.x OpenBSD 2.x Solaris 2.52.67.08 - exec C Library Standard IO File Descriptor Closure

Apple Mac OSX 10.x FreeBSD 4.x OpenBSD 2.x Solaris 2.52.67.08 - exec C Library Standard IO File Descriptor Closure / source: https://www.securityfocus.com/bid/4568/info It has been reported that BSD-based kernels do not check to ensure that the C library standard I/O file descriptors 0-2 are vali...

Apple Mac OSX 10.x / FreeBSD 4.x / OpenBSD 2.x / Solaris 2.5/2.6/7.0/8 - 'exec C Library' Standard I/O File Descriptor Closure

/ source: https://www.securityfocus.com/bid/4568/info It has been reported that BSD-based kernels do not check to ensure that the C library standard I/O file descriptors 0-2 are valid open files before execing setuid images. Consequently, I/O that are opened by a setuid process may be assigned fi...

*BSD YP authentication privelege escalation

No description provided...

TCP Connections to a Broadcast Address on BSD-Based Systems

BSD-based TCP/IP code has a bug with respect to creating TCP connections to a broadcast address. This bug can potentially be a security vulnerability when firewall administrators assume that the TCP implementation works correctly and do not block broadcast addresses. If good security practices ha...

Broadcast IP TCP connection in BSD systems

TCP SYN packets to broadcast address are accepted...

CVE-1999-1098

The CVE-1999-1098 entry describes a vulnerability in the BSD Telnet client that uses encryption and Kerberos 4 authentication, enabling remote attackers to decrypt the session by sniffing traffic. Reported impact is partial confidentiality loss with a CVSS v2 base score of 5.0 (Network vector, Lo...

CVE-2001-0554

Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows remote attackers to execute arbitrary commands via a set of options including AYT Are You There, which is not properly handled by the telrcv function...

CVE-2001-0670

Buffer overflow in BSD line printer daemon in.lpd or lpd in various BSD-based operating systems allows remote attackers to execute arbitrary code via an incomplete print job followed by a request to display the printer queue...

CVE-1999-1098

Vulnerability in BSD Telnet client with encryption and Kerberos 4 authentication allows remote attackers to decrypt the session via sniffing...

CVE-1999-1214

The asynchronous I/O facility in 4.4 BSD kernel does not check user credentials when setting the recipient of I/O notification, which allows local users to cause a denial of service by using certain ioctl and fcntl calls to cause the signal to be sent to an arbitrary process ID...

CVE-1999-1102

lpr on SunOS 4.1.1, BSD 4.3, A/UX 2.0.1, and other BSD-based operating systems allows local users to create or overwrite arbitrary files via a symlink attack that is triggered after invoking lpr 1000 times...

CVE-2001-0554

CVE-2001-0554 affects netkit-telnetd (Telnet daemon) on BSD-based systems, via a buffer overflow in in.telnetd/telrcv handling (triggered by certain Telnet options such as AYT). OpenVAS entries describe a remote attacker potentially causing denial of service or gaining remote code execution; at l...

CVE-2001-0670

CVE-2001-0670 is a remote buffer overflow in the BSD line printer daemon (in.lpd/lpd) that can allow an attacker to execute arbitrary code with elevated privileges. The vulnerability is triggered by a crafted, incomplete print job followed by a request to display the printer queue, and the attack...

CVE-1999-1102

The CVE-1999-1102 entry concerns lpr on SunOS 4.1.1, BSD 4.3, A/UX 2.0.1 and other BSD-based systems. The vulnerability arises from a symlink-related attack in lpr that enables local users to create or overwrite arbitrary files after the program is invoked 1000 times. Root cause is a symlink hand...

CVE-1999-1402

The access permissions for a UNIX domain socket are ignored in Solaris 2.x and SunOS 4.x, and other BSD-based operating systems before 4.4, which could allow local users to connect to the socket and possibly disrupt or control the operations of the program using that socket...