Linksys WIP 330 VoIP wireless phone crash from Nmap scan

Vulnerability Description ================== The Linksys WIP 330 VoIP wireless phone will crash when a full port-range Nmap scan is run against its IP address. Linksys WIP 330 Firmware Version ========================== 1.00.06A Nmap scan command ================ nmap -P0 WIP 330 ip address -p...

Windows CE MMS多媒体短信编辑器远程溢出漏洞

Windows CE是微软开发维护的运行于嵌入式设备的操作系统。 Windows CE自带的MMS多媒体短信编辑器程序实现上存在多个缓冲区溢出漏洞，远程攻击者可能利用此漏洞在用户设备上执行任意指令。 MMS多媒体短信编辑器在处理短信中TransactionID、Subject、ContentLocation等多个头部字段时存在溢出问题，攻击者可能通过向受害者发送畸形MMS消息导致在用户机器上执行任意指令。 Microsoft MMS Composer 2.0.0.13 Microsoft MMS Composer 1.5.5.6...

[NT] PicoWebServer Unicode Stack Overflow

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

PicoWebServer Remote Unicode Stack Overflow

Title: PicoWebServer Remote Unicode Stack Overflow Release Date: 28. May 2005 Author: Dennis Elser dennis backtrace de Vendor: Newmad Technologies http://www.newmad.se Vendor Status: Contacted Product: PicoWebServer Affected Version: 1.0 Platform: Microsoft Windows CE / PocketPC Processor Type: A...

CVE-2005-1395

Buffer overflow in Ce/Ceterm aka ARPUS/Ce 2.5.4 and earlier may allow local users to gain privileges via a long 1 XAPPLRESLANGPATH or 2 XAPPLRESDIR environment variable, or 3 command line argument...

CVE-2005-1396

Race condition in Ce/Ceterm aka ARPUS/Ce 2.5.4 and earlier allows local users to write to arbitrary files via a symlink attack on the ceeditlog temporary file...

DMA[2005-0501a] - 'ARPUS/Ce setuid buffer overflow and file overwrite'

DMA2005-0501a - 'ARPUS/Ce setuid buffer overflow and file overwrite' Author: Kevin Finisterre Vendor: http://www.swlink.net/styma/ce.shtml, http://168.158.26.15/ce/ce/ce.html Product: 'Ce/Ceterm' References: http://www.digitalmunition.com/DMA2005-0501a.txt Description: Ce/Ceterm aka. ARPUS/Ce is ...

CVE-2005-1396

The CVE-2005-1396 entry describes a race condition in Ce/Ceterm (aka ARPUS/Ce) versions 2.5.4 and earlier. The underlying issue allows local users to write to arbitrary files via a symlink attack on the ce_edit_log temporary file. Affected component: Ce/Ceterm, vulnerable file handling during log...

CVE-2005-1396

Race condition in Ce/Ceterm aka ARPUS/Ce 2.5.4 and earlier allows local users to write to arbitrary files via a symlink attack on the ceeditlog temporary file...

CVE-2005-1395

CVE-2005-1395 affects Ce/Ceterm (aka ARPUS/Ce) 2.5.4 and earlier. The vulnerability is a buffer overflow that can allow local users to gain privileges when a long environment variable (XAPPLRESLANGPATH or XAPPLRESDIR) is set or via a long command line argument. The Red Hat and NVD entries confirm...

CVE-2005-1395

Buffer overflow in Ce/Ceterm aka ARPUS/Ce 2.5.4 and earlier may allow local users to gain privileges via a long 1 XAPPLRESLANGPATH or 2 XAPPLRESDIR environment variable, or 3 command line argument...

ARPUS/Ce Local Overflow Exploit (setuid) (perl)

No description provided by source. !/usr/bin/perl -w Setuid ARPUS/ce exploit by KF - kflistsatdigitalmunitiondotcom - 4/21/05 Copyright Kevin Finisterre kfinisterre@threat:/tmp$ ./ceex.pl sh-2.05b id uid=0root gid=1000kfinisterre groups=20dialout,24cdrom,25floppy,29audio,44video,1000kfinisterre 5...

ARPUS/Ce Local File Overwrite Exploit (setuid)

No description provided by source. / Copyright Kevin Finisterre - ripped from my perlex.c DISCLAIMER I am in no way responsible for your stupidity. DISCLAIMER I am in no way liable for any damages caused by compilation and or execution of this code. WARNING DO NOT RUN THIS UNLESS YOU KNOW WHAT YO...

ARPUS/Ce - Local Overflow (setuid)

!/usr/bin/perl -w Setuid ARPUS/ce exploit by KF - kflistsatdigitalmunitiondotcom - 4/21/05 Copyright Kevin Finisterre kfinisterre@threat:/tmp$ ./ceex.pl sh-2.05b id uid=0root gid=1000kfinisterre groups=20dialout,24cdrom,25floppy,29audio,44video,1000kfinisterre 57 bytes long $sc = "\x90"x512; $sc ...

PT-2001-1393 · Microsoft · Wince

Name of the Vulnerable Software and Affected Versions: WinCE version 3.0.9348 Description: The issue allows remote attackers to spoof or hijack TCP connections due to the generation of predictable TCP Initial Sequence Numbers ISNs. Recommendations: For WinCE version 3.0.9348, at the moment, there...