Happy Labor Day from Snosoft

For your reading pleasure I have attached some of the communication between myself and CERT regarding the issues recently released at: ftp://ftp1.support.compaq.com/public/unix/v5.1/T64V51B19-C0136901-15143-ES-20020817.txt We are in the process of making our formal advisories out of these...

Immunity Canvas: TTDB_XDRARRAY

Name| ttdbxdrarray ---|--- CVE| CVE-2002-0391 Exploit Pack| CANVAS Description| rpc.ttdbserverd xdrarray Heap Overflow Notes| References: http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F46122 CVE Name: CVE-2002-0391 VENDOR: Sun Patch Info: Solaris 2.5.1: 103640-42, Solaris 2.6: 105401-3...

Immunity Canvas: IPLANET_CHUNKED

Name| iplanetchunked ---|--- CVE| CVE-2002-0845 Exploit Pack| CANVAS Description| iPlanet Chunked Encoding Notes| References: http://www.sun.com/service/sunone/software/alerts/transferencodingalert-23july2002.html http://www.eeye.com/html/Research/Advisories/AD20020808a.html CVE Name: CVE-2002-08...

RUS-CERT Advisory 2002-08:01: Incorrect integer overflow detection in C code

Incorrect integer overflow detection in C code A widely used method of detecting integer overflows results in undefined behavior according to the C standard. Who Should Read This Document This advisory deals with with details of the C programming language. It is targeted at C programmers. Systems...

Magic Enterprise contains multiple shell scripts that allow arbitrary file overwriting via symlink redirection of temporary file

Overview Some versions of Magic eDeveloper Enterprise Edition contain a symbolic-link vulnerability that allows attackers to overwrite data or execute arbitrary commands. Description Magic eDeveloper is a development environment for large-scale and distributed applications.Magic eDeveloper...

RAZOR advisory: Linux util-linux chfn local root vulnerability

Linux util-linux chfn local root vulnerability Issue Date: July 29, 2002 Contact: Michal Zalewski CVE: CAN-2002-0638 CERT vulnerability note: http://www.kb.cert.org/vuls/id/405955 the URL should be accessible soon Topic: A locally exploitable vulnerability is present in the util-linux package...

Advisory CA-2002-21 Vulnerability in PHP

-----BEGIN PGP SIGNED MESSAGE----- CERT Advisory CA-2002-21 Vulnerability in PHP Original release date: July 22, 2002 Last revised: -- Source: CERT/CC A complete revision history can be found at the end of this file. Systems Affected Systems running PHP versions 4.2.0 or 4.2.1 Overview A...

Lotus Domino Web Server discloses IP address

Overview Lotus Domino Web server discloses its IP address to some HTTP requests. Description Lotus Domino can be coerced to reveal its IP address by sending it a crafted HTTP request. --- Impact Attackers can discover limited information about the numbering of the Domino server's network. ---...

Advisory CA-2002-11 Heap Overflow in Cachefs Daemon (cachefsd)

-----BEGIN PGP SIGNED MESSAGE----- CERT Advisory CA-2002-11 Heap Overflow in Cachefs Daemon cachefsd Original release date: May 06, 2002 Last revised: Source: CERT/CC A complete revision history can be found at the end of this file. Systems Affected Sun Solaris 2.5.1, 2.6, 7, and 8 SPARC and Inte...

cryptcat does not encrypt data communications when -e command argument is used

Overview With certain options used, cryptcat does not encrypt network connections as expected. Description Cryptcat is an enhanced version of netcat that adds twofish encryption.If cryptcat is started in listen server mode binding a shell to a network port, cryptcat fails to enable encryption...

Vulnerability Netgear RP-114 Router - nmap causes DOS

BugTraq, This has been submitted to CERT as well. Here is the form I sent to them: CONTACT INFORMATION ============================================================================ === Let us know who you are: Name : Omkhar Arasaratnam E-mail : [email protected] Phone / fax :...

SysV /bin/login Environment Remote Overflow (rlogin)

The remote /bin/login seems to crash when it receives too many environment variables. This is likely due to a buffer overflow vulnerability which might allow an attacker to execute arbitrary code on the remote host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid1082...

Immunity Canvas: SUNLOGIN_PAMH

Name| sunloginpamh ---|--- CVE| CVE-2001-0797 Exploit Pack| CANVAS Description| Sun Login pamh Overflow Notes| References: http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F41987&zone32=category%3Asecurity CVE Name: CVE-2001-0797 VENDOR: Sun Patch Information: Solaris 2.5.1 patch 106160-0...

Secure Computing SafeWord uses vulnerable ssh server

Secure Computing's SafeWord PremierAccess product earlier known as SafeWord Plus is an access control system capable of using several different authentication mechanisms for controlling access to network resources. The most used mechanism is one time passwords, generated by hardware or software...

Sun Security Bulletin #00206 (fwd) [Patches for in.lpd]

Sun Microsystems, Inc. Security Bulletin Bulletin Number: 00206 Date: August 30, 2001 Cross-Ref: CERT Advisory CA-2001-15 Title: in.lpd The information contained in this Security Bulletin is provided "AS IS." Sun makes no warranties of any kind whatsoever with respect to the information contained...

Sun Security Bulletin #00207 (fwd) [Patches for snmpXdmid.]

Sun Microsystems, Inc. Security Bulletin Bulletin Number: 00207 Date: August 30, 2001 Cross-Ref: CERT Advisory CA-2001-05 Title: snmpXdmid The information contained in this Security Bulletin is provided "AS IS." Sun makes no warranties of any kind whatsoever with respect to the information...

Immunity Canvas: ORACLE8LISTENER_WIN32

Name| oracle8listenerwin32 ---|--- CVE| CVE-2001-0499 Exploit Pack| CANVAS Description| Oracle8i TNS Listener stack overflow Notes| References: http://otn.oracle.com/deploy/security/pdf/nainet8bof.pdf CVE Name: CVE-2001-0499 VENDOR: Oracle Repeatability: Single shot Date public: 27-06-2001 CERT...

Multiple versions of OpenLDAP are vulnerable to denial-of-service attacks

Overview Multiple versions of OpenLDAP contain vulnerabilities that may allow denial-of-service attacks. These vulnerabilities were revealed using the PROTOS LDAPv3 test suite and are documented in CERT Advisory CA-2001-18. If your site uses this product, the CERT/CC encourages you to follow the...

Advisory CA-2001-09

-----BEGIN PGP SIGNED MESSAGE----- CERT Advisory CA-2001-09 Statistical Weaknesses in TCP/IP Initial Sequence Numbers Original release date: May 01, 2001 Last revised: -- Source: CERT/CC A complete revision history can be found at the end of this file. Systems Affected Systems using TCP stacks...

Advisory CA-2001-05

-----BEGIN PGP SIGNED MESSAGE----- CERT Advisory CA-2001-05 Exploitation of snmpXdmid Original release date: March 30, 2001 Source: CERT/CC A complete revision history can be found at the end of this file. Systems Affected Any machine running Solaris 2.6, 7, or 8 with snmpXdmid installed and...