Microsoft Malware Protection Engine TWO DoS Vulnerabilities

CVE-2008-1437 CVE-2008-1438 There are two vulnerabilities idenitified in Microsoft Antivirus product. These vulnerabilities can be exploited to cause Denial of service. 1. CVE-2008-1437 PE Parsing Memory Corruption While scanning a specially crafted PE file, Malware orotection engine...

Microsoft恶意软件保护引擎多个拒绝服务漏洞(MS08-029)

BUGTRAQ ID: 29060,29073 CVECAN ID: CVE-2008-1437,CVE-2008-1438 Microsoft恶意软件保护引擎可为防病毒和反间谍软件客户端提供扫描、监测和清除功能。 Microsoft恶意软件保护引擎处理特制文件的方式中存在拒绝服务漏洞，攻击者可以通过建立特制文件来利用此漏洞，当目标计算机系统接收或Microsoft恶意软件保护引擎扫描到此文件时，就可能导致Microsoft恶意软件保护引擎停止响应和自动重新启动，或耗尽所有磁盘空间 0 Microsoft Windows Live OneCare Microsoft Antigen fo...

Microsoft Security Bulletin MS08-029 – Moderate Vulnerabilities in Microsoft Malware Protection Engine Could Allow Denial of Service (952044)

Microsoft Security Bulletin MS08-029 – Moderate Vulnerabilities in Microsoft Malware Protection Engine Could Allow Denial of Service 952044 Published: May 13, 2008 Version: 1.0 General Information Executive Summary This security update resolves two privately reported vulnerabilities in the...

MS08-029: Vulnerabilities in Microsoft Malware Protection Engine Could Allow Denial of Service (952044)

The remote host is running a version of Windows Malware Protection engine that is vulnerable to a bug in the file handling routine which could allow an attacker to crash the protection engine. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid32313; scriptversion"1.24";...

CVE-2003-1527

BlackICE Defender 2.9.cap and Server Protection 3.5.cdf, when configured to automatically block attacks, allows remote attackers to block IP addresses and cause a denial of service via spoofed packets...

CVE-2003-1527

Affected software : BlackICE Defender 2.9.cap and Server Protection 3.5.cdf. Vulnerability : When configured to automatically block attacks, remote attackers can cause a denial of service by spoofed packets, blocking IP addresses. Root cause/impact : The described behavior enables DoS through spo...

MS07-010: Vulnerability in Microsoft Malware Protection Engine Could Allow Remote Code Execution (932135)

The remote host is running a version of Windows Malware Protection engine that is vulnerable to a bug in the PDF file handling routine that could allow an attacker execute arbitrary code on the remote host by sending a specially crafted file. Tenable Network Security, Inc. include"compat.inc"; if...

Microsoft Security Bulletin MS07-010 Vulnerability in Microsoft Malware Protection Engine Could Allow Remote Code Execution (932135)

Microsoft Security Bulletin MS07-010 Vulnerability in Microsoft Malware Protection Engine Could Allow Remote Code Execution 932135 Published: February 13, 2007 Version: 1.0 Summary Who Should Read this Document: Customers who use Microsoft Malware Protection Engine Impact of Vulnerability: Remote...

CVE-2006-5406

Passgo Defender 5.2 creates the application directory with insecure permissions Everyone/Full Control, which allows local users to read and modify sensitive files. NOTE: the provenance of this information is unknown; the details are obtained from third party information...

CVE-2006-5406

Passgo Defender 5.2 is affected by a local vulnerability where the application directory is created with insecure permissions (Everyone/Full Control), allowing local users to read and modify sensitive files. The root cause is the insecure directory permissions setup by the product. The available ...

CVE-2006-5406

Passgo Defender 5.2 creates the application directory with insecure permissions Everyone/Full Control, which allows local users to read and modify sensitive files. NOTE: the provenance of this information is unknown; the details are obtained from third party information...

HACKER defender finder

This script checks whether the remote host is running the Hacker Defender backdoor. SPDX-FileCopyrightText: 2004 SIA Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

HACKER defender finder

This script checks whether the remote host is running the Hacker Defender backdoor. Hacker Defender is a rootkit for Windows. Among other things, it hooks itself into all open TCP ports on the system, listening for a specially-crafted packet, and opening a backdoor on that port when found. This...

CVE-2001-1431

CVE-2001-1431 affects Nokia Firewall Appliances (IPSO 3.3/3.4 and VPN-1/Firewall-1 4.1 SP3/4/5) when SYN Defender is in Active Gateway mode. The third packet of the TCP three-way handshake is not rewritten to use the NAT IP address, allowing remote attackers to gain sensitive information. Exploit...

CVE-2001-1431

Nokia Firewall Appliances running IPSO 3.3 and VPN-1/FireWall-1 4.1 Service Pack 3, IPSO 3.4 and VPN-1/FireWall-1 4.1 Service Pack 4, and IPSO 3.4 or IPSO 3.4.1 and VPN-1/FireWall-1 4.1 Service Pack 5, when SYN Defender is configured in Active Gateway mode, does not properly rewrite the third...

Hacker Defender Backdoor Detection

The remote host is running the Hacker Defender rootkit. Among other things, it hooks itself into all open TCP ports on the system, listening for a specially crafted packet, and opening a backdoor on that port when found. This backdoor can be used by malicious users to control the affected host...

Windows Defender Client Detection

Binary data 4503.prm...

CVE-2003-1527

BlackICE Defender 2.9.cap and Server Protection 3.5.cdf, when configured to automatically block attacks, allows remote attackers to block IP addresses and cause a denial of service via spoofed packets...

CVE-2002-0237

The CVE-2002-0237 issue affects ISS BlackICE Defender (2.9 and earlier), BlackICE Agent (3.0 and 3.1), and RealSecure Server Sensor (6.0.1 and 6.5). A buffer overflow in the ICMP handling exposes a remote attacker to crash the service (DoS) and, in some cases, potentially execute arbitrary code b...

CVE-2002-0237

Buffer overflow in ISS BlackICE Defender 2.9 and earlier, BlackICE Agent 3.0 and 3.1, and RealSecure Server Sensor 6.0.1 and 6.5 allow remote attackers to cause a denial of service crash and possibly execute arbitrary code via a flood of large ICMP ping packets...