717 matches found
Mutiple AntiVirus Reserved Device Name Handling Vulnerability
Mutiple AntiVirus Reserved Device Name Handling Vulnerability Author:Sowhat Date:October,9th,2004 http://secway.org/Advisory/Ad20041009.txt Vendor: AntiVir www.hbedv.com Twister www.filseclab.com Protector plus 2000 www.pspl.com Overview: As many popular AV's "Reserved Device Name Handling...
CVE-2004-0920: Undefined Security Weakness
Symantec Norton AntiVirus 2004, and earlier versions, allows a virus or other malicious code to avoid detection or cause a denial of service application crash using a filename containing an MS-DOS device name...
CVE-2004-0799: Undefined Security Weakness
The HTTP daemon in Ipswitch WhatsUp Gold 8.03 and 8.03 Hotfix 1 allows remote attackers to cause a denial of service server crash via a GET request containing an MS-DOS device name, as demonstrated using "prn.htm"...
CVE-2003-0045: Undefined Security Weakness
Jakarta Tomcat before 3.3.1a on certain Windows systems may allow remote attackers to cause a denial of service thread hang and resource consumption via a request for a JSP page containing an MS-DOS device name, such as aux.jsp...
Apache < 2.0.46 on OS/2 filestat.c Device Name Request DoS
Binary data 1535.prm...
CVE-2004-0050
The CVE-2004-0050 issue affects Verity Ultraseek (Inktomi Search) prior to 5.2.2 where an MS-DOS device name parameter in the web search option can cause disclosure of the full path to the document root. The OpenVAS entries corroborate a physical path disclosure vulnerability in Ultraseek/Verity,...
CVE-2004-0050: Undefined Security Weakness
Verity Ultraseek before 5.2.2 allows remote attackers to obtain the full pathname of the document root via an MS-DOS device name in the web search option, such as 1 NUL, 2 CON, 3 AUX, 4 COM1, 5 COM2, and others...
CVE-2004-0466
WebConnect 6.5, 6.4.4, and possibly earlier versions allows remote attackers to cause a denial of service hang via a URL containing an MS-DOS device name such as 1 AUX, 2 CON, 3 PRN, 4 COM1, or 5 LPT1...
CVE-2003-0671
CVE-2003-0671 affects tcpflow and is described as a format string vulnerability that, when tcpflow runs in a setuid context (notably the RunTCPFlow program used by Sustworks IPNetSentryX and IPNetMonitorX), allows local users to execute arbitrary code via the device name argument. The available d...
CVE-2003-0421
Apple QuickTime / Darwin Streaming Server before 4.1.3f allows remote attackers to cause a denial of service crash via an MS-DOS device name e.g. AUX in a request to HTTP port 1220, a different vulnerability than CVE-2003-0502...
CVE-2003-0421: Undefined Security Weakness
Apple QuickTime / Darwin Streaming Server before 4.1.3f allows remote attackers to cause a denial of service crash via an MS-DOS device name e.g. AUX in a request to HTTP port 1220, a different vulnerability than CVE-2003-0502...
CVE-2002-0851: Undefined Security Weakness
Format string vulnerability in ISDN Point to Point Protocol PPP daemon ipppd in the ISDN4Linux i4l package allows local users to gain root privileges via format strings in the device name command line argument, which is not properly handled in a call to syslog...
CVE-2002-0576: Undefined Security Weakness
ColdFusion 5.0 and earlier on Windows systems allows remote attackers to determine the absolute pathname of .cfm or .dbm files via an HTTP request that contains an MS-DOS device name such as NUL, which leaks the pathname in an error message...
Apache Tomcat DOS Device Name XSS
Apache Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. By making requests for DOS Device names it is possible to cause Tomcat to throw an exception, allowing cross-site scripting attacks. The exception...
CVE-2002-0200
Cyberstop Web Server for Windows 0.1 allows remote attackers to cause a denial of service via an HTTP request for an MS-DOS device name...
CVE-2002-0200: Undefined Security Weakness
Cyberstop Web Server for Windows 0.1 allows remote attackers to cause a denial of service via an HTTP request for an MS-DOS device name...
CVE-2001-1243: Undefined Security Weakness
Scripting.FileSystemObject in asp.dll for Microsoft IIS 4.0 and 5.0 allows local or remote attackers to cause a denial of service crash via 1 creating an ASP program that uses Scripting.FileSystemObject to open a file with an MS-DOS device name, or 2 remotely injecting the device name into ASP...
CVE-2002-0338: Undefined Security Weakness
The Bat! 1.53d and 1.54beta, and possibly other versions, allows remote attackers to cause a denial of service crash via an attachment whose name includes an MS-DOS device name...
Windows 98 FTP MS/DOS Device Name Request DoS
It was possible to freeze or reboot Windows by reading a MS/DOS device through FTP, using a file name like CON\CON, AUX.htm, or AUX. An attacker may use this flaw to continuously crash the affected host, preventing users from working properly. C Tenable Network Security, Inc. Script audit and...