Symantec pcAnywhere Detection (TCP)

Symantec pcAnywhere allows a Windows user to remotely obtain a graphical login and therefore act as a local user on the remote host. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid10794; scriptversion"1.46"; scriptsetattributeattribute:"pluginmodificationdate",...

SSH CRC32 attack detection code contains remote integer overflow

Overview There is a remote integer overflow vulnerability in several implementations of the SSH1 protocol that allows an attacker to execute arbitrary code with the privileges of the SSH daemon, typically root. Description There is a remote integer overflow vulnerability in several implementation...

Minor IE vulnerability: about: URLs

Zone spoofing? Oh yes, that reminds me. Here's another one. Affected: Internet Explorer under Windows, up to version 6 Risk: Low Workaround: Disable scripting in the Internet Zone Problem: If an unknown 'about:' name is used, IE echos the string exactly to the page. So 'about:foo' results in an...

Cisco IOS vulnerable to denial of service via Cisco Discovery Protocol

Overview The Cisco IOS contains a denial-of-service vulnerability that allows nearby remote attackers to crash or temporarily disable affected network devices. Description The Cisco Internetwork Operating System IOS contains a vulnerability in its processing of Cisco Discovery Protocol CDP packet...

IBM AIX portmir buffer overflow

Overview There is a buffer overflow vulnerability in the AIX portmir command that may allow local attackers to gain root privileges. Description There is a buffer overflow in the AIX portmir command. This problem was described in IBM ERS security bulletin: ERS-SVA-E01-1997:006.1. --- Impact...

Microsoft Windows 2000 Telnet Service uses named pipes with predictable names

Overview The Microsoft Windows 2000 Telnet Service contains a vulnerability that allows unprivileged local users to execute arbitrary code with elevated privileges. Description The Microsoft Windows 2000 Telnet Service creates a named pipe to share information between the processes that handle ea...

RTSP Server Type / Version Detection

The remote server is an RTSP server. RTSP is a client-server multimedia presentation protocol, which is used to stream videos and audio files over an IP network. It is usually possible to obtain the list of capabilities and the server name of the remote RTSP server by sending an OPTIONS request. ...

COM+ Internet Services (CIS) Server Detection

COM+ Internet Services are RPC over HTTP tunneling and require IIS to operate. CIS ports shouldn't be visible on internet but only behind a firewall. This script was written by Georges Dagousset See the Nessus Scripts License for details Changes by Tenable: - Revised plugin title 10/12/09...

BSD Line Printer Daemon vulnerable to buffer overflow via crafted print request

Overview The line printer daemon enables various clients to share printers over a network. There exists a buffer overflow vulnerability in this daemon that permits remote execution of arbitrary commands with elevated privileges. Description There is a buffer overflow in several implementations of...

javascript can write anything to windows98 registry

here's code from www.4y4y.net:88/ls.html it can write any value to windows98 registry solution: disable JavaScript in InternetExplorer tested on IE5.5 Marcin Jackowski --------------------------------------------------------------- script document.write"APPLET HEIGHT=0 WIDTH=0...

VisualRoute Web Server Detection

VisualRoute is a web-based solution which allows unauthenticated users to perform traceroutes against arbitrary hosts on the Internet. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid10744; scriptversion "1.22"; name"english" = "VisualRoute Web Server Detection";...

ADV/EXP: netkit <=0.17 in.telnetd remote buffer overflow

Product: netkit telnet protocol daemon, in.telnetd Version: netkit-telnet-0.17 and previous /usr/sbin/in.telnetd Severity: High Remote: Yes Allows: Remote ROOT level access. Workaround: Disable telnet access. Fix: Check with your vendor for an updated package. from...

PT-2001-2561 · Phpbb · Phpbb

Name of the Vulnerable Software and Affected Versions: phpBB versions 1.4.0 and earlier Description: The issue allows remote authenticated users to execute arbitrary PHP code via an invalid language value. This prevents the variables $l statsblock in prefs.php or $l privnotify in auth.php from...

PT-2001-2170 · Ipswitch · Ws Ftp

Name of the Vulnerable Software and Affected Versions: WS FTP version 2.02 Description: The issue allows remote attackers to execute arbitrary code via long arguments to several commands, including DELE, MDTM, MLST, MKD, RMD, RNFR, RNTO, SIZE, STAT, XMKD, or XRMD. Recommendations: For WS FTP...

PT-2001-2489 · Phpslice · Phpslice

Name of the Vulnerable Software and Affected Versions: PHPSlice versions 0.1.1 through 0.1.6 Description: The issue concerns the checkAccess function, which does not properly verify the administrative access level. This could allow remote attackers to gain privileges. Recommendations: For PHPSlic...

Cisco IOS HTTP Configuration Unauthorized Administrative Access

It is possible to execute arbitrary commands on the remote Cisco router. An attacker may leverage this issue to disable network access via this device or lock legitimate users out of the router. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid10700; scriptversion "1.38...

Solaris Line Printer Daemon (in.lpd) vulnerable to buffer overflow via transfer job routine

Overview A buffer overflow exists in the Solaris line printer daemon in.lpd that may allow a remote intruder to execute arbitrary code with the privileges of the running in.lpd. This daemon runs with root privileges by default on all recent versions of Solaris. Description The Solaris in.lpd...

Check Point FireWall-1 Telnet Client Authentication Detection

The Check Point FireWall-1 Client Authentication server is used to authenticate a user via telnet. Once authenticated, the user can get more privileges on the network ie, get access to hosts that were previously blocked by the firewall. C Tenable Network Security, Inc. include"compat.inc";...

undocumented 3Com Netbuilder II SNMP ILMI commnity

WWW.PLAZASITE.COM Systems & Security Division Title: 3Com Netbuilder II SNMP ILMI Community Date: 15-5-2001 Platform: Only tested Netbuilder II routers Author: Juan Manuel Pascual [email protected] Status: Vendor Contacted but no answers received OVERVIEW: It seems to exist an undocumented...

WFTPD "Pro" 3.0 R4 Buffer Overflow

WFTP is the Win/NT FTP server by Alun Jones, "an author acknowledged as an expert in FTP and TCP/IP". This advisory pertains to "Professional" version 3.00 R4, which appears to be the current version. It can be downloaded from the author's site at http://www.wftpd.com/. WFTPD is released as...