Common Desktop Environment (CDE) ToolTalk RPC database server (rpc.ttdbserverd) vulnerable to buffer overflow via _TT_CREATE_FILE()

Overview The Common Desktop Environment CDE ToolTalk RPC database server contains a buffer overflow condition that could let an attacker execute arbitrary code or cause a denial of service on a vulnerable system. The ToolTalk RPC database server typically runs with root privileges. Description A...

SGI IRIX rpc.xfsmd uses weak authentication mechanism for RPC authentication

Overview The XFS file system on SGI systems allows anonymous remote users to call xfs-related RPC functions. Description XFS is a 64-bit compliant journaling file system. The XFS journaling filesystem daemon rpc.xfsmd on SGI systems uses the default AUTHUNIX authentication mechanism a client-base...

RPC rusers Remote Information Disclosure

The rusersd RPC service is running. It provides an attacker interesting information such as how often the system is being used, the names of the users, and more. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid11058; scriptversion"1.19"; scriptcvsdate"Date: 2018/08/13...

fake identd (fakeidentd) Fragmented Packet Request Remote Overflow

The identd server on this port seems to be a version of fake identd that fails to properly validate user input before copying it into a buffer of fixed size. By splitting data into two or more packets, an anonymous remote attacker can overflow the input buffer and execute arbitrary code with root...

PT-2002-1727 · Netfilter · Netfilter

Name of the Vulnerable Software and Affected Versions: Netfilter "iptables" versions 1.2.6a and earlier Description: The Network Address Translation NAT capability leaks translated IP addresses in ICMP error messages. Recommendations: For versions 1.2.6a and earlier, consider disabling the NAT...

Sun iPlanet and ONE Web Servers contain a buffer overflow in the search engine

Overview The Sun iPlanet Web Server and Sun ONE Web Server both ship with a search engine that is not enabled by default. A remotely exploitable buffer overflow exists in the search engine that could permit an attacker to execute arbitrary code on the system. Description The Sun iPlanet Web Serve...

Common Desktop Environment (CDE) ToolTalk RPC database server (rpc.ttdbserverd) does not adequately validate file operations

Overview The Common Desktop Environment CDE ToolTalk RPC database server does not adequately validate file operations and follows symbolic links, allowing a local attacker to overwrite any file that is writeable by the server. The ToolTalk RPC database server typically runs with root privileges...

News Server (NNTP) Information Disclosure

By probing the remote NNTP server, Nessus is able to collect information about it, such as whether it allows remote connections, the number of newsgroups, etc. C Tenable Network Security, Inc. NNTP protocol is defined by RFC 977 NNTP message format is defined by RFC 1036 obsoletes 850; see also R...

Microsoft SQLXML ISAPI filter vulnerable to buffer overflow via contenttype parameter

Overview A buffer overflow vulnerability exists in the Microsoft SQLXML Internet Services Application Programming Interface ISAPI extension for Internet Information Server IIS. This vulnerability could allow a remote attacker to cause a denial of service or execute arbitrary code with LocalSystem...

IRIX rpc.yppasswdd Unspecified Remote Overflow

The remote RPC service 100009 yppasswdd is vulnerable to a buffer overflow which allows any user to obtain a root shell on this host. Note: This issue is different than the one described in CVE-2002-0357 / SGI advisory 20020601-01-P. C Tenable Network Security, Inc. This is NOT the issue describe...

SNMP Request Cisco Router Information Disclosure

It is possible to determine the model of the remote CISCO system by sending SNMP requests with the OID 1.3.6.1.4.1.9.1. An attacker may use this information to gain more knowledge about the remote host. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

Oracle Reports Server Reports Web Cartridge (RWCGI60) vulnerable to buffer overflow via database name parameter

Overview A buffer overflow vulnerability in Oracle Reports Server 6i could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the Reports Server process. Description Oracle Reports Server is a component of Oracle Application Server that handles client...

cqure.net.20020412.netware_sdmr.a

cqure.net Security Vulnerability Report No: cqure.net.20020412.netwaresdmr.a ======================================== Vulnerability Summary --------------------- Problem: The IPX compatibility issue Posted to BugTraq on July 11, 2000 by Dimuthu Parussalla applies to Netware 6.0 SP 1 as well...

Mp3 file can execute code in Winamp [Sandblad advisory #5]

Sandblad advisory 5 - ---..---..---..---..---..---..---..---..---..---..---..---..---- Title: Mp3 file can execute code in Winamp. Date: 2002-04-26 Software: Nullsoft Winamp 2.79 Rating: High because mp3 files are widely trusted as safe. Impact: Specially crafted mp3 file can execute arbitrary...

Microsoft Internet Information Server (IIS) vulnerable to heap overflow during processing of crafted ".htr" request by "ISM.DLL" ISAPI filter

Overview A buffer overflow in the HTR ISAP extension on IIS servers could permit an intruder to interrupt the normal operation of IIS or possibly execute arbitrary code with the privileges of the HTR extension. Description HTR is a server-side scripting technology for IIS which has largely been...

Microsoft scriptlet.typlib ActiveX object unsafe for scripting from Internet Explorer

Overview The ActiveX control "scriptlet.typlib" is incorrectly marked "safe for scripting" in Internet Explorer IE versions 4.0 and 5.0, when it is actually unsafe for scripting. Description There exists a vulnerability in the default installation of an ActiveX control named "scriptlet.typlib,"...

CVE-2002-0067

Squid 2.4 STABLE3 and earlier does not properly disable HTCP, even when "htcpport 0" is specified in squid.conf, which could allow remote attackers to bypass intended access restrictions...

SSH Protocol Version 1 Session Key Retrieval

The remote SSH daemon supports connections made using the version 1.33 and/or 1.5 of the SSH protocol. These protocols are not completely cryptographically safe so they should not be used. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid10882; scriptversion"1.37";...

Cisco IOS discloses fragments of previous packets when Express Forwarding is enabled

Overview A vulnerability exists in multiple versions of Cisco's Internetworking Operating System IOS software that allows an attacker to collect fragments of previously processed packets. Description Many networking devices running Cisco IOS with Cisco Express Forwarding CEF enabled contain a...

IE GetObject() problems

Georgi Guninski security advisory 52, 2001 IE GetObject problems Systems affected: Patched IE 6.0, somewhat patched 5.5 Win2K Risk: High Date: 1 January 2002 Legal Notice: This Advisory is Copyright c 2001 Georgi Guninski. You may distribute it unmodified. You may not modify it and distribute it ...