IPSec information leak

If ESP is used without integrity control it's possible to obtain plaintext data in ICMP error meesage by modifying source packet...

NISCC Vulnerability Advisory IPSEC - 004033

Abstract: Three attacks that apply to certain configurations of IPsec have been identified. These configurations use Encapsulating Security Payload ESP in tunnel mode with confidentiality only, or with integrity protection being provided by a higher layer protocol. Some configurations using AH to...

IPsec configurations may be vulnerable to information disclosure

Overview The IPsec Encapsulating Security Payload protocol used in tunneling mode may be vulnerable to multiple attacks when confidentiality mode is used without integrity protection, or in certain cases where integrity protection is provided by higher-level protocols. Description The IP Security...

CVE-2004-0967

The 1 pj-gs.sh, 2 ps2epsi, 3 pv.sh, and 4 sysvlp.sh scripts in the ESP Ghostscript espgs package in Trustix Secure Linux 1.5 through 2.1, and other operating systems, allow local users to overwrite files via a symlink attack on temporary files...

CVE-2004-0967

The 1 pj-gs.sh, 2 ps2epsi, 3 pv.sh, and 4 sysvlp.sh scripts in the ESP Ghostscript espgs package in Trustix Secure Linux 1.5 through 2.1, and other operating systems, allow local users to overwrite files via a symlink attack on temporary files...

CVE-2004-0967

The 1 pj-gs.sh, 2 ps2epsi, 3 pv.sh, and 4 sysvlp.sh scripts in the ESP Ghostscript espgs package in Trustix Secure Linux 1.5 through 2.1, and other operating systems, allow local users to overwrite files via a symlink attack on temporary files...

CVE-2003-0764

The CVE-2003-0764 entry concerns the Escapade Scripting Engine (ESP). Affected: ESP; Issue: remote attackers can obtain sensitive path information through a malformed request that causes the server to leak the path in an error message, demonstrated via the PAGE parameter. Impact: partial disclosu...

CVE-2003-0763

CVE-2003-0763 describes a Cross-site scripting (XSS) vulnerability in the Escapade Scripting Engine (ESP). The issue arises from unsanitized input in the method parameter (demonstrated via the PAGE parameter), enabling remote attackers to inject arbitrary script. Documents indicate the affected c...

CVE-2002-0666

CVE-2002-0666 affects multiple IPsec implementations (notably FreeS/WAN and KAME). The root cause is incorrect calculation of the authentication data length for very small ESP datagrams, which can result in an unsigned integer overflow and cause a kernel panic (remote denial of service). The NVD/...

NetBSD Security Advisory 2002-016: Insufficient length check in ESP authentication data

-----BEGIN PGP SIGNED MESSAGE----- NetBSD Security Advisory 2002-016 ================================= Topic: Insufficient length check in ESP authentication data Version: NetBSD-current: source prior to August 23, 2002 NetBSD-1.6 beta: source prior to August 23, 2002 NetBSD-1.5.3: affected...

CVE-2001-0331

Buffer overflow in Embedded Support Partner ESP daemon rpc.espd in IRIX 6.5.8 and earlier allows remote attackers to execute arbitrary commands...

CVE-2001-0331

CVE-2001-0331 describes a buffer overflow in SGI IRIX Embedded Support Partner (ESP) daemon rpc.espd, affecting IRIX 6.5.8 and earlier. The vulnerability allows remote attackers to execute arbitrary commands with superuser privileges, with the ESP daemon enabled by default on IRIX installations a...

ISSalert: ISS Security Advisory: Remote Buffer Overflow Vulnerability in IRIX Embedded Support Partner Infrastructure

TO UNSUBSCRIBE: email "unsubscribe alert" in the body of your message to [email protected] Contact [email protected] for help with any problems! --------------------------------------------------------------------------- -----BEGIN PGP SIGNED MESSAGE----- Internet Security Systems Security...

CVE-2000-0962

The CVE-2000-0962 entry concerns OpenBSD 2.7 IPSEC, where the implementation mishandles empty AH/ESP packets. This underpins a denial of service when processing such packets, with an impact described as partial availability. The available sources (NVD/CVE records) repeat the same description and ...

CVE-2000-0962

The IPSEC implementation in OpenBSD 2.7 does not properly handle empty AH/ESP packets, which allows remote attackers to cause a denial of service...

ms.winhelp.exploit.txt

Date: Mon, 24 May 1999 07:18:23 +0100 From: Mnemonix To: [email protected] Subject: Exploit and Analysis of the Winhlp32.exe buffer overrun. Analysis of the winhlp32.exe buffer overrun. The buffer overrun in winhlp32.exe occurs when it attempts to read a cnt file with an overly lon...