CVE-2006-4331

Affected software: Wireshark (formerly Ethereal). Vulnerability: off-by-one in the IPsec ESP decryption preference parser (CVE-2006-4331) that can cause a remote denial of service (crash). Impact/scope: described as a remote crash when parsing malformed packets; listed for Ethereal/Wireshark 0.99...

CVE-2006-4331

Multiple off-by-one errors in the IPSec ESP preference parser in Wireshark formerly Ethereal 0.99.2 allow remote attackers to cause a denial of service crash via unspecified vectors...

Multiple Wireshark (Ethereal) sniffer security vulnerabilities

Multiple DoS conditions IPSec ESP dissector off-by-one overflow...

CVE-2006-4331: Undefined Security Weakness

Multiple off-by-one errors in the IPSec ESP preference parser in Wireshark formerly Ethereal 0.99.2 allow remote attackers to cause a denial of service crash via unspecified vectors...

Multiple problems in Wireshark (Ethereal®) versions 0.7.9 to 0.99.2

Summary Name: Multiple problems in Wireshark Ethereal® versions 0.7.9 to 0.99.2 Docid: wnpa-sec-2006-02 Date: August 23, 2006 Versions affected: 0.7.9 up to and including 0.99.2 Details Description Wireshark 0.99.3 fixes the following vulnerabilities: The SCSI dissector could crash. Versions...

exp_jmp_rand.pl.txt

!/usr/bin/perl -w use strict; expjmprand.pl Mon Apr 3 19:17:14 CEST 2006 Exploit solution against 2.6 stack randomization Using the "jmp %esp" technic. Copyright: bunker - http://rawlab.altervista.org 37F1 A7A1 BB94 89DB A920 3105 9F74 7349 AF4C BFA2 EXPLANATION: In 2.6 kernel we have a ghost...

Private Wire Gateway Buffer Overflow

This exploits a buffer overflow in the ADMCREG.EXE used in the PrivateWire Online Registration Facility. Module Options msf use exploit/windows/http/privatewire/gateway msf undefinedgateway show actions ...actions... msf undefinedgateway set ACTION msf undefinedgateway show options ...show and se...

CesarFTP 0.99g - MKD Remote Buffer Overflow

CesarFTP 0.99g - MKD Remote Buffer Overflow !/usr/bin/python CesarFtp 0.99g 0day Exploit Proof of Concept: execute calc.exe Tested on XP sp2 polish Bug found by h07 [email protected] Date: 10.06.2006 from socket import shellcode = execute calc.exe...

Mini-Nuke<=1.8.2 SQL injection (6)

//mini-nuke board turk have many sql injection founded by Moroccan Security Team //Creetz to: Moroccan Security Team Dr.E-vil,Dr.Erase,H0550N,|ucifer,DaBDouB-MoSiKaR OverclockiX,ki11er ,Dranzelz,Esp!onLeRaVaGe,ameer,www.lezr.com and all muslim morocco 1...

phpWebsite <= SQL Injection (friend.php) & (article.php)

+phpWebsite +DaBDouB-MoSiKaR Moroccan Security Team +creetz to: Moroccan security TeamDr.E-vil,Dr.Erase,H0550N,ToM-le-Magicianfrance , ameeregypt, Esp!onLeRaVaGe, CiM TeaM, xMs3D0,|ucifer,B6,al-houda membersnabil,sn!per,Kasparovand all hackers musilm morocco and www.lezr.com +special 10x to: safa...

PeerCast 0.1216 - 'nextCGIarg' Remote Buffer Overflow (1)

/ GNU PeerCast include include include include include include include include include struct target char name; int retaddr; ; struct shellcode char name; int port; int host;...

Sami FTP Server 2.0.1 Remote Buffer Overflow Exploit (cpp)

No description provided by source. // Two includes. include fstream.h include winsock2.h // Project - Settings - Link Object/Library modules 'Ws232.lib' pragma commentlib, "ws232" char MyShellCode = // XOR by \x99\x99\x99\x99. "\xD9\xEE\xD9\x74\x24\xF4\x5B\x31\xC9\xB1\x59\x81\x73\x17\x99\x99"...

Xmame 0.102 (-lang) Local Buffer Overflow Exploit (c code)

Exploit for linux platform in category local exploits ========================================================== Xmame 0.102 -lang Local Buffer Overflow Exploit c code ========================================================== / Xmame 0.102 -lang Local Buffer Overflow Exploit Coded BY Qnix...

linux/x86 dup20,0; dup20,1; dup20,2; 15 bytes

linux/x86 dup20,0; dup20,1; dup20,2; 15 bytes. Shellcode exploit for linx86 platform / dup2loop-core.c by Charles Stevenson I made this as a chunk you can paste in to make modular remote exploits. I usually combine this with an execve as the second stage of a read jmp %esp / char hellcode = /...

Wireless Tools 26 (iwconfig) Local Root Exploit (some setuid)

Exploit for linux platform in category local exploits ============================================================= Wireless Tools 26 iwconfig Local Root Exploit some setuid ============================================================= // if the iwconfig executable is setuid /str0ke include inclu...

VisualBoyAdvanced 1.7.x Local Shell Exploit (non suid) (updated)

Exploit for linux platform in category local exploits ================================================================ VisualBoyAdvanced 1.7.x Local Shell Exploit non suid updated ================================================================ / VisualBoyAdvanced 1.7.x BufferOver Flow exploit VB...

WinZIP <= 8.1 Command Line Local Buffer Overflow Exploit

Exploit for unknown platform in category local exploits ======================================================== WinZIP include define NOP 0x90 void main // create crafted command line char tmpfile = "c:\wzs45.tmp"; char winzippath = "C:\Program Files\WINZIP\winzip32.exe"; char zipandmailpar =...

CVE-2005-0039

Certain configurations of IPsec, when using Encapsulating Security Payload ESP in tunnel mode, integrity protection at a higher layer, or Authentication Header AH, allow remote attackers to decrypt IPSec communications by modifying the outer packet in ways that cause plaintext data from the inner...

CVE-2005-0039

Certain configurations of IPsec, when using Encapsulating Security Payload ESP in tunnel mode, integrity protection at a higher layer, or Authentication Header AH, allow remote attackers to decrypt IPSec communications by modifying the outer packet in ways that cause plaintext data from the inner...

CVE-2005-0039

CVE-2005-0039 describes vulnerabilities in IPsec configurations where using ESP in tunnel mode (with CBC mode) or AH without proper integrity protections allows an attacker to modify the outer packet and cause the inner, encrypted data to be exposed in plaintext via ICMP messages. The attacks inc...