openSUSE 10 Security Update : snort (snort-1598)

This update fixes an evasion attack on URL parsing. The faulty code is in the httpinspect preprocessor. CVE-2006-2769 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update snort-1598. The text...

Sophos Anti-Virus CAB, RAR and LZH Scanning Evasion

The version of Sophos Anti-Virus installed on the remote host reportedly contains several problems involving the processing of 'CAB' 'RAR' and 'LZH' files which may allow an attacker to evade the anti- virus scanning by sending a specially-malformed archive. In addition, an attacker may exploit a...

Invalid Bind ACK Messages

DCE/RPC stands for Distributed Computing Environment / Remote Procedure Calls. It is a Remote Procedure Call system that allows software to work across multiple computers, as if it were all working on the same computer. This system allows programmers to write distributed software without having t...

Bind Acks with Invalid Return Ports

DCE/RPC stands for Distributed Computing Environment / Remote Procedure Calls. It is a Remote Procedure Call system that allows software to work across multiple computers, as if it were all working on the same computer. This system allows programmers to write distributed software without having t...

Invalid Bind NAK Messages

DCE/RPC stands for Distributed Computing Environment / Remote Procedure Calls. It is a Remote Procedure Call system that allows software to work across multiple computers, as if it were all working on the same computer. This system allows programmers to write distributed software without having t...

Stateful Inspection of Alter Context Messages

DCE/RPC stands for Distributed Computing Environment / Remote Procedure Calls. It is a Remote Procedure Call system that allows software to work across multiple computers, as if it were all working on the same computer. This system allows programmers to write distributed software without having t...

Non Standard MS-RPC Message Types

DCE/RPC stands for Distributed Computing Environment / Remote Procedure Calls. It is a Remote Procedure Call system that allows software to work across multiple computers, as if it were all working on the same computer. This system allows programmers to write distributed software without having t...

IPS-1 Protection Update for WWW2 (Version 27)

Microsoft IIS decodes Unicode character sets in a variety of ways. There is an uncommon way of creating Unicode characters in HTTP, which IIS but no other known web servers decode. It is in the form of percent-u-hexchar-hexchar-hexchar-hexchar. The IPS-1 WWW2 protocol subsystem has been updated t...

GLSA-200708-11 : Lighttpd: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200708-11 Lighttpd: Multiple vulnerabilities Stefan Esser discovered errors with evidence of memory corruption in the code parsing the headers. Several independent researchers also reported errors involving the handling of HTTP...

TippingPoint IPS Signature Evasion

======================================================================== = TippingPoint IPS Signature Evasion = = Vendor Website: = http://www.tippingpoint.com = = Affected Version: = TippingPoint IPS running TOS versions 2.1 & 2.2.0 - 2.2.4 = = Vendor Notified. 18th January 2006 = Public...

ips-evasion.txt

Summarized from https://strikecenter.bpointsys.com/ Many commercial IPS products fail to decode HTTP requests which use 0x0c, 0x0b, and 0x0d instead of the normal 0x20/0x09 separators. A request in the following format will evade most IPS protocol decoders: $ echo -ne...

CVE-2007-3279

PostgreSQL 8.1 and probably later versions, when the PL/pgSQL plpgsql language has been created, grants certain plpgsql privileges to the PUBLIC domain, which allows remote attackers to create and execute functions, as demonstrated by functions that perform local brute-force password guessing...

CVE-2007-2734

The 3Com TippingPoint IPS do not properly handle certain full-width and half-width Unicode character encodings in an HTTP POST request, which might allow remote attackers to evade detection of HTTP traffic...

Design/Logic Flaw

Check Point Web Intelligence does not properly handle certain full-width and half-width Unicode character encodings, which might allow remote attackers to evade detection of HTTP traffic...

CVE-2007-2690

Multiple IBM ISS Proventia Series products, including the A, G, and M series, do not properly handle certain full-width and half-width Unicode character encodings, which might allow remote attackers to evade detection of HTTP traffic...

Design/Logic Flaw

Multiple IBM ISS Proventia Series products, including the A, G, and M series, do not properly handle certain full-width and half-width Unicode character encodings, which might allow remote attackers to evade detection of HTTP traffic...

CVE-2007-2688

The CVE-2007-2688 issue affects Cisco’s Intrusion Prevention System (IPS) and IOS with Firewall/IPS Feature Set. The vulnerability arises from improper handling of certain full-width and half-width Unicode encodings, which could allow remote attackers to evade detection of HTTP traffic. What’s af...

CVE-2007-2688

The Cisco Intrusion Prevention System IPS and IOS with Firewall/IPS Feature Set do not properly handle certain full-width and half-width Unicode character encodings, which might allow remote attackers to evade detection of HTTP traffic...

By modifying the characteristics to evade antivirus checks-vulnerability warning-the black bar safety net

Today the rare is I in the school room and RUB into the machine, installed Norton and wheat coffee. Anyway, haven't for these two antivirus ever madefree kill, so just change it for the better. The positioning process on a free, given the feature code location: Norton: the starting offset 000B9A4...

n.runs-SA-2007.004 - PHProjekt 5.2.0 - Cross Site Scripting and Filter Evasion

n.runs AG http://www.nruns.com/ security at nruns.com n.runs-SA-2007.004 14-Mar-2007 Vendor: Mayflower GmbH, http://www.mayflower.de Affected Products: PHProjekt 5.2.0 Vulnerability: Cross Site Scripting and Filter Evasion Risk: HIGH Vendor communication: 2006/12/31 initial notification of...