KDE 1.1.2 KApplication configfile - Local Privilege Escalation (3)

KDE 1.1.2 KApplication configfile - Local Privilege Escalation 3 source: https://www.securityfocus.com/bid/1291/info The KDE configuration-file management has a bug which could result in root compromise. Due to insecure creation of configuration rc files via KApplication-class, local users can...

Elm Development Group ELM 2.42.5.1 Mail for UNIX - ELM Buffer Overflow (2)

Elm Development Group ELM 2.42.5.1 Mail for UNIX - ELM Buffer Overflow 2 // source: https://www.securityfocus.com/bid/1276/info Buffer overflow vulnerabilities exist in elm Electronic Mail for Unix. / Elm 2.5 PL3 exploit Tested Under Linux Slackware 3.6, 4.0, 7.0 By xfer [email protected] ...

Marty Bochane MDBms 0.9 - xbx Buffer Overflow

Marty Bochane MDBms 0.9 - xbx Buffer Overflow // source: https://www.securityfocus.com/bid/1252/info A vulnerability exists in the MDBMS database, written by Marty Bochane. By supplying a line of sufficient length to the MDBMS server, containing machine executable code, it is possible for a remot...

Lotus Domino Enterprise Server 5.0.1/5.0.2/5.0.3 / Mail Server 5.0.1/5.0.2/5.0.3 - Remote Buffer Overflow

Lotus Domino Enterprise Server 5.0.1/5.0.2/5.0.3,Mail Server 5.0.1/5.0.2/5.0.3 Buffer Overflow source: https://www.securityfocus.com/bid/1229/info The code that handles the 'rcpt to' 'saml from' and 'soml from' commands in the ESMTP service of Lotus Domino Server has an unchecked buffer. If Lotus...

Elm Development Group ELM 2.4/2.5.1 Mail for UNIX - ELM Buffer Overflow (1)

// source: https://www.securityfocus.com/bid/1276/info // // Buffer overflow vulnerabilities exist in elm Electronic Mail for Unix. // / Elm Exploit - Scrippie - Phreak.nl - b0f - http://b0f.freebsd.lublin.pl This exploit spawns an EGID mail shell on the default Slackware 4 install. Use as:...

Alert: DMailWeb buffer overflow

Cerberus Information Security Advisory CISADV000504 http://www.cerberus-infosec.co.uk/advisories.shtml Released : 4th May 2000 Name : Dmailweb Buffer Overflow Affected Systems : nix/Win32 Web Servers running Issue : Attackers can remotely execute arbitrary code Author : David Litchfield...

Solaris 2.6/7.0 - 'lpset -r' Local Buffer Overflow (1)

// source: https://www.securityfocus.com/bid/1138/info A vulnerability exists in the handling of the -r option to the lpset program, as included in Solaris 7 from Sun Microsystems. The -r option is undocumented. As such, its use in unknown. However, when supplied a well crafted buffer containing...

Linux Kernel 2.2.12/2.2.14/2.3.99 (RedHat 6.x) - Socket Denial of Service

/ source: https://www.securityfocus.com/bid/1072/info A denial of service exists in Linux kernels, as related to Unix domain sockets ignoring limits as set in /proc/sys/net/core/wmemmax. By creating successive Unix domain sockets, it is possible to cause a denial of service in some versions of th...

Mirabilis ICQ 0.99/98.0 a/2000.0 A/99a - Remote Denial of Service

// source: https://www.securityfocus.com/bid/1463/info The guestbook CGI program in ICQ Web Front service for ICQ 2000a, 99b, and others allows remote attackers to cause a denial of service via a URL with a long name parameter. / ICQ Web Front DoS / include include include include void mainint...

tinyftpd.exploit.txt

Hello, I translated a following message in BUGTRAQ-JPJapanese by proxy and forward this here. ------- Forwarded Message From: UNYUN To: [email protected] Hi, This is UNYUN@ShadowPenguinSecurity. Tiny FTPd 0.52 beta3 that is Windows FTP server has a buffer overflow vulnerability in...

ZBServer Pro 1.5 - Remote Buffer Overflow (2)

// source: https://www.securityfocus.com/bid/889/info ZBSoft ZBServer Pro is an Internet and Intranet server that supports HTTP, Gopher, FTP and Chat Services. ZBServer is available for Microsoft Windows operating systems. ZBServer Pro 1.5 has an unchecked buffer in the code that handles GET...

Real Networks Real Server 5.0 - ramgen Denial of Service

Real Networks Real Server 5.0 - ramgen Denial of Service // source: https://www.securityfocus.com/bid/888/info RealServer 5.0 can be crashed by sending an overly long 4082+ bytes ramgen request. Regular functionality can be restored by restarting the RealServer software. / rmscrash.c - [email protected]...

VDOLive Player 3.0.2 - Local Buffer Overflow

// source: https://www.securityfocus.com/bid/872/info VDOLive Player v3.02 has an unchecked buffer that can allow arbitrary code to be executed if a specially-crafted .vdo file is loaded. /==================================================================== exvdolive.c / VDO Live Player 3.02 32bi...

unixware7.gethostbyname.txt

Greetings, OVERVIEW A serious bug exists in UnixWare 7.1's libc. A buffer overflow in gethostbyname will allow any user to obtain elevated privileges. BACKGROUND Is this the same gethostbyname overflow which was present in ancient versions of non-unixware libc's way back when? I can't say for sur...

Solaris 7.0 - 'kcms_configure' Local Overflow / Local Privilege Escalation

/ source: https://www.securityfocus.com/bid/831/info The binary kcmsconfigure, part of the Kodak Color Management System package shipped with OpenWindows and ultimately, Solaris is vulnerable to a local buffer overflow. The buffer which the contents of the environment variable NETPATH are copied...

irfan.view32.txt

The popular Image viewer "Irfan View32" contains the buffer overflow problem, this problem exists in the handling of Adobe Photoshop image file. Irfan view checks the image type by the image header, if "8BPS" pattern is found in the header, Irfan view judges this file as Photo Shop image. We thin...

Microsoft Windows NT 4.0/SP1/SP2/SP3/SP4/SP5/SP6 - 'Spoolss.exe' DLL Insertion

source: https://www.securityfocus.com/bid/769/info The spooler service spoolss.exe allows local users to add their own dll files and have the spooler run them at SYSTEM level. This could lead to privilege escalation all the way up to Administrator level. The problem is in the function...

Microsoft Windows NT 4.0SP1SP2SP3SP4SP5SP6 - Spoolss.exe DLL Insertion

Microsoft Windows NT 4.0SP1SP2SP3SP4SP5SP6 - Spoolss.exe DLL Insertion source: https://www.securityfocus.com/bid/769/info The spooler service spoolss.exe allows local users to add their own dll files and have the spooler run them at SYSTEM level. This could lead to privilege escalation all the wa...

Sky Communications Skyfull 1.1.4 Mail Server - MAIL FROM Buffer Overflow

Sky Communications Skyfull 1.1.4 Mail Server - MAIL FROM Buffer Overflow // source: https://www.securityfocus.com/bid/759/info The Skyfull mail server version 1.1.4 has an unchecked buffer into which the argument from the MAIL FROM command is placed. This buffer can be overwritten and arbitrary...

Sambar_DoS.txt

While testing the security of the Sambar HTTP-Server I found it vulnerable to a simple DOS attack. Sending a "GET XXXX...a lot of Xs..XXXX HTTP/1.0" crashes the Server. It will die WITHOUT logging the attack. My testing-environment: Sambar 4.2.1 M$IE 5.0 de Windows 95 C de Sample exploit code...