Real Networks Real Server 5.0 - ramgen Denial of Service

Real Networks Real Server 5.0 - ramgen Denial of Service // source: https://www.securityfocus.com/bid/888/info RealServer 5.0 can be crashed by sending an overly long 4082+ bytes ramgen request. Regular functionality can be restored by restarting the RealServer software. / rmscrash.c - [email protected]...

VDOLive Player 3.0.2 - Local Buffer Overflow

// source: https://www.securityfocus.com/bid/872/info VDOLive Player v3.02 has an unchecked buffer that can allow arbitrary code to be executed if a specially-crafted .vdo file is loaded. /==================================================================== exvdolive.c / VDO Live Player 3.02 32bi...

unixware7.gethostbyname.txt

Greetings, OVERVIEW A serious bug exists in UnixWare 7.1's libc. A buffer overflow in gethostbyname will allow any user to obtain elevated privileges. BACKGROUND Is this the same gethostbyname overflow which was present in ancient versions of non-unixware libc's way back when? I can't say for sur...

Solaris 7.0 - 'kcms_configure' Local Overflow / Local Privilege Escalation

/ source: https://www.securityfocus.com/bid/831/info The binary kcmsconfigure, part of the Kodak Color Management System package shipped with OpenWindows and ultimately, Solaris is vulnerable to a local buffer overflow. The buffer which the contents of the environment variable NETPATH are copied...

irfan.view32.txt

The popular Image viewer "Irfan View32" contains the buffer overflow problem, this problem exists in the handling of Adobe Photoshop image file. Irfan view checks the image type by the image header, if "8BPS" pattern is found in the header, Irfan view judges this file as Photo Shop image. We thin...

Microsoft Windows NT 4.0/SP1/SP2/SP3/SP4/SP5/SP6 - 'Spoolss.exe' DLL Insertion

source: https://www.securityfocus.com/bid/769/info The spooler service spoolss.exe allows local users to add their own dll files and have the spooler run them at SYSTEM level. This could lead to privilege escalation all the way up to Administrator level. The problem is in the function...

Microsoft Windows NT 4.0SP1SP2SP3SP4SP5SP6 - Spoolss.exe DLL Insertion

Microsoft Windows NT 4.0SP1SP2SP3SP4SP5SP6 - Spoolss.exe DLL Insertion source: https://www.securityfocus.com/bid/769/info The spooler service spoolss.exe allows local users to add their own dll files and have the spooler run them at SYSTEM level. This could lead to privilege escalation all the wa...

Sky Communications Skyfull 1.1.4 Mail Server - MAIL FROM Buffer Overflow

Sky Communications Skyfull 1.1.4 Mail Server - MAIL FROM Buffer Overflow // source: https://www.securityfocus.com/bid/759/info The Skyfull mail server version 1.1.4 has an unchecked buffer into which the argument from the MAIL FROM command is placed. This buffer can be overwritten and arbitrary...

Sambar_DoS.txt

While testing the security of the Sambar HTTP-Server I found it vulnerable to a simple DOS attack. Sending a "GET XXXX...a lot of Xs..XXXX HTTP/1.0" crashes the Server. It will die WITHOUT logging the attack. My testing-environment: Sambar 4.2.1 M$IE 5.0 de Windows 95 C de Sample exploit code...

True North Software Internet Anywhere Mail Server 2.3.x - Mail Server Multiple Buffer Overflow

True North Software Internet Anywhere Mail Server 2.3.x - Mail Server Multiple Buffer Overflow // source: https://www.securityfocus.com/bid/730/info // // True North Software's Internet Anywhere Mail Server has various weaknesses that could allow an attacker to remotely crash the server running...

IBM AIX 4.3.2 - 'ftpd' Remote Buffer Overflow

source: https://www.securityfocus.com/bid/679/info A remote buffer overflow vulnerability in AIX's ftpd allows remote users to obtain root access. !/usr/bin/perl Synnergy Networks Description: Remote bufferoverflow exploit for ftpd from AIX 4.3.2 running on an RS6000. power This is an return into...

SuSE Linux 6.2 sscw - HOME Environment Variable Buffer Overflow

SuSE Linux 6.2 sscw - HOME Environment Variable Buffer Overflow source: https://www.securityfocus.com/bid/656/info A buffer overflow vulnerability in sscw's handling of the HOME environment variable allows local users to gain root privileges. !/bin/bash Linux x86 exploit for /usr/bin/sccw on SuSE...

SuSE Linux 6.2 sscw - HOME Environment Variable Buffer Overflow

source: https://www.securityfocus.com/bid/656/info A buffer overflow vulnerability in sscw's handling of the HOME environment variable allows local users to gain root privileges. !/bin/bash Linux x86 exploit for /usr/bin/sccw on SuSE 6.2 -Brock Tellier [email protected] echo "Building...

iis4_remote_DoS.txt

Subject: IIS 4.0 remote DoS MS99-029 To: [email protected] Hi, I found a kind of DoS attack against IIS 4.0 on NT SP4 & SP5. I reported it to MS and they've provided HotFix for this. Problem Description ------------------- Simple play. I sent lots of "Host:aaaaa...aa" to IIS like... GET /...

netscape_ssl_bug.txt

Subject: Netscape Enterprise Server SSL Handshake Bug To: [email protected] Hi everybody, There exists a SSL handshake bug in Netscape Enterprise Server that can be exploited to crash the server. Netscape has confirmed this, and they also told me that another person reported this to them...

linux.2.x.ipc.DoS.txt

Date: Sun, 7 Mar 1999 01:41:25 +0100 From: Michal Zalewski Linux 2.x IPC vunerability Linux IPC implementation seems to be broken. I noticed Alan about one/two months ago, so I believe it has been fixed in recent 2.2.x Linuxes. In fact, any luser may consume whole memory available on system using...

iis4.htr.pl

Re: Retina vs. IIS4, Round 2, KO Ryan R Permeh [email protected] Tue, 15 Jun 1999 17:01:23 -0500 tested, this works for me... scripting was turned on... perl exploit code follows: !/usr/bin/perl props to the absu crew use Net::Telnet; for $i=2500;$inew Host = "$ARGV0",Port = 80; my $cmd = "GE...

solaris-lpstat-bof.txt

Date: Wed, 27 Jan 1999 16:53:51 +0100 From: Anthony C . Zboralski To: [email protected] Subject: HERT Advisory 001 Buffer overflow in Solaris /usr/bin/lpstat -----BEGIN PGP SIGNED MESSAGE----- - ------------------------------------------------------------- HERT - Hacker Emergency Response Team...

iParty.daemon.DoS.txt

Date: Sat, 08 May 1999 13:11:34 EDT From: wh00t X To: [email protected] Cc: [email protected], [email protected] Subject: iParty Daemon Vulnerability w/ Exploit Code worse than thought? Hi, iParty, by Intel Experimental Technologies Department, unofficial information source a...

ms.winhelp.exploit.txt

Date: Mon, 24 May 1999 07:18:23 +0100 From: Mnemonix To: [email protected] Subject: Exploit and Analysis of the Winhlp32.exe buffer overrun. Analysis of the winhlp32.exe buffer overrun. The buffer overrun in winhlp32.exe occurs when it attempts to read a cnt file with an overly lon...