wingate-killer.pl

Date: Sat, 14 Nov 1998 13:51:30 -0500 From: G23 To: [email protected] Subject: crashing wingates Hello, The following one-liner will crash an open Wingate. perl -MIO::Socket -e \ 'IO::Socket::INET-newPeerAddr="wingate.to.hoze:23"\ -send"X" x 4400 . "\n",0' Unfortunately I don't have access to...

ipop3d.4.xx.bof.txt

Date: Sun, 7 Mar 1999 01:41:25 +0100 From: Michal Zalewski Overflow in CAC.Washington.EDU ipop3d 4.xx CAC.Washington.EDU ipop3d 4.xx, at least on Linux platform, has serious security hole. When data is read from so-called mailbox lock created in /tmp directory this happens under certain condition...

ipop2d.txt

Vulnerable Program: POP2 shipped with imap-4.4 package Platforms: Linux Impact: Remote users can spawn a shell with uid of user "nobody" Reported Initally: Chris Evans Exploit Code: bind Details: -------- POP-2 supports anonymous proxy service where remote users can connect to remote imap servers...

WebTrends Enterprise Reporting Server 1.5 - Negative Content Length Denial of Service

source: https://www.securityfocus.com/bid/569/info Specifying a negative content-length in a POST operation to the WebTrends Enterprise Reporting Server will crash the web server. !/usr/bin/perl -w Example DoS against WebTrends Enterprise Reporting Server 8/8/99 rpc use IO::Socket; die "usage: $0...

Fujitsu Chocoa 1.0 beta7R - Topic Remote Buffer Overflow

Fujitsu Chocoa 1.0 beta7R - Topic Remote Buffer Overflow // source: https://www.securityfocus.com/bid/573/info The Chocoa IRC client has an unchecked buffer in the code that processes channel topics. If the server returns a topic that overwrites the client's buffer and contains exploit code...

ToxSoft NextFTP 1.82 - Remote Buffer Overflow

ToxSoft NextFTP 1.82 - Remote Buffer Overflow // source: https://www.securityfocus.com/bid/572/info ToxSoft's shareware FTP client, NextFTP, contains an unchecked buffer in the code that parses CWD command replies. If the FTP server's reply contains the exploit code, arbitrary commands can be run...

Fujitsu Chocoa 1.0 beta7R - 'Topic' Remote Buffer Overflow

// source: https://www.securityfocus.com/bid/573/info The Chocoa IRC client has an unchecked buffer in the code that processes channel topics. If the server returns a topic that overwrites the client's buffer and contains exploit code arbitrary commands can be run on the client system...

IBM AIX 4.2.1 / Sun Solaris 7.0 - LC_MESSAGES libc Buffer Overflow (3)

/ source: https://www.securityfocus.com/bid/268/info A buffer overflow in libc's handling of the LCMESSAGES environment variable allows a malicious user to exploit any suid root program linked agains libc to obtain root privileges. This problem is found in both IBM's AIX and Sun Microsystem's...

Sun Solaris 7.0 - '/usr/bin/lpset' Local Buffer Overflow

/ source: https://www.securityfocus.com/bid/251/info A stack buffer overflow vulnerability in the handling of the "-a" command in the lpset program allows arbitrary execution of code with root privileges. The lpset utility sets printing configuration information in the system configuration...

Rational Software ClearCase for Unix 3.2 - ClearCase SUID

Rational Software ClearCase for Unix 3.2 - ClearCase SUID source: https://www.securityfocus.com/bid/538/info Rational Software's ClearCase product includes a vulnerability whereby an unprivileged user can have any readable executable set to SUID root.. A 1.5 meg file is copied and then chmod'ed t...

Rational Software ClearCase for Unix 3.2 - ClearCase SUID

source: https://www.securityfocus.com/bid/538/info Rational Software's ClearCase product includes a vulnerability whereby an unprivileged user can have any readable executable set to SUID root.. A 1.5 meg file is copied and then chmod'ed to SUID, and during the time this file is being copied it c...

Alt-N MDaemon Server 2.71 SP1 - SMTP HELO Argument Buffer Overflow

Alt-N MDaemon Server 2.71 SP1 - SMTP HELO Argument Buffer Overflow // source: https://www.securityfocus.com/bid/8622/info It has been reported that Alt-N MDaemon server is prone to an SMTP HELO command argument buffer overflow vulnerability. The issue presents itself likely due to insufficient...

RedHat Linux 5.0/5.1/5.2 / Slackware Linux 3.5 - 'klogd' Local Buffer Overflow (1)

// source: https://www.securityfocus.com/bid/398/info It is possible to cause a denial of service remote and local through generating old, obscure kernel messages not terminated with \n in klogd. The problem exists because of a buffer overflow in the klogd handling of kernel messages. It is...

DataLynx suGuard 1.0 - Local Privilege Escalation

source: https://www.securityfocus.com/bid/186/info A vulnerability exists within the DataLynx's suGuard program which allows a local attacker to gain administrative privilege by exploiting poor use of the /tmp directory and poor programming. !/bin/sh sgrun exploit - the types of vulnerabilities...

Sendmail 8.9.2 - Headers Prescan Denial of Service

Sendmail 8.9.2 - Headers Prescan Denial of Service / against.c - Another Sendmail and pine ;- DoS up to 8.9.2 c 1999 by Usage: ./against existinguseronvictimhost victimhost Example: ./against nobody lamers.net / include include include include include include include include include include inclu...

RedHat Linux 4.2 / SGI IRIX 6.3 / Solaris 2.6 - 'mailx' (1)

// source: https://www.securityfocus.com/bid/393/info A buffer overrun exists in the /bin/mailx program. This program was originally developed as part of BSD, and is available on many Unix systems. By supplying a long, well crafted buffer as the username argument, an attacker can use it to execua...

Fred N. van Kempen dip 3.3.7 - Local Buffer Overflow (1)

Fred N. van Kempen dip 3.3.7 - Local Buffer Overflow 1 // source: https://www.securityfocus.com/bid/86/info A buffer overflow resides in 'dip-3.3.7o' and derived programs. This is a problem only on systems where 'dip' is installed setuid. The culpable code is an 'sprintf' in line 192 in 'main.c':...

Fred N. van Kempen dip 3.3.7 - Local Buffer Overflow (1)

// source: https://www.securityfocus.com/bid/86/info A buffer overflow resides in 'dip-3.3.7o' and derived programs. This is a problem only on systems where 'dip' is installed setuid. The culpable code is an 'sprintf' in line 192 in 'main.c': sprintfbuf, "%s/LCK..%s", PATHLOCKD, nam; -----...

Fred N. van Kempen dip 3.3.7 - Local Buffer Overflow (2)

Fred N. van Kempen dip 3.3.7 - Local Buffer Overflow 2 // source: https://www.securityfocus.com/bid/86/info A buffer overflow resides in 'dip-3.3.7o' and derived programs. This is a problem only on systems where 'dip' is installed setuid. The culpable code is an 'sprintf' in line 192 in 'main.c':...

Apple Personal Web Sharing 1.1 - Remote Denial of Service

Apple Personal Web Sharing 1.1 - Remote Denial of Service source: https://www.securityfocus.com/bid/84/info There appears to be a buffer overflow in Apple's Personal Web Sharing 1.1. If you connect to its TCP port number 80 and send it a string over three thousand bytes long followed by two retur...