Buffer overflow in fake ident

Off-by-one buffer overflow...

fake identd (fakeidentd) Fragmented Packet Request Remote Overflow

The identd server on this port seems to be a version of fake identd that fails to properly validate user input before copying it into a buffer of fixed size. By splitting data into two or more packets, an anonymous remote attacker can overflow the input buffer and execute arbitrary code with root...

Fake Identd 0.9/1.x - Client Query Remote Buffer Overflow

// source: https://www.securityfocus.com/bid/5351/info Fake Identd is an open source Ident server designed to return the same information to all incoming requests. It is implemented by Tomi Ollila, and available for Linux and a number of other Unix based operating systems. Reportedly, some versio...

Fake Identd 0.91.x - Client Query Remote Buffer Overflow

Fake Identd 0.91.x - Client Query Remote Buffer Overflow // source: https://www.securityfocus.com/bid/5351/info Fake Identd is an open source Ident server designed to return the same information to all incoming requests. It is implemented by Tomi Ollila, and available for Linux and a number of...

Outlook \r expliots - ripMIME fix.

A recent announcement of ripMIME 1.2.12 has been superceded with a new release which covers several issues as mentioned in [email protected]'s content-exploits analysis post. Specifically, "0 data poisoning" and "fake-end-of-line termination" due to fgets have been immediately covered. Issu...

NIDS Evasion Options

This plugin configures Nessus for NIDS evasion see the 'Prefs' panel. NIDS evasion options are useful if you want to determine the quality of the expensive NIDS you just bought. TCP Evasion techniques : - Split : send data one byte at a time. This confuses NIDS which do not perform stream...

And another (same) bug in DCForum at user registration process (dcscripts.com)

When registering a user and not allowing him to choose a password, a password is generated by the same algorithm as the algorithm used when creating new password for a user who lost it. Once again, the password is predictable, thus bypasses all limitations of using a valid mailbox for user...

Cgisecurity Paper #4: Header Based Exploitation: Web Statistical Software Threats

Hello, Below is a paper I wrote on some threats that web statistical software faces in regards to header manipulation. I've decided to include 1 product affected by this to show that this is very possible. Product: w3perl Vendor: http://www.w3perl.com Patch: http://www.w3perl.com/download/ Upgrad...

IE bookmark 'clever' feature not so clever after all

short: type the name of one of your bookmarksfavorites in the addressfield in IE, and IE will execute the bookmark. bit longer: its trivial to trick a user into accepting a bookmark for a popular site, uh, lets say www.hotmail.com .. or placing it yourself. effect: users wont be able to access...

newsbug.txt

------=NextPart000015301BF7FF9.87FC33E0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable I created my NewsBug approximately 2-3 months ago but never did = anything further with it as I have a lot of other projects I am working = on. I reported this to MS ...

CVE-1999-0195

Denial of service in RPC portmapper allows attackers to register or unregister RPC services or spoof RPC services using a spoofed source IP address such as 127.0.0.1...

sl0scan.pl

Date: Tue, 9 Feb 1999 20:53:34 -0500 From: miff To: [email protected] Subject: sl0scan ambiguous source portscanner hello all, I hear that maybe nmap does something similar to this, but I'm posting it anyway to see if there is enough interest for me to continue developing it. This is based on...