BolinTech DreamFTP Server 1.2 (1.02/TryFTP 1.0.0.1) - Remote User Name Format String

include include include include // WIN NT/2K/XP cmd.exe shellcode // kernel32.dll baseaddress calculation: OS/SP-independent // string-save: 00, 0a and 0d free. // portbinding: port 28876 // looping: reconnect after disconnect char shellcode =...

Crashing Unreal 3.1.6 + NO_IDENT_CHECKING ENABLED [http://virulent.port5.com/dosyalar/unreal_en.txt]

------------------------------------------------- CRASHING UNREAL 3.1.6 + NOIDENTCHECKING ENABLED ------------------------------------------------- DESCRIPTION OF SOFTWARE ----------------------- UnrealIRCd is an IRC server based on the branch of IRCu called Dreamforge, formerly used by the DALne...

HD Soft Windows FTP Server 1.51.6 - Username Format String

HD Soft Windows FTP Server 1.51.6 - Username Format String // source: https://www.securityfocus.com/bid/9385/info It has been reported that Windows FTP Server may be prone to a remote format string vulnerability when processing a malicious request from a client. The vulnerability presents itself...

Multiple Vulnerabilities Sybase Anywhere 9

NGSSoftware Insight Security Research Advisory Name: Multiple Vulnerabilities in Adaptive Server Anywhere Network Server Version 9.0.0 Systems Affected: SQL Anywhere 9 Windows 2000 / XP Have not been verified on UNIX Severity: Critical Vendor URL: http://www.sybase.com Authors: Sherief Hammad...

Tolis Group BRU 17.0 - Local Privilege Escalation (1)

Tolis Group BRU 17.0 - Local Privilege Escalation 1 // source: https://www.securityfocus.com/bid/8215/info It has been reported that BRU may not properly parse commandline arguments, potentially leading to at least two vectors of exploitation. It may be possible for local attackers to conduct...

Tolis Group BRU 17.0 - Local Privilege Escalation (1)

// source: https://www.securityfocus.com/bid/8215/info It has been reported that BRU may not properly parse commandline arguments, potentially leading to at least two vectors of exploitation. It may be possible for local attackers to conduct format string-based attacks as well as buffer...

Tolis Group BRU 17.0 - Local Privilege Escalation (2)

Tolis Group BRU 17.0 - Local Privilege Escalation 2 // source: https://www.securityfocus.com/bid/8215/info It has been reported that BRU may not properly parse commandline arguments, potentially leading to at least two vectors of exploitation. It may be possible for local attackers to conduct...

Tolis Group BRU 17.0 - Local Privilege Escalation (2)

// source: https://www.securityfocus.com/bid/8215/info It has been reported that BRU may not properly parse commandline arguments, potentially leading to at least two vectors of exploitation. It may be possible for local attackers to conduct format string-based attacks as well as buffer...

Magic Winmail Server PASS Command Remote Format String

The remote Winmail POP server, according to its banner, is vulnerable to a format string attack when processing the USER command. An unauthenticated attacker may use this flaw to execute arbitrary code on this host. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid11742...

mod_gzip Debug Mode mod_gzip_printf Remote Format String

The remote host is running modgzip with debug symbols compiled in. The debug code includes vulnerabilities that can be exploited by an attacker to gain a shell on this host. C Tenable Network Security, Inc. Ref: From: "Matthew Murphy" To: "BugTraq" , Subject: Modgzip Debug Mode Vulnerabilities...

[SECURITY] [DSA 277-1] New apcupsd packages fix remote root exploit

-------------------------------------------------------------------------- Debian Security Advisory DSA 277-1 [email protected] http://www.debian.org/security/ Martin Schulze April 3rd, 2003 http://www.debian.org/security/faq -...

Generic Format String Detection

Nessus killed the remote service by sending it specially crafted data. The remote service seems to be vulnerable to a format string attack. An attacker might use this flaw to make it crash or even execute arbitrary code on this host. C Tenable Network Security, Inc. References: Date: Wed, 20 Mar...

Sun AnswerBook2 Web Server dwhttpd GET Request Remote Format String

The remote web server is vulnerable to a format string attack. An attacker may exploit this vulnerability to cause the web server to crash continually or even execute arbitrary code on the system. C Tenable Network Security, Inc. Script audit and contributions from Carmichael Security Erik Anders...

CVE-2002-0175

libsafe 2.0-11 and earlier allows attackers to bypass protection against format string vulnerabilities via format strings that use the "'" and "I" characters, which are implemented in libc but not libsafe...

CVE-2001-1215

Format string vulnerability in PFinger 0.7.5 through 0.7.7 allows remote attackers to execute arbitrary code via format string specifiers in a .plan file...

Solaris rpc.rwalld Remote Format String Arbitrary Code Execution

The rpc.walld RPC service is running. Some versions of this server allow an attacker to gain root access remotely, by consuming the resources of the remote host then sending a specially formed packet with format strings to this host. Solaris 2.5.1, 2.6, 7, 8 and 9 are vulnerable to this issue...

GNOME libgtop Daemon Remote Format String

It seems that libgtop is/was running on this port and is vulnerable to a format string attack which may allow an attacker to gain a shell on this host with the privileges of 'nobody'. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10812; scriptversion"1.20";...

Network Solutions Rwhoisd Syslog Remote Format String

The remote rwhois daemon is vulnerable to a format string attack when supplied malformed arguments to a malformed request such as %p%p%p. An attacker may use this flaw to gain a shell on this host. Note that Nessus solely relied on the banner version to issue this warning. If you manually patched...

locale_sol.txt

----/ Exploiting the Libc Locale Subsystem Format String Vulnerability on Solaris/SPARC ---/ 10/10/2000 -/ Solar Eclipse ---/ I. Introduction This paper describes in detail the exploitation of the libc locale format strin g vulnerability on Solaris/SPARC. The full source code for the exploit is...

Network Solutions Rwhoisd -soa Command Remote Format String

The remote rwhois daemon is vulnerable to a format string attack when supplied malformed arguments to a '-soa' request. An attacker may use this flaw to gain a shell on this host. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid10790; scriptversion "1.16";...