[Reversemode Advisory] February Advisories : Microsoft Word 2003 + Fortinet Forticlient

Hi ---------------------------- 1.Microsoft Word Memory Corruption Vulnerability Microsoft Word 2003 is prone to a memory corruption vulnerability while parsing a specially crafted Word file. The vulnerability is caused by calculation errors while parsing certain fields within the barely...

Fortinet Forticlient privilege escalation

No description provided...

Fortinet Fortigate - CRLF Characters URL Filtering Bypass

Fortinet Fortigate - CRLF Characters URL Filtering Bypass source: https://www.securityfocus.com/bid/27276/info Fortinet Fortigate is prone to a vulnerability that can allow attackers to bypass the device's URL filtering. An attacker can exploit this issue to view unauthorized websites, bypassing...

Fortinet Fortigate - CRLF Characters URL Filtering Bypass

source: https://www.securityfocus.com/bid/27276/info Fortinet Fortigate is prone to a vulnerability that can allow attackers to bypass the device's URL filtering. An attacker can exploit this issue to view unauthorized websites, bypassing certain security restrictions. This may lead to other...

urlevasion.txt

I dont know if its new but i code it during a PentTest and i would like to share it with you. It is based on code developed By sinhack research labs: http://sinhack.net/URLFilteringEvasion/sakeru.tx Description: "Fortinet's URL blocking functionality can be bypassed by specially-crafted HTTP...

FortiGuard: URL Filtering Application Bypass Vulnerability

I dont know if its new but i code it during a PentTest and i would like to share it with you. It is based on code developed By sinhack research labs: http://sinhack.net/URLFilteringEvasion/sakeru.tx Description: "Fortinet's URL blocking functionality can be bypassed by specially-crafted HTTP...

CA BrightStor ARCServe BackUp Message Engine Remote Stack Overflow Vulnerability

hi full-disclosure, CA BrightStor ARCServe BackUp Message Engine Remote Stack Overflow Vulnerability by cocoruder of Fortinet Security Research Team http://ruder.cdut.net Summary: A remote stack overflow vulnerability exist in the RPC interface of CA BrightStor ARCServe BackUp. An arbitrary...

Baidu Soba Remote Code Execute Vulnerability(FGA-2007-10)

hi full-disclosure, Baidu Soba Remote Code Execute Vulnerability by cocoruder of Fortinet Security Research Team http://ruder.cdut.net Summary: Baidu Soba is a popular browser toolbar which developed by Baidu, a Chinese web search engine company, like Google, more informations can be found at:...

Microsoft Server Service fails to properly handle network messages

Overview A vulnerability in the way Microsoft Server Service handles network messages may lead to execution of arbitrary code. Description Microsoft Server Service provides support for Remote Proceedure Call RPC, resource sharing, and named pipe communication over the network. Microsoft Server...

eIQNetworks ESA License Manager LICMGR_ADDLICENSE Overflow

This module exploits a stack buffer overflow in eIQnetworks Enterprise Security Analyzer. During the processing of long arguments to the LICMGRADDLICENSE command, a stack-based buffer overflow occurs. This module has only been tested against ESA v2.1.13. This module requires Metasploit:...

eIQnetworks Enterprise Security Analyzer License Manager Detection

The remote host is running a license manager for eIQnetworks Enterprise Security Analyzer ESA, a security information and event management application. Note that eIQnetworks Enterprise Security Analyzer is also included in third-party products such as Astaro Report Manager, Fortinet FortiReporter...

eIQnetworks Enterprise Security Analyzer Syslog Server Detection (deprecated)

Plugin has been deprecated as the software is EOL and no longer obtainable %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include"compat.inc"; if description scriptid22126; scriptversion"1.14"; scriptsetattributeattribute:"pluginmodificationdate",...

Microsoft PowerPoint does not properly handle malformed shapes

Overview Microsoft PowerPoint contains a vulnerability that may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Microsoft PowerPoint contains a vulnerability that could be exploited when PowerPoint opens a specially crafted document. Accordin...

CVE-2006-3222

The FTP proxy module in Fortinet FortiOS FortiGate before 2.80 MR12 and 3.0 MR2 allows remote attackers to bypass anti-virus scanning via the Enhanced Passive EPSV FTP mode...

CVE-2006-3222

The FTP proxy module in Fortinet FortiOS FortiGate before 2.80 MR12 and 3.0 MR2 allows remote attackers to bypass anti-virus scanning via the Enhanced Passive EPSV FTP mode...

CVE-2006-3222

The vulnerability CVE-2006-3222 affects Fortinet FortiOS FortiGate devices where the FTP proxy module (before 2.80 MR12 and 3.0 MR2) can bypass antivirus scanning by abusing Enhanced Passive (EPSV) FTP mode. Affected product: FortiGate/FortiOS FTP proxy. Root cause: FTP proxy mishandles EPSV in a...

CVE-2006-1966

An unspecified Fortinet product, possibly Fortinet28, allows remote attackers to cause a denial of service via a "small synflood" to the SMTP port TCP port 25, as demonstrated by a 10-microsecond wait between sending packets. NOTE: this issue has been disputed in followup posts that suggest that ...

Design/Logic Flaw

An unspecified Fortinet product, possibly Fortinet28, allows remote attackers to cause a denial of service via a "small synflood" to the SMTP port TCP port 25, as demonstrated by a 10-microsecond wait between sending packets. NOTE: this issue has been disputed in followup posts that suggest that ...

CVE-2006-1966

CVE-2006-1966 targets an unspecified Fortinet product (possibly Fortinet28) and describes a remote denial-of-service via a small synflood to SMTP (TCP 25). The underlying cause and affected version details are not provided in the documents. The note mentions dispute that a protection feature trig...

CVE-2006-1966

An unspecified Fortinet product, possibly Fortinet28, allows remote attackers to cause a denial of service via a "small synflood" to the SMTP port TCP port 25, as demonstrated by a 10-microsecond wait between sending packets. NOTE: this issue has been disputed in followup posts that suggest that ...