FreeBSD : elm -- remote buffer overflow in Expires header (f66e011d-13ff-11da-af41-0004614cc33d)

Ulf Harnhammar has discovered a remotely exploitable buffer overflow in Elm e-mail client when parsing the Expires header of an e-mail message : The attacker only needs to send the victim an e-mail message. When the victim with that message in his or her inbox starts Elm or simply views the inbox...

Avast! antivirus weak file permissions

Everyone:Full Control permissions are set to program folder...

AVG 7 granting Everyone Full Control to updated files... even its drivers

There is more here: http://www.dslreports.com/forum/remark,15601404 Basically, a first time install of AVG 7 will have default permissions. Program FilesGrisoftAVG Free has inherited permissions from Program Files. This is preferred, because lower privileged accounts can't damage it. Once any fil...

AVG antivirus weak file permissions

Everyone:Full Control permission is set for files, including drivers, after update...

Unprotected PC Anywhere Service (pcAnywhere Protocol)

The PC Anywhere service does not require a password to access the desktop of this system. If this machine is running Windows 95, 98, or ME, gaining full control of the machine is trivial. If this system is running NT or 2000 and is currently logged out, an attacker can still spy on and hijack a...

CVE-2004-1714

CVE-2004-1714 affects BlackICE PC Protection and Server Protection. The issue arises from installation of firewall.ini, blackice.ini, sigs.ini, and protect.ini with Everyone Full Control permissions, enabling a local attacker to crash the service or modify configuration by editing firewall.ini (e...

Portcullis Security Advisory 05-003

Portcullis Security Advisory Vulnerable System: MediaPartner 5.0 Vulnerability Title: In Place Password Update Process Flawed Vulnerability discovery and development: Portcullis Security Testing Service Affected systems: Emotion MediaPartner Web Server Version 5.0 5.1 not confirmed Details: The...

Altiris Deployment Server server spoofing

Mutual authentication absence and multicast based server detection allow to spoof server and obtain full control under managed network...

CVE-2004-1714

BlackICE PC Protection and Server Protection installs 1 firewall.ini, 2 blackice.ini, 3 sigs.ini and 4 protect.ini with Everyone Full Control permissions, which allows local users to cause a denial of service crash or modify configuration, as demonstrated by modifying firewall.ini to contain a...

CVE-2003-0365

ICQLite 2003a creates the ICQ Lite directory with an ACE for "Full Control" privileges for Interactive Users, which allows local users to gain privileges as other users by replacing the executables with malicious programs...

CVE-2003-0365

ICQLite 2003a creates the ICQ Lite directory with an ACE for "Full Control" privileges for Interactive Users, which allows local users to gain privileges as other users by replacing the executables with malicious programs...

CVE-2003-0365

CVE-2003-0365 affects ICQLite 2003a, where the ICQ Lite directory is created with an ACE granting Full Control to Interactive Users. This permission allows local users to replace executables with malicious programs, enabling privilege escalation to other user accounts. The available sources descr...

ICQ Lite weak permissions

During installation Interactive Users: Full Control permission is added to executables directory...

ASI Sybase Security Alert: Buffer overflow in DBCC CHECKVERIFY

Sybase Adaptive Server buffer overflow in DBCC CHECKVERIFY http://www.appsecinc.com/resources/alerts/sybase/02-0001.html To determine if you should apply this hot fix, download AppDetective for Sybase from http://www.sybasesecurity.net/products/appdetective/sybase/. Risk level: High Threat: Allow...

Windows 2000 system partition weak default permissions

Title: Windows 2000 system partition weak default permissions Affected: Windows 2000 Vendor: Microsoft Author: ZARAZA Date: August, 03 2002 Risk: High Exploitable: Yes Remote: No Vendor notified: May, 17 2002 SECURITY.NNOV URL: http://www.security.nnov.ru Advanced info:...

CVE-2001-0006

The CVE-2001-0006 issue affects Windows NT 4.0 (and Terminal Server Edition) where the Winsock2ProtocolCatalogMutex has insecure Everyone/Full Control permissions. This allows a local user to modify the ACL to “No Access,” effectively disabling Winsock network connectivity and causing a denial of...

ntsecurity.nu advisory: Winsock Mutex Vulnerability in Windows NT 4.0 SP6 and below

-- Winsock Mutex Vulnerability in Windows NT 4.0 SP6 and below -- Author: Arne Vidstrom [email protected] - http://ntsecurity.nu Severity: Denial Of Service if the attacker is able to execute the exploit code under any account on the system. Remote exploitation is not possible. Details:...

CVE-2000-1106

Trend Micro InterScan VirusWall creates an "Intscan" share to the "InterScan" directory with permissions that grant Full Control permissions to the Everyone group, which allows attackers to gain privileges by modifying the VirusWall programs...

TrendMicro InterScan VirusWall shared folder problem

I could not find any reference to this particular issue on bugtraq, and as it seems rather serious I decided to submit it. This message concerns what seems to be a security 'feature' in all versions of InterScan SMTP VirusWall for Windows NT at least through version 3.4. The problem is not with t...

cuartango-window.txt

Cuartango Window http://pages.whowhere.com/computers/cuartangojc/cuartangow1.html Affected software Microsoft Internet Explorer 4 Risks Your computer is at risk a malicious VBScript can get full control over your system. The VBScript can de everything : delete files, install viruses, read your...