AIX 3.x/4.x / Windows 95/98/2000/NT 4.0 / SunOS 5 - 'gethostbyname()' Remote Buffer Overflow

source: https://www.securityfocus.com/bid/6853/info A vulnerability has been discovered in multiple vendor implementations of the 'gethostbyname' library function, which is used to resolve network addresses. The 'gethostbyname' function fails to implement sufficient bounds checking on data copied...

NaviCOPA Web Server 2.01 - GET Remote Buffer Overflow

NaviCOPA Web Server 2.01 - GET Remote Buffer Overflow / naviexp.c NaviCOPA Web Server 2.01 0day Remote Buffer Overflow Exploit Coded by h07 Tested on XP SP2 Polish, 2000 SP4 Polish Example: C:\naviexp 192.168.0.1 0 NaviCOPA Web Server 2.01 0day Remote Buffer Overflow Exploit Coded by h07 + Sendin...

crossfire-server 1.9.0 - 'SetUp()' Remote Buffer Overflow

// crossfire-server include include include include include include include include define PORT 13327 // default port define SCPORT 33333 // default shellcode port define SCHOST "127.0.0.1" // default shellcode host unsigned char sccb = // izik's...

FreeBSD : mysql -- mysql_real_connect buffer overflow vulnerability (835256b8-46ed-11d9-8ce0-00065be4b5b6)

The mysqlrealconnect function doesn't properly handle DNS replies by copying the IP address into a buffer without any length checking. A specially crafted DNS reply may therefore be used to cause a buffer overflow on affected systems. Note that whether this issue can be exploitable depends on the...

CVE-2004-1485: Undefined Security Weakness

Buffer overflow in the TFTP client in InetUtils 1.4.2 allows remote malicious DNS servers to execute arbitrary code via a large DNS response that is handled by the gethostbyname function...

suid scotty / ntping overflow

here is the offending code and the attached letter has the general information for this issue. in /home/d0tslash/scotty-2.1.0/tnm/ntping/ntping.c char hname; / hostname / ... else char tmp 512; struct hostent hp; strcpy tmp, hname; ifdef HAVERES / try to spend no longer than some seconds: /...

CVE-1999-0101

CVE-1999-0101 describes a buffer overflow in the AIX/Solaris gethostbyname() library call that allows root access through corrupt DNS host names. Affected: AIX 3.x/4.x, SunOS/Solaris; impact: potential full host compromise. Root cause: insufficient bounds checking in gethostbyname() implementatio...

CVE-1999-0101: Undefined Security Weakness

Buffer overflow in AIX and Solaris "gethostbyname" library call allows root access through corrupt DNS host names...

SCO Unixware 7.1 pkginstall - Local Buffer Overflow

// source: https://www.securityfocus.com/bid/853/info It is possible to view the entries in /etc/shadow through exploiting a buffer overflow in pkgcat and pkginstall. Though neither of these binaries are setuid, the dacread permissions which are granted in /etc/security/tcb/privs give them the...

unixware7.gethostbyname.txt

Greetings, OVERVIEW A serious bug exists in UnixWare 7.1's libc. A buffer overflow in gethostbyname will allow any user to obtain elevated privileges. BACKGROUND Is this the same gethostbyname overflow which was present in ancient versions of non-unixware libc's way back when? I can't say for sur...