Roxen security alert: Problems with URLs containing null characters.

Roxen 2.0 up to version 2.0.68 has a vulnerability where using URLs containing null characters can gain the browser access to information he is not authorized to: Directory listings in directories with index files In normal filesystems: the sourcecode for RXML files, Pike scripts, CGIs etc...

wu-ftpd remote exploit patched

A remote exploit has been found in the FTP daemon, wu-ftpd. This can allow an attacker full access to your machine. The wu-ftpd daemon is part of the tcpip1.tgz package in the N series. A new tcpip1.tgz package is now available in the Slackware 7.1 tree. We have also provided a seperate patch...

glftpd.privpath.txt

Glftpd 1.18 till 1.21b8 current beta have a serious problem with the privpath directives.... It will probably be fixed in the comming 1.21b9 but i have included a quick fix in this one to prevent exploits of this bug. Thanx for Hoopy for the quick fix glftpd dev team. Problem: When you know the...

infradig_1225_5-3-00.txt

+++=== Written by Nemesystm, leader of the DHC ===== Visit us at dhc1.cjb.net You want 2 == Infradig 1.225 for Windows 95/98 downloaded from cnet.com Installed with the typical installation, no standard settings changed. This problem worked on: Windows 98 + IE5.0 The administration service runs o...

wmmon.freebsd.txt

Posted Tuesday, December 21, 1999 - 16:41 by reid: Steve Reid wrote: Wmmon is a popular program for monitoring CPU load and other system utilization. It runs as a dockapp under WindowMaker. The FreeBSD version of this program has a feature that can be trivially exploited to gain group kmem in...

Majordomo 1.94.4/1.94.5 - Local -C Parameter (2)

// source: https://www.securityfocus.com/bid/903/info It is possible for a local user to gain majordomo privileges through a vulnerability which allows privileged arbitrary commands to be executed. If the -C parameter is passed to majordomo or one of several other scripts when run with the setuid...

[SECURITY] Updated i386 package for sendmail

------------------------------------------------------------------------ Debian Security Advisory [email protected] http://www.debian.org/security/ Wichert Akkerman December 7, 1999 - ------------------------------------------------------------------------ The version of sendmail that was...

[SECURITY] New version of bind released

The version bind that was distributed in Debian GNU/Linux 2.1 has a vulnerability in the processing of NXT records that can be used by an attacked in a Debian of Service attack or theoretically be exploited to gain access to the server. This has been fixed in version 8.2.5p5-0slink1, and we...

SunOS 4.1.1 - '/usr/release/bin/winstall' Local Privilege Escalation

source: https://www.securityfocus.com/bid/22/info This applies to sites that have installed Sun Source tapes only. The Sun distribution of sources sunsrc has an installation procedure which creates the directory /usr/release/bin and installs two setuid root files in it: makeinstall and winstall...

proftpd_exploit.txt

Subject: ProFTPD To: [email protected] / !!!! Private .. ... distribute !!!! proftpd-1.2.0 remote root exploit beta2 Still need some code, but it works fine Offset: Linux Redhat 6.0 0 - proftpd-1.2.0pre1 0 - proftpd-1.2.0pre2 0 - proftpd-1.2.0pre3 If this dont work, try changing the align...

[SECURITY] New versions of epic4 fixes possible DoS vulnerability

Debian Security Advisory [email protected] http://www.debian.org/security/ Martin Schulze August 26, 1999 We have received a report from the author of epic4 covering a denial of service vulnerability. All versions of epic4 between version pre1.034 including and version pre2.004-19990718 excludi...

vintra.txt

From: Vytis Fedaravicius Subject: DOS in Vintra systems Mailserver software. Hello, There is a bug in a free MailServer software for Windows NT from Vintra systems http://www.vintra.com/mailsrvr.html . Any remote user can cause MTA to go nuts and make CPU ussage up to 99%, eat all available memor...

mother2.sh

!/bin/sh mother2.sh by; syg @ EFnet AKA the bitch who doesnt care to take credit for such a worthless script that doesnt do anything hard, I just wanted to say those other two bitches are dumb as fuck for even sending this to the public and actually making a huge prop header as if it was some sor...

icq.webserver.exploits.txt

ICQ Homepage Exploit By Shadow51 Ever wondered why there is a little house beside the name of some people? That doesn't mean they are at home, it means they have the ICQ-Webserver running. The idiots who made it left huge bugs in it, like you can close their ICQ remotely, and even download their...

asmcodes.txt

http://www.rootshell.com/ ----------------- begin asmcodes.txt --------------------- -- Assembly drop in replacements -- Probably useless, but can be a little fun ;- Here are some assembly instructions that you can drop into your favorite buffer overflow exploit. Generally, replacing existing...

cable.modem.ip.hijack.txt

Cable Modem IP Hijacking in Win95/98 The purpose of this is to show you how bad cable modems security is and that even with a win box you can take someone else's IP. You can hijack IP's using a cable modem and it's very simple in any operating system. Just follow the steps: 1 Choose someone's IP...

University of Washington pop2d 4.4 - Remote Buffer Overflow

University of Washington pop2d 4.4 - Remote Buffer Overflow // source: https://www.securityfocus.com/bid/283/info A buffer overflow vulnerability in pop2d version 4.4 or earlier allow malicious remote users to obtain access to the "nobody" user account. The pop2 and pop3 servers support the conce...

Re: [SECURITY] New versions of super fixes two buffer overflows

Martin Schulze wrote: ==================================================================== Debian GNU/Linux Security February 15th, 1999 We have received reports about two buffer overflows in the super package which was distributed as part of Debian GNU/Linux. Firstly, for per-user .supertab file...

[SECURITY] New version of zgv fixes buffer overflows

We have received reports that the zgv package is vulnerable to buffer overflows. We recommend you upgrade your zgv package immediately. wget url will fetch the file for you dpkg -i file.deb will install the referenced file. Debian GNU/Linux 2.0 alias hamm This version of Debian was released only...

[SECURITY] Current versions of lpr fixes security problem

We have received reports that buffer overflows in lprm may allow users to gain root access to the local system. We recommend that you use the binaries from hamm or any newer release. dpkg -i file.deb will install the referred file. Debian GNU/Linux 2.0 alias hamm Source archives:...