samba: Multiple heap-based buffer overflows in memory management based on NDR marshalling code output

The RPC code generator in Samba 3.x before 3.4.16, 3.5.x before 3.5.14, and 3.6.x before 3.6.4 does not implement validation of an array length in a manner consistent with validation of array memory allocation, which allows remote attackers to execute arbitrary code via a crafted RPC call...

Interactive Data eSignal Stack Buffer Overflow (CVE-2011-3494)

A stack buffer overflow vulnerability exists in Interactive Data eSignal. The vulnerability is due to insufficient string length validation when copying input into a fixed size stack buffer in certain file types.A remote attacker may exploit this issue by enticing a target user to open a speciall...

SonicWall SSL-VPN NetExtender ActiveX Control Buffer Overflow (CVE-2007-5603)

An arbitrary code execution vulnerability has been reported in SonicWall SSL-VPN NetExtender. The vulnerability is due to insufficient length validation by an ActiveX control. A remote attacker may exploit this vulnerability by sending a specially crafted request to an affected service. Successfu...

PT-2011-4187 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 3.1-rc3 Description: The issue is related to the befs follow link function in fs/befs/linuxvfs.c, which does not validate the length attribute of long symlinks. This allows local users to cause a denial of servi...

kernel: drivers/scsi/mpt2sas: prevent heap overflows

drivers/scsi/mpt2sas/mpt2sasctl.c in the Linux kernel 2.6.38 and earlier does not validate 1 length and 2 offset values before performing memory copy operations, which might allow local users to gain privileges, cause a denial of service memory corruption, or obtain sensitive information from...

Microsoft Windows LSASS Length Validation Privilege Escalation (MS11-014; CVE-2011-0039)

The Local Security Authority Subsystem Service LSASS provides an interface for managing local security, domain authentication, and Active Directory service processes. It handles authentication for the client and for the server. An elevation of privilege vulnerability has been reported in the way...

Windows NT NNTP Component Buffer Overflow

The Network News Transfer Protocol NNTP component of Microsoft Windows NT Server 4.0, Windows 2000 Server, Windows Server 2003, Exchange 2000 Server, and Exchange Server 2003 allows remote attackers to execute arbitrary code via XPAT patterns, possibly related to improper length validation and an...

Windows NT NNTP Component Buffer Overflow

The Network News Transfer Protocol NNTP component of Microsoft Windows NT Server 4.0, Windows 2000 Server, Windows Server 2003, Exchange 2000 Server, and Exchange Server 2003 allows remote attackers to execute arbitrary code via XPAT patterns, possibly related to improper length validation and an...

Oracle Database 10.1.0.5 - 10.2.0.4 AUTH_SESSKEY length validation

Exploit for unknown platform in category remote exploits ========================================================================== Oracle Database 10.1.0.5 - 10.2.0.4 AUTHSESSKEY length validation exploit ========================================================================== Title: Oracle...

Oracle Database 10.1.0.5 - 10.2.0.4 AUTH_SESSKEY length validation exploit

No description provided by source. include winsock2.h include stdio.h include string.h include windows.h include assert.h include string void ssend SOCKET s, char msg, DWORD size int sent; printf "ssend: begin: %d bytes\n", size; sent=send s, charmsg, size, 0; if sent==SOCKETERROR printf "send -...

Fedora 10 : krb5-1.6.3-18.fc10 (2009-2852)

This update incorporates patches to fix potential read overflow and NULL pointer dereferences in the implementation of the SPNEGO GSSAPI mechanism CVE-2009-0844, CVE-2009-0845, attempts to free an uninitialized pointer during protocol parsing CVE-2009-0846, and a bug in length validation during...

Fedora Core 10 FEDORA-2009-2852 (krb5)

The remote host is missing an update to krb5 announced via advisory FEDORA-2009-2852. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

Fedora Core 9 FEDORA-2009-2834 (krb5)

The remote host is missing an update to krb5 announced via advisory FEDORA-2009-2834. OpenVAS Vulnerability Test $Id: fcore20092834.nasl 6624 2017-07-10 06:11:55Z cfischer $ Description: Auto-generated from advisory FEDORA-2009-2834 krb5 Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft...

Fedora 9 : krb5-1.6.3-16.fc9 (2009-2834)

This update incorporates patches to fix potential read overflow and NULL pointer dereferences in the implementation of the SPNEGO GSSAPI mechanism CVE-2009-0844, CVE-2009-0845, attempts to free an uninitialized pointer during protocol parsing CVE-2009-0846, and a bug in length validation during...

krb5 security update

1.3.4-60.el47.2 - whoops, actually add the patches 1.3.4-60.el47.1 - add fix for attempt to free uninitialized pointer in the ASN.1 decoder 491835, CVE-2009-0846 - add fix for bug in length validation in the ASN.1 decoder CVE-2009-0847...

evolution-data-server: insufficient checking of NTLM authentication challenge packets

The ntlmchallenge function in the NTLM SASL authentication mechanism in camel/camel-sasl-ntlm.c in Camel in Evolution Data Server aka evolution-data-server 2.24.5 and earlier, and 2.25.92 and earlier 2.25.x versions, does not validate whether a certain length value is consistent with the amount o...

NetBSD PPPoE发现脚本远程拒绝服务漏洞

BUGTRAQ ID:30838 CNCAN ID：CNCAN-2008082706 NetBSD是一款基于BSD的操作系统。 NetBSD包含的pppoe4代码处理恶意报文存在问题，远程攻击者可以利用漏洞触发内核访问越界内容而导致内核崩溃，造成拒绝服务攻击。 在客户端和访问集中器之间的会话连接之前，处理PPPoE连接的早期状态的关键代码存在问题。在"discovery"阶段的报文由多个可变长度"tags"装载同一个PPPoE报文中，每个标签将被检查，而且针对全部报文大小的长度进行了验证。不过在长度检查过程中存在一个缺陷，允许把下一个TAG的指针越界移动到报文后最多4字节的位置。...

CVE-2007-3956

TeamSpeak WebServer 2.0 for Windows is affected by a denial-of-service vulnerability where input parameter length is not validated and TCP sessions are not expired. An attacker can trigger high CPU/memory usage by sending overly long username/password values to login.tscmd on TCP port 14534. The ...

XSS vulnerability: space name and key not validated nor escaped

Email sent from Igor: quote The problem: The input for space name and key is not being validated properly. I created a JIRA for lacking length validation CONF-8894 and later on I noticed that any characters in the input for space name are allowed. Combine that with another batch of bugs - space...

CVE-2007-1995

bgpd/bgpattr.c in Quagga 0.98.6 and earlier, and 0.99.6 and earlier 0.99 versions, does not validate length values in the MPREACHNLRI and MPUNREACHNLRI attributes, which allows remote attackers to cause a denial of service daemon crash or exit via crafted UPDATE messages that trigger an assertion...