alicetelecom-backdoor.txt

saxdax & drpepperONE Discovered embedded backdoor to activate telnet/ftp/tftp/web extended admin interface with Admin privileges, from internal network lan on Alice ADSL CPE Modem/Router, manufactered by Pirelli based on Broadcom platform. saxdax & drpepperONE Router Vendor: Alice Telecom Italia...

Telecom Italia Alice Pirelli routers - Backdoor from internal LANWAN

Telecom Italia Alice Pirelli routers - Backdoor from internal LANWAN saxdax & drpepperONE Discovered embedded backdoor to activate telnet/ftp/tftp/web extended admin interface with Admin privileges, from internal network lan on Alice ADSL CPE Modem/Router, manufactered by Pirelli based on Broadco...

Gentoo Security Advisory GLSA 200507-20 (shorewall)

The remote host is missing updates announced in advisory GLSA 200507-20. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

nbstat NSE Script

Attempts to retrieve the target's NetBIOS names and MAC address. By default, the script displays the name of the computer and the logged-in user; if the verbosity is turned up, it displays all names the system thinks it owns. Example Usage sudo nmap -sU --script nbstat.nse -p137 Script Output Hos...

Thomson SpeedTouch和BT Home Hub路由器默认WEP/WPA密钥算法漏洞

BUGTRAQ ID: 28893 BT Home Hub和Speedtouch都是家用的无线Internet路由器。 BT Home Hub和Speedtouch路由器所使用的默认WEP/WPA密钥算法是可预测的，远程攻击者可以基于一些公开信息（如MAC地址或SSID）预测出密钥，这样就可以完全入侵路由器。 对于Speedtouch路由器路由器： S/N：CP0615JT109 53 删除CC和PP值：CP0615109 将XXX值转换为16进制：CP0615313039 通过SHA-1处理：742da831d2b657fa53d347301ec610e1ebf8a3d0...

intelcentrino-overflow.txt

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/projects/Framework/ require 'msf/core' module Msf class...

Alcatel OmniPCX Enterprise VoIP Vulnerability

COMPASS SECURITY ADVISORY http://www.csnc.ch/ Product: OmniPCX Enterprise Vendor: Alcatel Subject: VoIP Phone Audio Stream Rerouting Vulnerability Risk High Effect Currently exploitable Author: Daniel Stirnimann daniel.stirnimann at csnc dot ch Date: November, 19th 2007 Introduction: ------------...

Clever use Tcpreplay to let the attack traffic sneak-vulnerability warning-the black bar safety net

TcpreplayisNetwork Securityin a commonly used tool, for its message playback feature we are very clear, but for it to replay rewrite the packets of the contents of the function application but not very much, if can skilled application of Tcpreplay packet rewriting function it is possible to make...

CVE-2002-2371

Linksys WET11 firmware 1.31 and 1.32 allows remote attackers to cause a denial of service crash via a packet containing the device's hardware address as the source MAC address in the DLC header...

CVE-2002-2316

Cisco Catalyst 4000 series switches running CatOS 5.5.5, 6.3.5, and 7.1.2 do not always learn MAC addresses from a single initial packet, which causes unicast traffic to be broadcast across the switch and allows remote attackers to obtain sensitive network information by sniffing...

CVE-2002-2316

Cisco Catalyst 4000 series switches running CatOS 5.5.5, 6.3.5, and 7.1.2 may fail to learn MAC addresses from a single initial packet, causing unicast traffic to be broadcast and allowing remote attackers to sniff sensitive network information. The connected Red Hat and CVE registries confirm th...

Then talk about the Exchange environment session hijacking(For windows2000)-vulnerability warning-the black bar safety net

The first step is to open the IP Routing function, modify the registry HKEYLOCALMACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\IPEnableRouter to 0x1, and restart the system. The second step is ARP spoofing, the specific principle I will not say. The third step is to start the hijackin...

Cisco PIX/ASA DHCP Relay Agent Memory Leak Vulnerability

Cisco PIX and Adaptive Security Appliance ASA software versions 7.21 through 7.22.14 contain a vulnerability that could allow an unauthenticated, remote attacker to cause an affected device to stop forwarding traffic. This vulnerability exists due to an error when handling specific DHCP packets...

PPPOE authentication the defect caused the harm-vulnerability warning-the black bar safety net

Author: black lantern Black Mask） Source: Black Mask'blog The article has a table in the hacker X-Files 2 0 0 7 in the first period,reproduced please specify! With the network technology rapid development, the different access methods and thus also into our lives at the time, from the most common...

CVE-2007-1528

The LLTD Mapper in Microsoft Windows Vista allows remote attackers to spoof hosts, and nonexistent bridge relationships, into the network topology map by using a MAC address that differs from the MAC address provided in the Real Source field of the LLTD BASE header of a HELLO packet, aka the "Spo...

Code injection

The LLTD Mapper in Microsoft Windows Vista allows remote attackers to spoof hosts, and nonexistent bridge relationships, into the network topology map by using a MAC address that differs from the MAC address provided in the Real Source field of the LLTD BASE header of a HELLO packet, aka the "Spo...

CVE-2007-1528

The LLTD Mapper in Microsoft Windows Vista allows remote attackers to spoof hosts, and nonexistent bridge relationships, into the network topology map by using a MAC address that differs from the MAC address provided in the Real Source field of the LLTD BASE header of a HELLO packet, aka the "Spo...

CVE-2007-1528

The CVE-2007-1528 entry concerns the LLTD Mapper in Microsoft Windows Vista, where remote attackers can spoof hosts and nonexistent bridge relationships in the network topology map. This occurs by sending a HELLO packet whose LLTD BASE header Real Source MAC address differs from the MAC address p...

OpenBSD ICMPv6 Fragment Remote Execution Exploit PoC

No description provided by source. The PoC executes the shellcode int 3 and returns. It overwrites the extfree function pointer on the mbuf and forces a mfreem on the overflowed packet. The Impacket library is used to craft and send packets http://oss.coresecurity.com/projects/impacket.html or...

NETGEAR WG311v1 Wireless Driver 2.3.1.10 - SSID Heap Buffer Overflow

NETGEAR WG311v1 Wireless Driver 2.3.1.10 - SSID Heap Buffer Overflow source: https://www.securityfocus.com/bid/21251/info NetGear WG311v1 Wireless devices are prone to a heap-based buffer-overflow vulnerability because the driver fails to properly bounds-check user-supplied data before copying it...