iDefense Security Advisory 12.12.06: Sun Microsystems Solaris ld.so 'doprf()' Buffer Overflow Vulnerability

Sun Microsystems Solaris ld.so 'doprf' Buffer Overflow Vulnerability iDefense Security Advisory 12.12.06 http://labs.idefense.com/intelligence/vulnerabilities/ Dec 12, 2006 I. BACKGROUND Solaris is a UNIX operating system developed by Sun Microsystems. More information can be found at...

CVE-2006-6265

CVE-2006-6265 describes a Teredo-related risk where clients behind a restricted NAT can be reached for inbound connections by either using the client port embedded in the Teredo address or via the bubble-to-open procedure. The vulnerability stems from Teredo’s handling of port discovery in constr...

Gene6 FTP Server本地权限提升漏洞

Gene6 FTP Server是一款非常流行的Microsoft Windows平台的FTP Server。 默认安装后，本地的非特权用户可以修改Gene6 FTP Server的设置，例如添加新的SITE命令。由于Gene6 FTP Server是以SYSTEM权限运行的，因此攻击者可以轻易的提升权限。 Gene6 G6 FTP Server http://marc.theaimsgroup.com 1. 以非特权用户的身份登陆。 2. 打开Gene6 FTP Server控制台，添加FTP用户帐号，如“test” 3. 对FTP...

Multiple Linksys/ ZyXel / Edimax / Sitecom routers UPnP problems

UPnP AddPortMapping request requires no authentication. It makes it possible to create mapping between any external port and internal IP/port. Additionally, insufficient paramters validation allows code execution on router itself...

security flaw

OpenSSH 3.6.1 and earlier, when restricting host access by numeric IP addresses and with VerifyReverseMapping disabled, allows remote attackers to bypass "from=" and "user@host" address restrictions by connecting to a host from a system whose reverse DNS hostname contains the numeric IP address...

WhatsUp Gold _maincfgret.cgi instancename buffer overflow

Added: 09/08/2006 CVE: CVE-2004-0798 BID: 11043 OSVDB: 9177 Background WhatsUp Professional formerly WhatsUp Gold is a network mapping and monitoring tool. Problem A buffer overflow in the WhatsUp Gold web interface allows remote command execution by requesting maincfgret.cgi with a long...

PT-2006-3507 · Edimax · Edimax Br-6104K

Name of the Vulnerable Software and Affected Versions: Edimax BR-6104K router affected versions not specified Description: The issue allows remote attackers to bypass access restrictions and conduct unauthorized operations. This is achieved via a UPnP request with a modified InternalClient...

PT-2006-3506 · Sitecom · Sitecom Wl-153

Name of the Vulnerable Software and Affected Versions: Sitecom WL-153 router firmware versions prior to 1.38 Description: The issue allows remote attackers to bypass access restrictions and conduct unauthorized operations. This is achieved via a UPnP request with a modified InternalClient...

PT-2006-3508 · Zyxel · Zyxel P-335Wt

Name of the Vulnerable Software and Affected Versions: ZyXEL P-335WT router affected versions not specified Description: The issue allows remote attackers to bypass access restrictions and conduct unauthorized operations. This is achieved via a UPnP request with a modified InternalClient paramete...

PT-2006-3505 · Linksys · Linksys Wrt54Gl Wireless-G Broadband Router

Name of the Vulnerable Software and Affected Versions: Linksys WRT54G Wireless-G Broadband Router affected versions not specified Description: The issue allows remote attackers to bypass access restrictions and conduct unauthorized operations. This is achieved via a UPnP request with a modified...

SEC-20060512-0.txt

SEC Consult Security Advisory 20060512-0 ============================================================== title: Symantec Enterprise Firewall NAT/HTTP Proxy Private IP Exposure program: Symantec Enterprise FW vulnerable version: 8.0 homepage: www.symantec.com found: 2005-09-13 by: SEC Consult /...

Cheops NG without password

The remote service does not require a password for access. Description : The Cheops NG agent on the remote host is running without authentication. Anyone can connect to this service and use it to map your network, port scan machines and identify running services. OpenVAS Vulnerability Test $Id:...

Cheops NG clear text authentication

A Cheops NG agent is running on the remote host. Description : Cheops NG is running on this port. Users with a valid account on this machine can connect to this service and use it to map your network, port scan machines and identify running services. Passwords are transmitted in clear text and...

Symantec Ghost: Local access vulnerabilities in Database

SUMMARY Symantec engineers updated the db component to address three local access vulnerabilities discovered in the database installed with Symantec Ghost and the Central Management Console in Symantec Ghost Solutions Suite SGSS 1.0. Exploitation of any of these issues requires physical access to...

[Full-disclosure] Cisco PIX embryonic state machine 1b data DoS

Arhont Ltd - Information Security Arhont Advisory by: Konstantin V. Gavrilenko http://www.arhont.com http://www.hackingciscoexposed.com Arhont ref: arh200601-1 Advisory: Cisco PIX embryonic state machine 1b data DoS Class: design bug? Version: Tested on PIX535, PIX OS ver 6.34 Tested on PIX515E,...

RHEL 4 : kernel (RHSA-2006:0101)

Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 4 kernel are now available. This security advisory has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating syste...

Seen this kind of asp Trojan horse?--- Hidden virtual directory-vulnerability warning-the black bar safety net

Don't know if you see some on in Microsoft's IIS in the establishment of the"hidden virtual directory"article or video, in order to take care of beginners, I'll briefly explain: the Generally is in the site's"root directory"under the newly established a"folder"such as"icyfox", and then in the bui...

Some of the port mapping data collection-vulnerability warning-the black bar safety net

SONICWALL Firewall with port forwarding SonicWall Firewall with port forwarding process is as follows: To set upa Web serveras an example, assume that theWeb serverwithin the network IP is 1 9 2. 1 6 8. 0. 5 0 First log in to the firewall, select“Access", and then look at the default first...

Cheops NG Unauthenticated Access

The Cheops NG agent on the remote host is running without authentication. Anyone can connect to this service and use it to map your network, port scan machines and identify running services. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid20161; scriptversion "$Revisio...

Zope < 2.3.3 ZClass Permission Mapping Vulnerability

Zope is prone to a permission mapping vulnerability. SPDX-FileCopyrightText: 2001 Alert4Web.com Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:zope:zope"; ifdescription...