AIX 5.1 < 5.3 - paginit Local Stack Overflow

/ exploit for /usr/bin/paginit tested on: AIX 5.2 if the exploit fails it's because the shellcode ends up at a different address. use dbx to check, and change RETADDR accordingly. cees-bart / define RETADDR 0x2ff22c90 char shellcode = "\x7c\xa5\x2a\x79" "\x40\x82\xff\xfd" "\x7c\xa8\x02\xa6"...

CVE-2004-1195

Star Wars Battlefront 1.11 and earlier allows remote attackers to cause a denial of service application crash via a join request that contains a memory address that causes the server to read arbitrary memory...

CVE-2004-1195

CVE-2004-1195 affects Star Wars Battlefront versions 1.11 and earlier. The server could be forced to read an arbitrary memory address via a crafted join request, allowing remote attackers to cause an application crash (DoS). The connected documents provide this description; no patch/version detai...

Michael Kohn Ringtone Tools 2.22 - .EMelody File Remote Buffer Overflow

Michael Kohn Ringtone Tools 2.22 - .EMelody File Remote Buffer Overflow source: https://www.securityfocus.com/bid/12010/info Ringtone Tools is reported prone to a remote buffer overflow vulnerability. This issue arises because the application fails to carry out proper boundary checks before copyi...

CVE-2004-1195: Undefined Security Weakness

Star Wars Battlefront 1.11 and earlier allows remote attackers to cause a denial of service application crash via a join request that contains a memory address that causes the server to read arbitrary memory...

wodFtpDLX Client - ActiveX Control Buffer Overflow Crash

/ WodFtpDLX Client ActiveX Control Buffer Overflow Crash Exploit created by Komrade e-mail: unsecureataltervistadotorg web: http://unsecure.altervista.org Tested on WodFtpDLX.ocx versions 2.3.2.90 - 2.3.0.0 - 2.2.0.1 on a Windows XP Professional sp2 operating system. This exploit creates a fake F...

CVE-2004-1007

CVE-2004-1007 concerns bogofilter’s quoted-printable decoder, affecting versions 0.17.4 through 0.92.7. The vulnerability allows remote attackers to cause a denial of service (application crash) by crafting mail headers in which a line feed (LF) is replaced by a null byte that is written to an in...

Painkiller 1.3.1 - Denial of Service

Painkiller 1.3.1 - Denial of Service / by Luigi Auriemma / include include include ifdef WIN32 include include "winerr.h" define close closesocket else include include include include include endif define VER "0.1" define BUFFSZ 2048 define PORT 3455 define TIMEOUT 3 define GAMEVER "1.3" define...

CVE-2004-0728

The Remote Control Client service in Microsoft's Systems Management Server SMS 2.50.2726.0 allows remote attackers to cause a denial of service crash via a data packet to TCP port 2702 that causes the server to read or write to an invalid memory address...

CVE-2004-0728: Undefined Security Weakness

The Remote Control Client service in Microsoft's Systems Management Server SMS 2.50.2726.0 allows remote attackers to cause a denial of service crash via a data packet to TCP port 2702 that causes the server to read or write to an invalid memory address...

CVE-2004-0618: Undefined Security Weakness

FreeBSD 5.1 for the Alpha processor allows local users to cause a denial of service crash via an execve system call with an unaligned memory address as an argument...

ALLO ALLO WS_FTP Server

Advisory Name: ALLO ALLO WSFTP Server Impact : Arbitrary code execution as SYSTEM Discovered by: Hugh Mann [email protected] Tested progs : Ipswitch WSFTP Server 4.0.2.EVAL Description A user who can upload files, and also has a max number of files limit or max total file size limit, can read...

shatterSEH3.txt

============================================================================ = Shattering SEH III = = [email protected] = http://www.security-assessment.com = = Originally posted: September 29, 2003 ============================================================================ ==...

HP-UX ftpd REST bug

Because of a bug in REST processing value given is treated as a memory address. It makes it possible to read any memory block...

Solaris 2.5/2.5.1 - 'getgrnam()' Local Overflow

include include / getgrnam function overflow. works against Solaris 2.5/2.5.1 SPARC default offset should work. Pablo Sor, Buenos Aires, Argentina. [email protected] / uchar shell = "\x82\x10\x20\xca\xa6\x1c\xc0\x13\x90\x0c\xc0\x13\x92\x0c\xc0\x13"...

Microsoft Windows 9x - File Handle Buffer Overflow

Microsoft Windows 9x - File Handle Buffer Overflow // source: https://www.securityfocus.com/bid/1796/info The file sharing SMB service in Windows enables client applications to access and modify files from a server on the network. The SMB service within Windows 95/98 allocates 0x4004 bytes to sto...

Ipswitch IMail 5.0.86.06.1 - IMonitor status.cgi Denial of Service

Ipswitch IMail 5.0.86.06.1 - IMonitor status.cgi Denial of Service source: https://www.securityfocus.com/bid/914/info IMail includes a service called IMail Monitor which is used for local and remote performance measuring and diagnostics. It includes a small webserver operating on port 8181 to...

LibXt - 'XtAppInitialize()' Local Overflow *xterm

/ cxterm buffer overflow exploit for Linux. This code is tested on both Slackware 3.1 and 3.2. Ming Zhang [email protected] / include include include include define CXTERMPATH "/usr/X11R6/bin/cxterm" define BUFFERSIZE 1024 define DEFAULTOFFSET 50 define NOPSIZE 1 char nop = "\x90"; char shellcod...