Linux Kernel 2.2.25/2.4.24/2.6.2 - 'mremap()' Validator

/ Proof-of-concept exploit code for domremap 2 EDB Note: This is NOT to be confused with CVE-2003-0985 // https://www.exploit-db.com/exploits/141/, which would be "domremap 1". EDB Note: This will just "test" the vulnerability. A exploit version can be found here...

Linux kernel do_mremap() local privilege escalation vulnerability

Background The Linux kernel is responsible for memory management in a working system - to allow this, processes are allowed to allocate and unallocate memory. Description The memory subsystem allows for shrinking, growing, and moving of chunks of memory along any of the allocated memory areas whi...

[Full-Disclosure] Linux kernel mremap vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Synopsis: Linux kernel domremap local privilege escalation vulnerability Product: Linux kernel Version: 2.2, 2.4 and 2.6 series Vendor: http://www.kernel.org/ URL: http://isec.pl/vulnerabilities/isec-0012-mremap.txt CVE:...

[Full-Disclosure] [iSEC] Linux kernel do_brk() lacks argument bound checking

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Synopsis: Linux kernel dobrk lacks argument bound checking Product: Linux Version: up to 2.4.23, others Vendor: http://www.kernel.org/ URL: http://isec.pl/vulnerabilities/isec-0012-dobrk.txt CVE:...

Microsoft Windows - DCOM RPC2 Universal Shellcode

MS Windows DCOM RPC2 Universal Shellcode. Shellcode exploit for win32 platform ; Segment type: Pure code ;seg000 segment byte public 'CODE' use32 ; assume cs:seg000 ; assume es:nothing, ss:nothing, ds:nothing, fs:nothing, gs:nothing .386 assume cs:seg000 var29C = byte ptr -29Ch var28C = byte ptr...

Sendmail fails to appropriately initialize data structures for DNS maps

Overview There is an uninitialized data structure in sendmail 8.12.x rrdomain = smstrduphost; \t\tif rr-rrdomain == NULL \t\t A fix for this condition was made in sendmail 8.12.9 in March 2003, but it was not known to be a security issue at that time. --- Impact A remote attacker may be able to...

OpenBSD 3.3 - Semget() Integer Overflow (2)

OpenBSD 3.3 - Semget Integer Overflow 2 // source: https://www.securityfocus.com/bid/8464/info A vulnerability has been discovered in the OpenBSD semget system call. The problem occurs due to insufficient sanity checks before allocating memory using the user-supplied nsems value as an argument. A...

Microsoft Security Bulletin MS03-029: Flaw in Windows Function Could Allow Denial of Service (Q823803)

-----BEGIN PGP SIGNED MESSAGE----- - ---------------------------------------------------------------------- Title: Flaw in Windows Function Could Allow Denial of Service 823803 Date: 23 July 2003 Software: Microsoft Windows NT 4.0 Server Impact: Denial of service Max Risk: Moderate Bulletin:...

EType EServ 2.98/2.99/3.0 - Resource Exhaustion (Denial of Service) (1)

source: https://www.securityfocus.com/bid/7552/info A denial of service vulnerability has been reported for EServ. The vulnerability exists due to the way the server handles connections. Specifically, memory allocated for open connections are not properly freed when a connection no longer exists...

Mod_NTLM 0.x - Authorisation Heap Overflow

source: https://www.securityfocus.com/bid/7388/info The modntlm Apache module has been reported prone to a heap overflow vulnerability. The vulnerability occurs due to a lack of sufficient bounds checking performed on user-supplied data, stored in heap memory. By supplying excessive data an...

Multiple cgihtml vulnerabilities

Overview -------- cgihtml is a collection of routines for parsing World Wide Web WWW Common Gateway Interface CGI input and outputting HyperText Markup Language HTML. http://www.eekim.com/software/cgihtml/ According to the authors website, it has potentially been used in the implementation of...

DEBIAN-CVE-2002-0847

tinyproxy HTTP proxy 1.5.0, 1.4.3, and earlier allows remote attackers to execute arbitrary code via memory that is freed twice double-free...

EEYE: Sun(TM) ONE / iPlanet Web Server 4.1 and 6.0 Remote Buffer Overflow

SunTM ONE / iPlanet Web Server 4.1 and 6.0 Remote Buffer Overflow Release Date: August 8, 2002 Severity: High Remote SYSTEM/ROOT Systems Affected: iPlanet 6.0 and prior Description: A vulnerability in transfer chunking can be exploited to remotely execute code of an attacker's choice on a...

DSA-145 tinyproxy - doubly freed memory

Bulletin has no description...

PHP fails to properly parse the headers of HTTP POST requests

Overview A vulnerability has been discovered in PHP. This vulnerability could be used by a remote attacker to execute arbitrary code or crash PHP and/or the web server. Description PHP is a popular scripting language in widespread use. For more information about PHP, see...

CVE-2002-0059

The decompression algorithm in zlib 1.1.3 and earlier, as used in many different utilities and packages, causes inflateEnd to release certain memory more than once a "double free", which may allow local and remote attackers to execute arbitrary code via a block of malformed compression data...

FreeBSD-SA-02:22.mmap

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-02:22.mmap Security Advisory FreeBSD, Inc. Topic: mmap/msync denial of service Category: core Module: net Announced: 2002-04-18 Credits: Harry Newton Matt Dillon Affects: Al...

CVE-2002-0059

The decompression algorithm in zlib 1.1.3 and earlier, as used in many different utilities and packages, causes inflateEnd to release certain memory more than once a "double free", which may allow local and remote attackers to execute arbitrary code via a block of malformed compression data...

Multiple FTPD glob Command Arbitrary Command Execution

The FTPD glob vulnerability manifests itself in handling the glob command. The problem is not a typical buffer overflow or format string vulnerability, but a combination of two bugs - an implementation of the glob command that does not properly return an error condition when interpreting the stri...

leak of information in counterpane/Bruce Schneier's Password Safe program

Background : Password Safe http://www.counterpane.com/passsafe.html is a free win9x/2000 utility used to keep all your passwords encrypted on hdd using Bruce Schneier's symmetric algorithm blowfish. Version tested : 1.71 Vulnerability : Password Safe has an option I think is default to "lock...