CVE-2007-2446

CVE-2007-2446 is a remote code execution vulnerability in Samba, caused by heap-based buffer overflows in the NDR parsing of the SMB/CIFS NetDFS/LSA RPC interfaces. Affected are Samba 3.0.0 through 3.0.25rc3. The flaw is triggered by crafted MS-RPC requests and affects multiple RPC operations, in...

CVE-2007-2446

Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving 1 DFSEnum netdfsiodfsEnumInfod, 2 RFNPCNEX smbionotifyoptiontypedata, 3 LsarAddPrivilegesToAccount...

samba code injection

The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the 1 SamrChangePassword function, when the "username map script" smb.conf option is enabled, and allows remote authenticated users to execute...

Remote Command Injection Vulnerability

Description This bug was originally reported against the anonymous calls to the SamrChangePassword MS-RPC function in combination with the "username map script" smb.conf option which is not enabled by default. After further investigation by Samba developers, it was determined that the problem was...

samba -- multiple vulnerabilities

The Samba Team reports: A bug in the local SID/Name translation routines may potentially result in a user being able to issue SMB/CIFS protocol operations as root. When translating SIDs to/from names using Samba local list of user and group accounts, a logic error in the smbd daemon's internal...

Samba NDR MS-RPC heap buffer overflow

Overview Samba fails to properly handle malformed MS-RPC packets. Exploitation of this vulnerability could allow a remote attacker to execute arbitrary code. Description Samba is a widely used open-source implementation of Server Message Block SMB/Common Internet File System CIFS. Network Data...

Samba < 3.0.25 NDR MS-RPC Request Heap-Based Overflow

Binary data 3988.prm...

sharepoint-xss.txt

Hi! I think this is a XSS in MS SharePoint, you can reproduce it in SharePoint test server using for example following url: http://www.example.com/sharepoint/default.aspx/%22;iftruealert%22qwertytis This is due a lack of string stripping when putting the path into javascript. It seems to work at...

MS Windows .HLP File Local HEAP Overflow PoC 0day

Exploit for unknown platform in category dos / poc ================================================= MS Windows .HLP File Local HEAP Overflow PoC 0day ================================================= MS Windows .HLP File Local HEAP Overflow PoC 0day http://www.inj3ct0r.com/sploits/6354.hlp.tgz...

MS Windows Explorer Unspecified .ANI File Denial of Service Exploit

No description provided by source. / MS Windows Explorer Unspecified .ANI File DoS Another .Ani bug that freezes Explorer if you open a folder that contains a crafted file. Tested against Win XP SP2 FR. Have Fun! Coded by Marsu [email protected] / include "stdio.h" include "stdlib.h"...

Microsoft Windows - Animated Cursor .ani Universal Generator

Microsoft Windows - Animated Cursor .ani Universal Generator -------------------------------------------------------------------------------- Info: .ANI RIFF Cursors 2007 universal exploit generator Tested on MS Internet Explorer 6.x-7.x, Windows XP SP2, Windows Vista Author: Yag Kohha 10xnGr33tz...

MS Internet Explorer (FTP Server Response) DoS Exp-vulnerability warning-the black bar safety net

!/ usr/bin/perl MS 07-016 FTP Server Response PoC Usage: ./ ms07016ftp.pl LISTENIP Tested Against: MSIE 6.02900.2180 SP2 Details: The response is broken into buffers, either at length 1 0 2 4, or at '\r\n'. Each buffer is apended with \x00, without bounds checking. If the response is exctly 1 0 2...

MS Internet Explorer (FTP Server Response) DoS Exploit (MS07-002)

No description provided by source. !/usr/bin/perl MS 07-016 FTP Server Response PoC Usage: ./ms07016ftp.pl LISTENIP Tested Against: MSIE 6.02900.2180 SP2 Details: The response is broken into buffers, either at length 1024, or at ' '. Each buffer is apended with x00, without...

Microsoft Windows - DCE-RPC svcctl ChangeServiceConfig2A() Memory Corruption

Microsoft Windows - DCE-RPC svcctl ChangeServiceConfig2A Memory Corruption !/usr/bin/python MS Windows DCE-RPC svcctl ChangeServiceConfig2A 0day Memory Corruption PoC Exploit Bug discovered by Krystian Kloskowski h07 Tested on Windows 2000 SP4 Polish all patches Requires.. - Impacket :...

knorrede-sql.txt

Author: Sebastian Bauer Web: http://blog.gjl-network.net Date: 01/12/07 Vuln. website: http://www.knorr.de Vulnerability: SQL Injection mainly login authentication bypass + any other SQL inj. possibility, XSS Significance: Very Critical ---------------------------------------------------------...

MS-RPC - General Settings

...

Microsoft Help Workshop 4.03.0002 - '.HPJ' Local Buffer Overflow

// // // PoC exploit for .HPJ project files buffer overflow vulnerability in // Microsoft Help Workshop v4.03.0002 // The tool is standard component of MS Visual Studio v6.0 and 2003 .NET // // vulnerability found / exploit built by porkythepig // // include "stdio.h" include "stdlib.h" include...

Microsoft Help Workshop 4.03.0002 (.CNT) Buffer Overflow Exploit

Exploit for unknown platform in category local exploits ================================================================ Microsoft Help Workshop 4.03.0002 .CNT Buffer Overflow Exploit ================================================================ // // // PoC exploit for .cnt files buffer...

Microsoft Help Workshop 4.03.0002 - '.cnt' Local Buffer Overflow

// // // PoC exploit for .cnt files buffer overflow vulnerability in // Microsoft Help Workshop v4.03.0002 // The tool is standard component of MS Visual Studio v6.0, 2003 .NET // // vulnerability found / exploit built by porkythepig // // include "stdio.h" include "stdlib.h" include "string.h"...

Port interception with port hidden sniffing attacks-vulnerability warning-the black bar safety net

In WINDOWS SOCKET Server Application Programming, the following statement perhaps than than are: s=socketAFINET,SOCKSTREAM,IPPROTOTCP; saddr. sinfamily = AFINET; saddr. sinaddr. serveraddress = htonlINADDRANY; binds,SOCKADDR &saddr,sizeofsaddr; In fact, this which exists in a very big security...