2612 matches found
[NEWS] Multiple Vulnerabilities In NAS
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...
Code injection
The AddResource function in server/dia/resource.c in Network Audio System NAS before 1.8a SVN 237 allows remote attackers to cause a denial of service server crash via a nonexistent client ID...
Command injection
Array index error in Network Audio System NAS before 1.8a SVN 237 allows remote attackers to cause a denial of service crash via 1 large numaction values in the ProcAuSetElements function in server/dia/audispatch.c or 2 a large inputNum parameter to the compileInputs function in server/dia/auutil...
CVE-2007-1546
Array index error in Network Audio System NAS before 1.8a SVN 237 allows remote attackers to cause a denial of service crash via 1 large numaction values in the ProcAuSetElements function in server/dia/audispatch.c or 2 a large inputNum parameter to the compileInputs function in server/dia/auutil...
CVE-2007-1544
CVE-2007-1544 affects the Network Audio System (nas) server. A stack/integer overflow in ProcAuWriteElement (server/dia/audispatch.c) in NAS versions before 1.8a SVN 237 enables a remote attacker to crash the service and potentially execute arbitrary code via a large max_samples value. This is on...
CVE-2007-1547
Vulnerability (CVE-2007-1547) affects the Network Audio System (NAS). The issue is in the ReadRequestFromClient function (server/os/io.c) where handling multiple simultaneous connections can trigger a NULL pointer dereference, allowing a remote attacker to cause a crash (DoS). Affected software i...
CVE-2007-1543
The CVE-2007-1543 issue affects Network Audio System (NAS) prior to 1.8a SVN 237. A stack-based buffer overflow in accept_att_local (server/os/connection.c) can be triggered by a long path slave name over a USL socket, enabling remote code execution. Other CVEs (CVE-2007-1544 to CVE-2007-1547) ac...
CVE-2007-1543
Stack-based buffer overflow in the acceptattlocal function in server/os/connection.c in Network Audio System NAS before 1.8a SVN 237 allows remote attackers to execute arbitrary code via a long path slave name in a USL socket connection...
CVE-2007-1545
CVE-2007-1545 is a vulnerability in Network Audio System (NAS) prior to NAS 1.8a SVN 237 where the AddResource function can crash the server via a nonexistent client ID, enabling a remote denial of service. The connected Debian advisory (DSA-1273-1) enumerates five NAS flaws (CVE-2007-1543 to CVE...
CVE-2007-1546
CVE-2007-1546 affects the Network Audio System (NAS) prior to 1.8a SVN 237. The vulnerability is an array index error in NAS code paths: ProcAuSetElements (server/dia/audispatch.c) and compileInputs (server/dia/auutil.c). A remote attacker can trigger a denial of service (crash) by sending large ...
CVE-2007-1546: Undefined Security Weakness
Array index error in Network Audio System NAS before 1.8a SVN 237 allows remote attackers to cause a denial of service crash via 1 large numaction values in the ProcAuSetElements function in server/dia/audispatch.c or 2 a large inputNum parameter to the compileInputs function in server/dia/auutil...
CVE-2007-1545: Undefined Security Weakness
The AddResource function in server/dia/resource.c in Network Audio System NAS before 1.8a SVN 237 allows remote attackers to cause a denial of service server crash via a nonexistent client ID...
CVE-2007-1543: Undefined Security Weakness
Stack-based buffer overflow in the acceptattlocal function in server/os/connection.c in Network Audio System NAS before 1.8a SVN 237 allows remote attackers to execute arbitrary code via a long path slave name in a USL socket connection...
CVE-2006-3878
CVE-2006-3878 concerns Opsware Network Automation System (NAS) 6.0. The issue arises because NAS installs /etc/init.d/mysql with insecure permissions, enabling local users to read the root password for the MySQL MAX database or gain privileges by modifying /etc/init.d/mysql. The root cause is imp...
CVE-2006-3878: Undefined Security Weakness
Opsware Network Automation System NAS 6.0 installs /etc/init.d/mysql with insecure permissions, which allows local users to read the root password for the MySQL MAX database or gain privileges by modifying /etc/init.d/mysql...
Opsware NAS 6.0 reveals MySQL 'root' password
The Opsware Network Automation System NAS version 6.0 installation places an 'init' style startup script in /etc/init.d/mysqll and places the 'root' password that you choose for the MySQL MAX database during installation. The permissions on this small shell script are world readable, allowing any...
CVE-2002-1863
Iomega Network Attached Storage (NAS) A300U (and possibly other models) has a vulnerability where the FTP service cannot be disabled, enabling local users to access home directories via FTP even when access to all shared directories is disabled. Affected component: FTP enablement/disable control ...
CVE-2002-1949
CVE-2002-1949 affects Iomega NAS A300U Admin Web Page, where credentials are transmitted in cleartext over the network, enabling remote password sniffing. Connected docs corroborate the issue and provide limited remediation guidance: IBM bulletin notes remediations for Jazz Foundation products (u...