Sun RPC XDR xdrmem_getbytes Function Remote Overflow

The RPC library has an integer overflow in the function xdrmemgetbytes. An attacker may use this flaw to execute arbitrary code on this host with the privileges your RPC programs are running with typically root, by sending a specially crafted request to them. Note that this issue affects Solaris,...

SquirrelMail 1.2.9 / 1.2.10 read_body.php Multiple Parameter XSS

The remote host seems to be vulnerable to a security problem in SquirrelMail. The 'readbody.php' script doesn't filter out user input for multiple parameters, allowing for XSS attacks. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. This script was rewritten by Tenable Network Security, Inc....

Thunderstone Software Texis Crafted Request Information Disclosure

The remote installation of Texis can be abused to disclose potentially sensitive information about the remote host, such as its internal IP address and the path to various components eg, cmd.exe. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

Samba < 2.2.8 Multiple Vulnerabilities

The remote Samba server, according to its version number, is vulnerable to a remote buffer overflow when receiving specially crafted SMB fragment packets. An attacker needs to be able to access at least one share to exploit this flaw. In addition, it is reported that Samba contains a flaw related...

Cisco IOS SSH Large Packet CPU Consumption DoS (CSCdw33027)

It is possible to make the remote IOS crash when sending it malformed SSH packets. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid11381; scriptversion"1.26"; scriptcveid"CVE-2002-1024"; scriptbugtraqid5114; scriptnameenglish:"Cisco IOS SSH Large Packet CPU Consumption...

Microsoft IIS fpcount.exe CGI Remote Overflow

Nessus detected the 'fpcount.exe' CGI on the remote web server. Some versions of this CGI have a remote buffer overflow vulnerability. A remote attacker could exploit it to crash the web server, or possibly execute arbitrary code. Nessus did not actually check for this flaw, but solely relied on...

SunFTP GET Request Remote Overflow

Buffer overflow in SunFTP build 91 allows remote attackers to cause a denial of service or possibly execute arbitrary commands by sending more than 2100 characters to the server. This script was written by Xue Yong Zhi See the Nessus Scripts License for details Changes by Tenable: - Revised plugi...

NFS portmapper localhost Mount Request Restricted Host Access

The remote RPC portmapper forwards NFS requests made to it. An attacker may use this flaw to make NFS mount requests which will appear to come from localhost and therefore override the ACLs set up for NFS. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

Multiple Vendor NFS CD Command Arbitrary File/Directory Access

The remote NFS server allows users to use a 'cd ..' command to access other directories besides the NFS file system. An attacker may use this flaw to read every file on this host. C Tenable Network Security, Inc. This is the implementation of an oooold attack. include 'compat.inc' ; if descriptio...

Auction Deluxe auction.pl Multiple Parameter XSS

The remote Auction Deluxe server is vulnerable to a cross-site scripting attack. As a result, a user could easily steal the cookies of your legitimate users and impersonate them. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc';...

Low: Red Hat Security Advisory: tcpdump security update

Updated tcpdump packages are available to fix a denial of service vulnerability in tcpdump. Updated 12 March 2003 Added packages for Red Hat Enterprise Linux ES and Red Hat Enterprise Linux WS Tcpdump is a command-line tool for monitoring network traffic. The ISAKMP parser in tcpdump 3.6 through...

Solaris mibiisa MIB Parsing Remote Overflow

The remote host is running mibiisa. There is a buffer overflow in older versions of this software, which may allow an attacker to gain a root shell on this host. Note that Nessus did not actually check for this vulnerability so this might be a false positive. C Tenable Network Security, Inc. XXXX...

Apache < 2.0.44 DOS Device Name Multiple Remote Vulnerabilities (Code Exec, DoS)

The remote host appears to be running a version of Apache for Windows that is older than 2.0.44. There are several flaws in this version that allow an attacker to crash this host or even execute arbitrary code remotely, but it only affects WindowsME and Windows9x. Note that Nessus solely relied o...

Concurrent Versions System (CVS) server improperly deallocates memory

Overview A "double-free" vulnerability in the Concurrent Versions System CVS server could allow a remote attacker to execute arbitrary code or commands or cause a denial of service on a vulnerable system. Description CVS is a source code maintenance system that is widely used by open-source...

BitKeeper Daemon Mode diff Shell Command Injection

The remote host is running version 3.0.x of BitKeeper. Some versions of this service are known to allow anyone to execute arbitrary commands with the privileges of the BitKeeper daemon. Nessus did not check for this vulnerability, but solely relied on the banner of the remote server to issue this...

[VSA0305] HLTV remote DoS

void.at Security Advisory VSA0305 HLTV offers the ability to have thousands of spectators watch online games on Half-Life-servers. Overview ======== By sending a specially crafted packet to the hltv-server, an attacker can cause the server to crash. Affected Versions ================= The one tha...

Cyrus IMAP Server login Command Remote Overflow

According to its banner, the remote Cyrus IMAP server is vulnerable to a pre-login buffer overrun. An attacker without a valid login could exploit this, and would be able to execute arbitrary commands as the owner of the Cyrus process. This would allow full access to all users' mailboxes. This...

Novell NetWare Web Handler Multiple Vulnerabilities

Novell NetWare contains multiple default web server installations. The NetWare Enterprise Web Server Netscape/IPlanet has a perl handler that will run arbitrary code given in a POST request. Versions 5.x through SP4 and 6.x through SP1 are affected. c 2002 visigoth GPLv2 REGISTER Changes by...

MS03-010: Microsoft Windows RPC Endpoint Manager Malformed Packet DoS (331953) (intrusive check)

MS Windows RPC service RPCSS crashes trying to dereference a NULL pointer when it receives a certain malformed request. All MS RPC-based services i.e. a large part of MS Windows 2000+ running on the target machine are rendered inoperable. %NASLMINLEVEL 70300 Test "Spike 2.7" MS RPC Services NULL...

Generic Format String Detection

Nessus killed the remote service by sending it specially crafted data. The remote service seems to be vulnerable to a format string attack. An attacker might use this flaw to make it crash or even execute arbitrary code on this host. C Tenable Network Security, Inc. References: Date: Wed, 20 Mar...