NFS portmapper localhost Mount Request Restricted Host Access

The remote RPC portmapper forwards NFS requests made to it. An attacker may use this flaw to make NFS mount requests which will appear to come from localhost and therefore override the ACLs set up for NFS. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

Multiple Vendor NFS CD Command Arbitrary File/Directory Access

The remote NFS server allows users to use a 'cd ..' command to access other directories besides the NFS file system. An attacker may use this flaw to read every file on this host. C Tenable Network Security, Inc. This is the implementation of an oooold attack. include 'compat.inc' ; if descriptio...

Low: Red Hat Security Advisory: tcpdump security update

Updated tcpdump packages are available to fix a denial of service vulnerability in tcpdump. Updated 12 March 2003 Added packages for Red Hat Enterprise Linux ES and Red Hat Enterprise Linux WS Tcpdump is a command-line tool for monitoring network traffic. The ISAKMP parser in tcpdump 3.6 through...

Solaris mibiisa MIB Parsing Remote Overflow

The remote host is running mibiisa. There is a buffer overflow in older versions of this software, which may allow an attacker to gain a root shell on this host. Note that Nessus did not actually check for this vulnerability so this might be a false positive. C Tenable Network Security, Inc. XXXX...

Apache < 2.0.44 DOS Device Name Multiple Remote Vulnerabilities (Code Exec, DoS)

The remote host appears to be running a version of Apache for Windows that is older than 2.0.44. There are several flaws in this version that allow an attacker to crash this host or even execute arbitrary code remotely, but it only affects WindowsME and Windows9x. Note that Nessus solely relied o...

Concurrent Versions System (CVS) server improperly deallocates memory

Overview A "double-free" vulnerability in the Concurrent Versions System CVS server could allow a remote attacker to execute arbitrary code or commands or cause a denial of service on a vulnerable system. Description CVS is a source code maintenance system that is widely used by open-source...

BitKeeper Daemon Mode diff Shell Command Injection

The remote host is running version 3.0.x of BitKeeper. Some versions of this service are known to allow anyone to execute arbitrary commands with the privileges of the BitKeeper daemon. Nessus did not check for this vulnerability, but solely relied on the banner of the remote server to issue this...

[VSA0305] HLTV remote DoS

void.at Security Advisory VSA0305 HLTV offers the ability to have thousands of spectators watch online games on Half-Life-servers. Overview ======== By sending a specially crafted packet to the hltv-server, an attacker can cause the server to crash. Affected Versions ================= The one tha...

Cyrus IMAP Server login Command Remote Overflow

According to its banner, the remote Cyrus IMAP server is vulnerable to a pre-login buffer overrun. An attacker without a valid login could exploit this, and would be able to execute arbitrary commands as the owner of the Cyrus process. This would allow full access to all users' mailboxes. This...

MS03-010: Microsoft Windows RPC Endpoint Manager Malformed Packet DoS (331953) (intrusive check)

MS Windows RPC service RPCSS crashes trying to dereference a NULL pointer when it receives a certain malformed request. All MS RPC-based services i.e. a large part of MS Windows 2000+ running on the target machine are rendered inoperable. %NASLMINLEVEL 70300 Test "Spike 2.7" MS RPC Services NULL...

Novell NetWare Web Handler Multiple Vulnerabilities

Novell NetWare contains multiple default web server installations. The NetWare Enterprise Web Server Netscape/IPlanet has a perl handler that will run arbitrary code given in a POST request. Versions 5.x through SP4 and 6.x through SP1 are affected. c 2002 visigoth GPLv2 REGISTER Changes by...

Generic Format String Detection

Nessus killed the remote service by sending it specially crafted data. The remote service seems to be vulnerable to a format string attack. An attacker might use this flaw to make it crash or even execute arbitrary code on this host. C Tenable Network Security, Inc. References: Date: Wed, 20 Mar...

CISCO as5350 crashes with nmap connect scan

I have managed to "reduplicate" at least five times the following scenario with a cisco as5250, with firmwrare 12.2 11t release firmware of cisco: nmap -dinsane -p 1-65535 ip.of.as5350 This causes a "hard" lockup, and the device must be powered off in order to have functionality restored to it...

DSA-180 nis - information leak

Bulletin has no description...

[SECURITY] [DSA 178-1] New Heimdal packages fix remote command execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 178-1 [email protected] http://www.debian.org/security/ Martin Schulze October 17th, 2002 http://www.debian.org/security/faq -...

Polycom ViaVideo 2.23.0 - Denial of Service

Polycom ViaVideo 2.23.0 - Denial of Service source: https://www.securityfocus.com/bid/5962/info Polycom ViaVideo devices are prone to a denial of service condition upon receipt of numerous incomplete HTTP requests. This may restrict availability of the device for legitimate users. The device may...

DHTML Edit Control for IE5 allows local files to be uploaded to web server

Overview A vulnerability exists in the DHTML Edit Control for IE5 that allows arbitrary local files to be uploaded to a web server. Description DHTML Edit is an activex control that is marked safe-for-scripting. This control can be embedded in a website, and permit local files to be remotely...

Mike Spice's My Calendar does not adequately validate user input

Overview Mike Spice's My Calendar does not adequately validate user input, allowing directory traversal. As a result, an attacker can cause My Calendar to overwrite any file on the server to which the web server process has write privileges. Description Mike Spice's My Calendar is a CGI script...

IBM AIX FC contains buffer overflow exploitable during session setup

Overview The FC client in IBM's AIX contains a buffer overflow that may cause a core dump in the client. Description The IBM AIX FC client allows a buffer overflow of a few bytes in the client process, which could cause intermittent core dumps during session setup. Overflowing the buffer is...

HP Tru64 UNIX "ypmatch" contains buffer overflow (SSRT2277)

Overview The HP Tru64 UNIX implementation of "ypmatch" contains a locally exploitable buffer overflow. Description "ypmatch" is used to print the value of keys from an NIS map. A locally exploitable buffer overflow in ypmatch may permit a local attacker to gain elevated privileges and execute...