4220 matches found
CUPS 1.1.x - Negative Length HTTP Header
CUPS 1.1.x - Negative Length HTTP Header source: https://www.securityfocus.com/bid/6437/info A vulnerability has been reported for CUPS that if exploited may result in a DoS or the execute of code on affected systems. An attacker can exploit this vulnerability by connecting to a vulnerable system...
openbsd-select-bug.txt
Hi there, Recently a bug in the select syscall of openbsd was published. This text describes the details and the eventual exploitation of this bug. First of all let us look at the definition of select: int selectint nfds, fdset readfds, fdset writefds, fdset exceptfds, struct timeval timeout; The...
Null HTTPd 0.5 - Remote Heap Overflow
Null HTTPd 0.5 - Remote Heap Overflow // source: https://www.securityfocus.com/bid/5774/info Null httpd is a small multithreaded web server for Linux and Windows, mantained by NullLogic. A remotely exploitable heap overflow has been discovered in Null httpd. By passing a negative content length...
Savant Web Server 3.1 - Malformed Content-Length Denial of Service
source: https://www.securityfocus.com/bid/5707/info Savant Webserver is prone to a denial of service attack, when processing a negative integer located in a users Content-Length value. It should be noted that versions below 3.1 may also be vulnerable to this issue. GET / HTTP/1.0 Content-Length: ...
Signed/unsigned conversion bug in OpenBSD select() call
By passing negative argument to select function it's possible to overwrite the fragment of kernel memory...
CVE-2002-0818
wwwoffled in World Wide Web Offline Explorer WWWOFFLE allows remote attackers to cause a denial of service and possibly execute arbitrary code via a negative Content-Length value...
DSA-144 wwwoffle - improper input handling
Bulletin has no description...
wwwoffle-2.7b and prior segfaults with negative Content-Length value
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 QITEST1 SECURITY ADVISORY 005 wwwoffle-2.7b and prior segfaults with negative Content-Length value PROGRAM DESCRIPTION WWWOFFLE, World Wide Web Offline Explorer, is a proxy HTTP/FTP server for computers with dial-up internet access. DETAILS When...
CVE-2001-0653
CVE-2001-0653 affects Sendmail 8.10.0–8.11.5 and 8.12.0 beta. The root cause is an input-validation/overflow in the debugger (-d) category handling: a large numeric value can be interpreted as a signed negative index, bypassing bounds checks and allowing local writes to process memory. Consequenc...
Отрицательные индексы массива в rsync (negatice array index)
Ошибка отрицательных индексов массива дает возможность удаленного выполнения кода...
rsync 2.5.1 - Remote (2)
/ 7350rsync - rsync include include include include include include include include include include define MAXPATHLEN 4096 define VERSION "@RSYNCD: 26\n" define PORT 873 define NULLOFFSET -48 define STARTNULLBRUTE -44 define ENDNULLBRUTE -56 define BRUTEBASE 0xbfff7777 define INCREMENT 512 define...
Ошибки в sendmail debug (signed/unsigned)
при использовании ключа -d используется знаковое число после присвоения ему беззнакового значения в качестве индекса массива, что позволяет адресовать отрицательное смещение...
Linux kernel does not properly validate user input via sysctl for negative value
Overview Unprivileged local users can exploit the sysctl Linux kernel program to gain privileged access. Description A program called sysctl in the Linux kernel allows a privileged local user to read or write runtime system settings. Unprivileged local users are also allowed to use sysctl to read...
X 11.0/3.3.3/3.3.4/3.3.5/3.3.6/4.0 - libX11 '_XAsyncReply()' Stack Corruption
// source: https://www.securityfocus.com/bid/1408/info A vulnerability exists in the XAsyncReply function of libX11. This function utilizes size information retrieved as part of a client supplied packet. This value is a signed integer. By forcing this value to be negative, it becomes possible to...
CVE-2000-0453
XFree86 3.3.x and 4.0 allows a user to cause a denial of service via a negative counter value in a malformed TCP packet that is sent to port 6000...
openbsdreadv.txt
Date: Mon, 27 Jul 1998 12:26:36 +0100 BST From: [email protected] To: [email protected] X-Send-Pr-Version: 3.97 Subject: kernel/549: Any user can panic OpenBSD machine Sender: [email protected] Number: 549 Category: kernel Synopsis: readv with -ve block size panics kernel Confidential: yes...
WebTrends Enterprise Reporting Server 1.5 - Negative Content Length Denial of Service
source: https://www.securityfocus.com/bid/569/info Specifying a negative content-length in a POST operation to the WebTrends Enterprise Reporting Server will crash the web server. !/usr/bin/perl -w Example DoS against WebTrends Enterprise Reporting Server 8/8/99 rpc use IO::Socket; die "usage: $0...
WebTrends Enterprise Reporting Server 1.5 - Negative Content Length Denial of Service
WebTrends Enterprise Reporting Server 1.5 - Negative Content Length Denial of Service source: https://www.securityfocus.com/bid/569/info Specifying a negative content-length in a POST operation to the WebTrends Enterprise Reporting Server will crash the web server. !/usr/bin/perl -w Example DoS...
