Mercur IMAPD 5.00.14 (Windows x86) - Remote Denial of Service

Mercur IMAPD 5.00.14 Windows x86 - Remote Denial of Service !/usr/bin/perl mercur-v1.pl Mercur v5.00.14 win32 remote exploit by mu-b - Dec 2006 - Tested on: Mercur v5.00.14 win32 use Getopt::Std; getopts't:n:', %arg; use Socket; use MIME::Base64; my $target; if defined$arg't' $target = $arg't' if...

MailEnable multiple security vulnerabilities

Multiple crossite scripting issues. NTLM authentication DoS. Buffer overflow in IMAP APPEND command...

CVE-2007-0955

The NTLMUnPackType3 function in MENTLM.dll in MailEnable Professional 2.35 and earlier allows remote attackers to cause a denial of service application crash via certain base64-encoded data following an AUTHENTICATE NTLM command to the imap port 143/tcp, which results in an out-of-bounds read...

CVE-2007-0955

The CVE-2007-0955 entry concerns MailEnable Professional (version 2.35 and earlier) where the NTLM_UnPack_Type3 function in MENTLM.dll is vulnerable. Remote attackers can cause an application crash (DoS) by sending certain base64-encoded data after an AUTHENTICATE NTLM command to the IMAP port (1...

[Full-disclosure] MailEnable DoS POC

The POC attached exploits an out of bounds memory read in the NTLM authentication routines of MailEnable Pro/Enterprise. The problem lies in the NTLMUnPackType3 function of MENTLM.dll. This appears to have been silently "patched" somewhere between versions 2.351 and 2.36-7. observe the quotes...

MailEnable Professional/Enterprise 2.35 - Out of Bounds Denial of Service

!/usr/bin/perl maildisable-v5.pl Mail Enable Professional/Enterprise Connected\n"; sendSOCKET, "1 AUTHENTICATE NTLM\r\n", 0; sleep$senddelay; $buf = $PAD x 12. "\xfa\xff\xff\xff". $PAD x 12; sendSOCKET, encodebase64$buf."\r\n", 0; sleep$senddelay; $buf = $PAD x 28. "\x00\x01". $PAD x 2...

MailEnable ProfessionalEnterprise 2.37 - Denial of Service

MailEnable ProfessionalEnterprise 2.37 - Denial of Service !/usr/bin/perl maildisable-v7.pl Mail Enable Professional/Enterprise v2.32-7 win32 by mu-b - Wed Feb 14 2007 - Tested on: Mail Enable Professional v2.37 win32 use Getopt::Std; getopts't:', %arg; use Socket; use MIME::Base64; my $target; i...

MailEnable Professional/Enterprise <= 2.37 Denial of Service Exploit

Exploit for unknown platform in category dos / poc ==================================================================== MailEnable Professional/Enterprise Connected\n"; sendSOCKET, "1 AUTHENTICATE NTLM\r\n", 0; sleep$senddelay; $buf = $PAD x 12. "\xfa\xff\xff\xff". $PAD x 12; sendSOCKET,...

MailEnable Professional/Enterprise 2.37 - Denial of Service

!/usr/bin/perl maildisable-v7.pl Mail Enable Professional/Enterprise v2.32-7 win32 by mu-b - Wed Feb 14 2007 - Tested on: Mail Enable Professional v2.37 win32 use Getopt::Std; getopts't:', %arg; use Socket; use MIME::Base64; my $target; if defined$arg't' $target = $arg't' if !defined$target my...

maildisable-v7.pl.txt

!/usr/bin/perl maildisable-v7.pl Mail Enable Professional/Enterprise v2.32-7 win32 by mu-b - Wed Feb 14 2007 - Tested on: Mail Enable Professional v2.37 win32 use Getopt::Std; getopts't:', %arg; use Socket; use MIME::Base64; my $target; if defined$arg't' $target = $arg't' if !defined$target my...

CVE-2006-6981

3proxy 0.5 to 0.5.2, when NT-encoded passwords are being used, allows remote attackers to cause a denial of service blocked account via unspecified vectors related to NTLM authentication, which causes a password hash to be overwritten...

CVE-2006-6982

3proxy 0.5 to 0.5.2 does not offer NTLM authentication before basic authentication, which might cause browsers with incomplete RFC2616/RFC2617 support to use basic cleartext authentication even if NTLM is available, which makes it easier for attackers to steal credentials...

CVE-2006-6981

3proxy 0.5 to 0.5.2, when NT-encoded passwords are being used, allows remote attackers to cause a denial of service blocked account via unspecified vectors related to NTLM authentication, which causes a password hash to be overwritten...

CVE-2006-6982

CVE-2006-6982 affects 3proxy versions 0.5 to 0.5.2. The issue is that NTLM authentication is not offered before basic authentication, which may cause browsers with incomplete RFC2616/RFC2617 support to fall back to basic cleartext credentials even when NTLM is available, potentially enabling cred...

CVE-2006-6981

CVE-2006-6981 affects 3proxy versions 0.5 to 0.5.2. The issue arises when NT-encoded passwords are used and NTLM authentication is involved, allowing remote attackers to cause a denial of service by overwriting a password hash, resulting in a blocked account. The vulnerability is documented with ...

CVE-2006-6982

3proxy 0.5 to 0.5.2 does not offer NTLM authentication before basic authentication, which might cause browsers with incomplete RFC2616/RFC2617 support to use basic cleartext authentication even if NTLM is available, which makes it easier for attackers to steal credentials...

3proxy user account locking

It's possible to lock user's account if user's password is stored as NT-hash via HTTP proxy. Service restart or configuration reload is required to restore account in working state. In addition, Basic authentication is offered as first authentication protocol, it can lead to shoosing weak clearte...

Kerio Winroute Firewall 5.10 users credentials leak

Application: Kerio Winroute Firewall 5.10 Vendor: Kerio Technologies Inc. Vendor Site: http://www.kerio.com Remote: Yes Exploitable: Yes Risk level: Critical if proxy requires authentication Authors: Alexander Antipov & 3APA3A aka Pig Killer Authors Sites: http://www.securitylab.ru...

3APA3A : NTLM in corporate networks

November 18, 2004| 3APA3A NTLM in corporate networks Introduction When, a decade and a half ago, Microsoft began serious work on creating enterprise-wide centralized networks while working on the Windows NT operating system, the developers were given a very difficult and new task for those times ...

Squid NTLM Authenticate Overflow

This is an exploit for Squid's NTLM authenticate overflow libntlmssp.c. Due to improper bounds checking in ntlmcheckauth, it is possible to overflow the 'pass' variable on the stack with user controlled data of a user defined length. Props to iDEFENSE for the advisory. This module requires...