CVE-2006-4435

OpenBSD 3.8 and 3.9 (and possibly earlier) are affected by a vulnerability in the kernel semaphore handling. The issue allows context-dependent attackers to cause a denial of service (kernel panic) by allocating more semaphores than the default, leading to system instability. The available source...

CVE-2006-4436

isakmpd in OpenBSD 3.8, 3.9, and possibly earlier versions, creates Security Associations SA with a replay window of size 0 when isakmpd acts as a responder during SA negotiation, which allows remote attackers to replay IPSec packets and bypass the replay protection...

CVE-2006-4436

CVE-2006-4436 affects OpenBSD’s isakmpd (SAK/ISAKMP daemon) in OpenBSD 3.8, 3.9 and possibly earlier. The flaw causes Security Associations to be created with a replay window of 0 when isakmpd acts as the responder during SA negotiation, enabling remote attackers to replay IPsec packets and bypas...

CVE-2006-4436

Removed by vendor...

CVE-2006-4304

Buffer overflow in the sppp driver in FreeBSD 4.11 through 6.1, NetBSD 2.0 through 4.0 beta before 20060823, and OpenBSD 3.8 and 3.9 before 20060902 allows remote attackers to cause a denial of service panic, obtain sensitive information, and possibly execute arbitrary code via crafted Link Contr...

CVE-2006-4304

Buffer overflow in the sppp driver in FreeBSD 4.11 through 6.1, NetBSD 2.0 through 4.0 beta before 20060823, and OpenBSD 3.8 and 3.9 before 20060902 allows remote attackers to cause a denial of service panic, obtain sensitive information, and possibly execute arbitrary code via crafted Link Contr...

CVE-2006-4304

CVE-2006-4304 describes a buffer overflow in the sppp(4) driver (used with PPP implementations such as pppoe/ippp) on FreeBSD 4.11–6.1, NetBSD 2.0–4.0 beta, and OpenBSD 3.8–3.9. The issue arises while processing LCP configuration options, where option lengths aren’t properly validated, allowing a...

CVE-2006-4304

Buffer overflow in the sppp driver in FreeBSD 4.11 through 6.1, NetBSD 2.0 through 4.0 beta before 20060823, and OpenBSD 3.8 and 3.9 before 20060902 allows remote attackers to cause a denial of service panic, obtain sensitive information, and possibly execute arbitrary code via crafted Link Contr...

OpenBSD PF IP分片拒绝服务漏洞

BUGTRAQ ID: 16375 CVECAN ID: CVE-2006-0381 OpenBSD是一款开放源代码Unix类操作系统。 OpenBSD内核的报文分片处理模块存在漏洞，远程攻击者可利用此漏洞对服务器进行拒绝服务攻击。 远程攻击者可能通过精心构造的恶意分片报文导致内核崩溃。 FreeBSD FreeBSD 6.0-STABLE FreeBSD FreeBSD 6.0-RELEASE FreeBSD FreeBSD 5.4 FreeBSD FreeBSD 5.3 OpenBSD OpenBSD current OpenBSD OpenBSD 3.8 OpenBSD OpenB...

bsd/x86 - setuid/portbind shellcode 94 bytes

bsd/x86 setuid/portbind shellcode 94 bytes. Shellcode exploit for bsdx86 platform / $Id: portbind-bsd.c,v 1.3 2004/06/02 12:22:30 raptor Exp $ portbind-bsd.c - setuid/portbind shellcode for BSD/x86 Copyright c 2003 Marco Ivaldi Simple portbind shellcode that bind's a setuid0 shell on port 31337/t...

bsd/x86 - setuid/execve shellcode 30 bytes

bsd/x86 setuid/execve shellcode 30 bytes. Shellcode exploit for bsdx86 platform / $Id: setuid-bsd.c,v 1.6 2004/06/02 12:22:30 raptor Exp $ setuid-bsd.c - setuid/execve shellcode for BSD/x86 Copyright c 2003 Marco Ivaldi Short setuid0 and /bin/sh execve shellcode based on esdee's code. Tested on...

openbsd/x86 execve(/bin/sh) 23 bytes

Exploit for openbsd/x86 platform in category shellcode ==================================== openbsd/x86 execve/bin/sh 23 bytes ==================================== / OpenBSD/x86 Shellcode for: execve"/bin/sh", "/bin/sh", NULL 23 bytes / include include include include include include include...

openbsd/x86 execve/bin/sh 23 bytes

openbsd/x86 execve/bin/sh 23 bytes. Shellcode exploit for openbsdx86 platform / OpenBSD/x86 Shellcode for: execve"/bin/sh", "/bin/sh", NULL 23 bytes hophet at gmail.com http://www.nlabs.com.br/hophet/ Fancy mappings by iruata souza muzgo iru.muzgo!gmail.com http://openvms-rocks.com/muzgo/ / inclu...

[SLAB] NetBSD / OpenBSD kernfs_xread patch evasion

--- SecurityLab Technologies, Inc. --- Security Advisory --- http://www.securitylab.net Advisory Name: NetBSD / OpenBSD kernfsxread patch evasion Release Date: February 02, 2006 Application: kernfs Platform: NetBSD / OpenBSD Severity: Severe Author: SLAB Research Vendor Status: Patched Reference:...

Design/Logic Flaw

A logic error in the IP fragment cache functionality in pf in FreeBSD 5.3, 5.4, and 6.0, and OpenBSD, when a 'scrub fragment crop' or 'scrub fragment drop-ovl' rule is being used, allows remote attackers to cause a denial of service crash via crafted packets that cause a packet fragment to be...

CVE-2006-0381

A logic error in the IP fragment cache functionality in pf in FreeBSD 5.3, 5.4, and 6.0, and OpenBSD, when a 'scrub fragment crop' or 'scrub fragment drop-ovl' rule is being used, allows remote attackers to cause a denial of service crash via crafted packets that cause a packet fragment to be...

CVE-2006-0381

A logic error in the IP fragment cache functionality in pf in FreeBSD 5.3, 5.4, and 6.0, and OpenBSD, when a 'scrub fragment crop' or 'scrub fragment drop-ovl' rule is being used, allows remote attackers to cause a denial of service crash via crafted packets that cause a packet fragment to be...

CVE-2006-0381

A logic error in the IP fragment cache functionality in pf in FreeBSD 5.3, 5.4, and 6.0, and OpenBSD, when a 'scrub fragment crop' or 'scrub fragment drop-ovl' rule is being used, allows remote attackers to cause a denial of service crash via crafted packets that cause a packet fragment to be...

CVE-2006-0381

The CVE-2006-0381 entry describes a logic bug in pf's IP fragment cache that can cause a fragment to be inserted twice when using the pf rules scrub fragment crop or scrub fragment drop-ovl. Affected products include FreeBSD 5.3, 5.4, and 6.0, and OpenBSD. The impact is remote denial of service (...

Ubuntu 4.10 : libxpm4 vulnerability (USN-27-1)

Chris Evans discovered several stack overflows in the versions of libXpm shipped by X.Org, XFree86, and LessTif. These overflows were fixed in the Warty development tree before its release. Mathieu Herrb of OpenBSD subsequently discovered that the original patch was insufficient to address these...