EGD detection

A random number generator is listening on the remote port. Description : The Entropy Gathering Daemon is running on the remote host. EGD is a user space random generator for operating systems that lack /dev/random SPDX-FileCopyrightText: 2005 Michel Arboi Some text descriptions might be excerpted...

Microsoft Distributed Transaction Coordinator Memory Corruption (MS05-051; CVE-2005-2119)

DTC Distributed Transaction Coordinator is a system service that coordinates transactions. A vulnerability was detected in the DTC service for several Microsoft Windows operating systems that can allow remote attackers to execute arbitrary code via a crafted DTC packet...

Microsoft Active Directory LSASS Buffer Overflow (MS04-011; CVE-2003-0533)

The Local Security Authority Subsystem Service LSASS is used to manage security processes, including local permission and client/server authentication A vulnerability was detected in the LSASS service for several Microsoft Windows operating systems that can allow remote attackers to execute...

picasm.txt

picasm error handling stack overflow vulnerability Name: picasm error handling stack overflow Versions Affected: picasm Author: Shaun Colley Vendor Notified: May 7th 2005 Public Disclosure: May 20th 2005 BACKGROUND picasm is a Microchip PIC16Cxx assembler, designed to run on most UNIX-like...

OS2A-1001.txt

OS2A ePing Arbitrary File Creation/Command Execution Vulnerability OS2A ID: OS2A1001 Status Published: 08/04/2005 Updated : 08/05/2005 Patch Released Class: File Creation/Command Execution Severity: CRITICAL Overview: ePing is a ping utility plugin for e107, a PHP-based content management system...

Windows 9x/NT/2k/XP PEB method 29 bytes

Windows 9x/NT/2k/XP PEB method 29 bytes. Shellcode exploit for win32 platform // // PEB way of getting kernel32 imagebase by loco. // Compatible with all Win9x/NT based operating systems. // // Gives kernel32 imagebase in eax when executing. // 29 bytes, only eax/esi used. // // Originally...

[Full-disclosure] Compuware Softice (DbgMsg driver) Local Denial Of Service

Compuware Softice DbgMsg driver Local Denial Of Service by Piotr Bania [email protected] http://pb.specialised.info Original location: http://pb.specialised.info/all/adv/sice-adv.txt Severity: Low / Medium - BSOD Blue Screen Of Death DOS Software affected: Tested on Softice from DriverStudio...

Entropy Gathering Daemon (EGD) Detection

The Entropy Gathering Daemon is running on the remote host. EGD is a user space random generator for operating systems that lack /dev/random %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include"compat.inc"; ifdescription scriptid18393; scriptversion"1.15"...

Windows (XP, 2k3, Longhorn) is vulnerable to IpV6 Land attack.

Hi! The land attack described in - http://www.securityfocus.com/archive/1/392354 - is fixed for ipv4 by last security updates, but not for ipv6 protocol. As in IpV4 version of the attack, the build-in firewall has to be turned off to experience the result 1-5 seconds of DoS condition. Tools used:...

CVE-2005-0637

The copy functions in locore.s such as copyout in OpenBSD 3.5 and 3.6, and possibly other BSD based operating systems, may allow attackers to exceed certain address boundaries and modify kernel memory...

CVE-2000-1221

The line printer daemon lpd in the lpr package in multiple Linux operating systems authenticates by comparing the reverse-resolved hostname of the local machine to the hostname of the print server as returned by gethostname, which allows remote attackers to bypass intended access controls by...

CVE-2000-1220

The line printer daemon lpd in the lpr package in multiple Linux operating systems allows local users to gain root privileges by causing sendmail to execute with arbitrary command line arguments, as demonstrated using the -C option to specify a configuration file...

CVE-2005-1184

The CVE-2005-1184 entry describes a DoS in the TCP/IP stack across multiple operating systems: a remote attacker sends a TCP packet with the correct sequence number but an incorrect Acknowledgement number, triggering a flood of keep-alive packets and CPU consumption. The impact is listed as Parti...

Cain & Abel PSK Sniffer Heap overflow

SEC-1 LTD. www.sec-1.com Security Advisory Advisory Name: Cain & Abel PSK Sniffer Heap overflow Release Date: 18/03/2005 Application: Cain & Abel 2.65 Platform: Win32 Severity: Remote Code Execution Author: Gary O'leary-Steele Vendor Status: Fixed 16/03/2005 CVE Candidate: N/A Reference:...

Sylpheed < 1.0.3 Invalid Header Overflow

Binary data 2672.prm...

CVE-2005-0637

CVE-2005-0637 concerns the copyout functions in locore.s (notably OpenBSD 3.5 and 3.6) which may allow an attacker to exceed certain address boundaries and modify kernel memory. The underlying issue is a boundary/offset handling in these copy routines that can bypass protection checks, leading to...

CVE-2005-0044

The OLE component in Windows 98, 2000, XP, and Server 2003, and Exchange Server 5.0 through 2003, does not properly validate the lengths of messages for certain OLE data, which allows remote attackers to execute arbitrary code, aka the "Input Validation Vulnerability."...

CVE-1999-1572

cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O archive or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files...

EEYE: Windows ANI File Parsing Buffer Overflow

Windows ANI File Parsing Buffer Overflow Systems Affected: Windows Me Windows 2000 Windows XP SP1 and earlier Windows 2003 Overview: eEye Digital Security has discovered a vulnerability in USER32.DLL's handling of Windows animated cursor .ani files that will allow a remote attacker to reliably...

[Full-Disclosure] [AppSecInc Team SHATTER Security Advisory] Microsoft Windows Improper Token Validation

Microsoft Windows Improper Token Validation AppSecInc Team SHATTER Security Advisory http://www.appsecinc.com/resources/alerts/general/06-0001.html January 10, 2005 Credit: This vulnerability was discovered and researched by Cesar Cerrudo of Application Security, Inc. Risk Level: High Summary: A...