CVE-2005-0039

Certain configurations of IPsec, when using Encapsulating Security Payload ESP in tunnel mode, integrity protection at a higher layer, or Authentication Header AH, allow remote attackers to decrypt IPSec communications by modifying the outer packet in ways that cause plaintext data from the inner...

CVE-2005-0021

Multiple buffer overflows in Exim before 4.43 may allow attackers to execute arbitrary code via 1 an IPv6 address with more than 8 components, as demonstrated using the -be command line option, which triggers an overflow in the hostaton function, or 2 the -bh command line option or dnsdb PTR...

Microsoft Windows - Malformed IP Options Denial of Service (MS05-019)

Microsoft Windows - Malformed IP Options Denial of Service MS05-019 / ecl-winipdos.c - 16/04/05 Yuri Gushin Alex Behar This one was actually interesting, an off-by-one by our beloved M$ : When processing an IP packet with an option size 2nd byte after the option of 39, it will crash - since the...

Microsoft Windows - Malformed IP Options Denial of Service (MS05-019)

/ ecl-winipdos.c - 16/04/05 Yuri Gushin Alex Behar This one was actually interesting, an off-by-one by our beloved M$ : When processing an IP packet with an option size 2nd byte after the option of 39, it will crash - since the maximum available size is 40 for the whole IP options field, and two...

Microsoft Windows does not adequately validate IP options

Overview Microsoft Windows does not adequately validate IP options, allowing an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service. An attacker could take complete control of a vulnerable system. Description Several versions of the Microsoft Windows IP stack a...

security flaw

Buffer overflow in the slcaddreply function in various BSD-based Telnet clients, when handling LINEMODE suboptions, allows remote attackers to execute arbitrary code via a reply with a large number of Set Local Character SLC commands...

security flaw

cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O archive or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files...

CVE-2004-0592

The tcpfindoption function of the netfilter subsystem for IPv6 in the SUSE Linux 2.6.5 kernel with USAGI patches, when using iptables and TCP options rules, allows remote attackers to cause a denial of service CPU consumption by infinite loop via a large option length that produces a negative...

DEBIAN-CVE-2004-1951

xine 1.x alpha, 1.x beta, and 1.0rc through 1.0rc3a, and xine-ui 0.9.21 to 0.9.23 allows remote attackers to overwrite arbitrary files via the 1 audio.sunaudiodevice or 2 dxr3.devicename options in an MRL link...

CVE-2004-2652

The DecodeTCPOptions function in decode.c in Snort before 2.3.0, when printing TCP/IP options using FAST output or verbose mode, allows remote attackers to cause a denial of service crash via packets with invalid TCP/IP options, which trigger a null dereference...

CVE-2004-2315

Mbedthis AppWeb HTTP server before 1.0.2 allows remote attackers to cause a denial of service crash via an empty OPTIONS request...

PT-2004-2784 · Ipswitch · Ipswitch Ws Ftp Server

Name of the Vulnerable Software and Affected Versions: Ipswitch WS FTP Server version 4.0.2 Description: The issue allows remote authenticated users to execute arbitrary programs as SYSTEM. This is achieved by using the SITE command to modify certain iFtpSvc options handled by iftpmgr.exe...

[EXPL] Snort Malformed TCP Options DoS

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

snort TCP options DoS

Invalid set of TCP options causes program to crash...

security flaw

Memory leak in the ipoptionsget function in the Linux kernel before 2.6.10 allows local users to cause a denial of service memory consumption by repeatedly calling the ipcmsgsend function...

Snort 2.12.2 - DecodeTCPOptions Remote Denial of Service (1)

Snort 2.12.2 - DecodeTCPOptions Remote Denial of Service 1 // source: https://www.securityfocus.com/bid/12084/info Snort is reported prone to a remote denial of service vulnerability. The vulnerability is reported to exist in the DecodeTCPOptions function of 'decode.c', and is as a result of a...

Gadu-Gadu Remote DoS (all versions)

Product: Gadu-Gadu, all available versions including the latest 6.1 build156 Vendor: SMS-EXPRESS.COM http://www.gadu-gadu.pl Impact: Remote Denial of Service Severity: Important Author: Maciej Soltysiak [email protected] Advisory: http://www.soltysiak.com/gg-dos.txt ISSUE It is possible to...

PT-2004-2256 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 2.6.10 Description: The issue is related to an integer overflow in the ip options get function, which can be exploited by local users to cause a denial of service, resulting in a kernel crash. This is achieved b...

Hydra (NASL wrappers options)

This plugin sets options for the Hydra tests. Hydra finds passwords by brute force. To use the Hydra plugins, enter the 'Logins file' and the 'Passwords file under the 'Hydra NASL wrappers options' advanced settings block. TRUSTED...

atari800 - Local Privilege Escalation

/ Exploit for atari800 by pi3 pi3ki31ny pi3@pi3:$ ./p ...::: -= exploit for Atari800 by pi3 pi3ki31ny =- :::... Ussage: + ./p options -? -v choose a bug: 1 - first bug in all versions Atari800 2 - second bug in older Atari800 - modiy argv0 3 - third bug in config file - OS/AROM 4 - fourth bug in...