FreeBSD : openvpn -- arbitrary code execution on client through malicious or compromised server (6129fdc7-6462-456d-a3ef-8fc3fbf44d16)

James Yonan reports : A format string vulnerability in the foreignoption function in options.c could potentially allow a malicious or compromised server to execute arbitrary code on the client. Only non-Windows clients are affected. The vulnerability only exists if a the client's TLS negotiation...

Serendipity Blog vuln

I found this while auditing serendipty blog. You need a blog account which isnt that big of deal just google all the sites that give out free blogs for this to work. After you get hte blog account you go into your admin panel where there will be config options. The mysql details are editable from...

phpMyChat 0.15.0dev (SYS enter) Remote Code Execution Exploit

Exploit for unknown platform in category web applications ============================================================= phpMyChat 0.15.0dev SYS enter Remote Code Execution Exploit ============================================================= !/usr/bin/php -q -d shortopentag=on works with...

CVE-2006-1117

nCipher firmware before V10, as used by 1 nShield, 2 nForce, 3 netHSM, 4 payShield, 5 SecureDB, 6 DSE200 Document Sealing Engine, 7 Time Source Master Clock TSMC, and possibly other products, contains certain options that were only intended for testing and not production, which might allow remote...

CVE-2006-1079

htpasswd, as used in Acme thttpd 2.25b and possibly other products such as Apache, might allow local users to gain privileges via shell metacharacters in a command line argument, which is used in a call to the system function. NOTE: since htpasswd is normally installed as a non-setuid program, an...

CVE-2006-0965

NCP Network Communication Secure Client 8.11 Build 146, and possibly other versions, allows local users to bypass security protections and configure privileged options via a long argument to ncpmon.exe, which provides access to alternate privileged menus, possibly due to a buffer overflow...

Design/Logic Flaw

The frag3 preprocessor in Sourcefire Snort 2.4.3 does not properly reassemble certain fragmented packets with IP options, which allows remote attackers to evade detection of certain attacks, possibly related to IP option lengths...

CVE-2006-0839

The frag3 preprocessor in Sourcefire Snort 2.4.3 does not properly reassemble certain fragmented packets with IP options, which allows remote attackers to evade detection of certain attacks, possibly related to IP option lengths...

CVE-2006-0839

The frag3 preprocessor in Sourcefire Snort 2.4.3 does not properly reassemble certain fragmented packets with IP options, which allows remote attackers to evade detection of certain attacks, possibly related to IP option lengths...

CVE-2006-0839

The CVE-2006-0839 entry concerns the frag3 preprocessor in Sourcefire Snort 2.4.3. It states that certain fragmented packets with IP options are not properly reassembled, which can allow remote attackers to evade detection of certain attacks (potentially related to IP option lengths). The existin...

CVE-2006-0839

Removed by vendor...

CVE-2006-0839

The frag3 preprocessor in Sourcefire Snort 2.4.3 does not properly reassemble certain fragmented packets with IP options, which allows remote attackers to evade detection of certain attacks, possibly related to IP option lengths...

CVE-2006-0839: Undefined Security Weakness

The frag3 preprocessor in Sourcefire Snort 2.4.3 does not properly reassemble certain fragmented packets with IP options, which allows remote attackers to evade detection of certain attacks, possibly related to IP option lengths...

Design/Logic Flaw

eStara SIP softphone allows remote attackers to cause a denial of service crash via a SIP OPTIONS request with a negative Expires field...

CVE-2006-0737

eStara SIP softphone allows remote attackers to cause a denial of service crash via a SIP OPTIONS request with a negative Expires field...

CVE-2006-0737: Undefined Security Weakness

eStara SIP softphone allows remote attackers to cause a denial of service crash via a SIP OPTIONS request with a negative Expires field...

Linux kernel ICMP DoS

record-route or timestamp IP options handling vulnerability...

CVE-2006-0454

Linux kernel before 2.6.15.3 down to 2.6.12, while constructing an ICMP response in icmpsend, does not properly handle when the ipoptionsecho function in icmp.c fails, which allows remote attackers to cause a denial of service crash via vectors such as 1 record-route and 2 timestamp IP options wi...

CVE-2006-0454

Linux kernel before 2.6.15.3 down to 2.6.12, while constructing an ICMP response in icmpsend, does not properly handle when the ipoptionsecho function in icmp.c fails, which allows remote attackers to cause a denial of service crash via vectors such as 1 record-route and 2 timestamp IP options wi...

CVE-2006-0454

The CVE-2006-0454 issue affects the Linux kernel (2.6.x) where icmp_send mishandles failures in ip_options_echo, enabling remote attackers to crash the host via crafted ICMP options (record-route, timestamp with needaddr and truncated value). Public advisories from SUSE, Red Hat, Fedora, Ubuntu d...