openssl mitm downgrade attack

The SSL/TLS server implementation in OpenSSL 0.9.7 before 0.9.7h and 0.9.8 before 0.9.8a, when using the SSLOPMSIESSLV2RSAPADDING option, disables a verification step that is required for preventing protocol version rollback attacks, which allows remote attackers to force a client and server to u...

PECL 3.0.x - Alternative PHP Cache Extension apc_search_paths() Remote Buffer Overflow

PECL 3.0.x - Alternative PHP Cache Extension apcsearchpaths Remote Buffer Overflow source: https://www.securityfocus.com/bid/28457/info PECL Alternative PHP Cache APC extension is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input...

DEBIAN-CVE-2007-6277

Multiple buffer overflows in Free Lossless Audio Codec FLAC libFLAC before 1.2.1 allow user-assisted remote attackers to execute arbitrary code via large 1 Metadata Block Size, 2 VORBIS Comment String Size, 3 Picture Metadata MIME-TYPE Size, 4 Picture Description Size, 5 Picture Data Length, 6...

Ubuntu 6.06 LTS : firefox vulnerabilities (USN-351-1)

Various flaws have been reported that allow an attacker to execute arbitrary code with user privileges by tricking the user into opening a malicious web page containing JavaScript. CVE-2006-4253, CVE-2006-4565, CVE-2006-4566, CVE-2006-4568, CVE-2006-4569 CVE-2006-4571 The NSS library did not...

PT-2007-5034 · Marshalsec · Mailmarshal Smtp

Name of the Vulnerable Software and Affected Versions: MailMarshal SMTP versions 6.2.0.x through 6.2.0.x Description: The password reset feature in the Spam Quarantine HTTP interface has an issue that allows remote attackers to modify arbitrary account information. This is achieved by exploiting...

Apache mod_rewrite (Windows x86) - Off-by-One Remote Overflow

!/bin/sh Exploit for Apache modrewrite off-by-oneWin32. by axis http://www.ph4nt0m.org 2007-04-06 Tested on Apache 2.0.58 Win32 Windows2003 CN SP1 Vulnerable Apache Versions: 1.3 branch: 1.3.28 and 2.0.46 and 2.2.0 and 2006-08-20 http://www.milw0rm.com/exploits/2237 to successfully exploit the...

Apache mod_rewrite (Windows x86) - Off-by-One Remote Overflow

Apache modrewrite Windows x86 - Off-by-One Remote Overflow !/bin/sh Exploit for Apache modrewrite off-by-oneWin32. by axis http://www.ph4nt0m.org 2007-04-06 Tested on Apache 2.0.58 Win32 Windows2003 CN SP1 Vulnerable Apache Versions: 1.3 branch: 1.3.28 and 2.0.46 and 2.2.0 and 2006-08-20...

Ethernet Device Drivers Frame Padding Info Leakage Exploit (Etherleak)

No description provided by source. !/usr/bin/perl -w etherleak, code that has been 5 years coming. On 04/27/2002, I disclosed on the Linux Kernel Mailing list, a vulnerability that would be come known as the 'etherleak' bug. In various situations an ethernet frame must be padded to reach a specif...

Linux Kernel 2.0.x2.2.x2.4.x (FreeBSD 4.x) - Network Device Driver Frame Padding Information Disclosure

Linux Kernel 2.0.x2.2.x2.4.x FreeBSD 4.x - Network Device Driver Frame Padding Information Disclosure source: https://www.securityfocus.com/bid/6535/info Network device drivers for several vendors have been reported to disclose potentially sensitive information to attackers. Frames that are small...

Ethernet Device Drivers Frame Padding - 'Etherleak' Infomation Leakage

!/usr/bin/perl -w etherleak, code that has been 5 years coming. On 04/27/2002, I disclosed on the Linux Kernel Mailing list, a vulnerability that would be come known as the 'etherleak' bug. In various situations an ethernet frame must be padded to reach a specific size or fall on a certain...

Linux Kernel 2.0.x/2.2.x/2.4.x (FreeBSD 4.x) - Network Device Driver Frame Padding Information Disclosure

source: https://www.securityfocus.com/bid/6535/info Network device drivers for several vendors have been reported to disclose potentially sensitive information to attackers. Frames that are smaller than the minimum frame size should have the unused portion of the frame buffer padded with null or...

CVE-2006-7140

The libike library, as used by in.iked, elfsign, and kcfd in Sun Solaris 9 and 10, when using an RSA key with exponent 3, removes PKCS-1 padding before generating a hash, which allows remote attackers to forge a PKCS 1 v1.5 signature that is signed by that RSA key and prevents libike from correct...

MailEnable Professional 2.35 Remote Buffer Overflow Exploit

No description provided by source. !/usr/bin/perl maildisable-v6.pl Mail Enable Professional =v2.35 win32 remote exploit by mu-b - Tue Dec 5 2006 - Tested on: Mail Enable Professional v2.35 win32 Note: timing is quite critical with this!!, so change $senddelay if it doesn't work...

maildisable-v6.pl.txt

!/usr/bin/perl maildisable-v6.pl Mail Enable Professional =v2.35 win32 remote exploit by mu-b - Tue Dec 5 2006 - Tested on: Mail Enable Professional v2.35 win32 Note: timing is quite critical with this!!, so change $senddelay if it doesn't work.... use Getopt::Std; getopts't:n:', %arg; use Socket...

MailEnable IMAPD Enterprise 2.32 < 2.34 - Remote Buffer Overflow

!/usr/bin/perl maildisable-v3.pl Mail Enable Professional/Enterprise v2.32-4 win32 remote exploit by mu-b - Thu Nov 23 2006 - Tested on: Mail Enable Professional v2.32 win32 - with HOTFIX Mail Enable Professional v2.33 win32 Mail Enable Professional v2.34 win32 what does this remind you off? Note...

MailEnable IMAPD Professional 2.35 - Remote Buffer Overflow

!/usr/bin/perl maildisable-v6.pl Mail Enable Professional =v2.35 win32 remote exploit by mu-b - Tue Dec 5 2006 - Tested on: Mail Enable Professional v2.35 win32 Note: timing is quite critical with this!!, so change $senddelay if it doesn't work.... use Getopt::Std; getopts't:n:', %arg; use Socket...

MailEnable Enterprise &lt;= 2.32 - 2.34 Remote Buffer Overflow Exploit

No description provided by source. !/usr/bin/perl maildisable-v3.pl Mail Enable Professional/Enterprise v2.32-4 win32 remote exploit by mu-b - Thu Nov 23 2006 - Tested on: Mail Enable Professional v2.32 win32 - with HOTFIX Mail Enable Professional v2.33 win32 Mail Enable Professional v2.34 win32...

openssl signature forgery

OpenSSL before 0.9.7, 0.9.7 before 0.9.7k, and 0.9.8 before 0.9.8c, when using an RSA key with exponent 3, removes PKCS-1 padding before generating a hash, which allows remote attackers to forge a PKCS 1 v1.5 signature that is signed by that RSA key and prevents OpenSSL from correctly verifying...

FreeBSD : openssl -- Incorrect PKCS#1 v1.5 padding validation in crypto(3) (077c2dca-8f9a-11db-ab33-000e0c2e438a)

Problem Description When verifying a PKCS1 v1.5 signature, OpenSSL ignores any bytes which follow the cryptographic hash being signed. In a valid signature there will be no such bytes. Impact OpenSSL will incorrectly report some invalid signatures as valid. When an RSA public exponent of 3 is use...

PHP Nop Generator

Generates harmless padding for PHP scripts This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework This class implements a "nop" generator for PHP payloads class MetasploitModule 'PHP Nop Generator', 'Alias' = 'phpgeneric',...