HP Tru64 UNIX "ipcs" contains buffer overflow (SSRT0794U)

Overview The HP Tru64 UNIX implementation of "ipcs" contains a locally exploitable buffer overflow. Description "ipcs" is used to report inter-process communication status. A locally exploitable buffer overflow in "ipcs" may permit a local attacker to gain elevated privileges and execute arbitrar...

HP Tru64 UNIX "binmail" contains buffer overflow (SSRT0796U)

Overview The HP Tru64 UNIX implementation of "binmail" contains a locally exploitable buffer overflow. Description "binmail" is used to send and display mail messages. A locally exploitable buffer overflow in "binmail" may permit a local attacker to gain elevated privileges and execute arbitrary...

HP Tru64 UNIX "lpq" contains buffer overflow (SSRT2275)

Overview The HP Tru64 UNIX implementation of "lpq" contains a locally exploitable buffer overflow. Description "lpq" is used to examine the printer spool queue. A locally exploitable buffer overflow in "lpq" may permit a local attacker to gain elevated privileges and execute arbitrary code on a...

Multiple Vendor rpc.nisd Long NIS+ Argument Remote Overflow

The remote RPC service 100300 nisd is vulnerable to a buffer overflow attack that allows any user to obtain a root shell on this host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10251; scriptversion"1.28"; scriptcvsdate"Date: 2018/11/15 20:50:24";...

Microsoft Windows Server Message Block (SMB) fails to properly handle SMB_COM_TRANSACTION packets requesting NetServerEnum3 transaction

Overview Microsoft Server Message Block SMB may crash upon receipt of a crafted SMBCOMTRANSACTION packet requesting a NetServerEnum3 transaction. Attackers can use this vulnerability to cause a denial of service. Description SMB is a protocol for sharing data and resources between computers,...

Sendmail RestrictQueueRun Option Debug Mode Information Disclosure

According to the version number of the remote mail server, a local user may be able to obtain the complete mail configuration and other interesting information about the mail queue even if he is not allowed to access those information directly, by running sendmail -q -d0-nnnn.xxx where nnnn & xxx...

Microsoft Windows SQL Server allows arbitrary queries to be executed via "xp_execresultset" extended procedure

Overview MS SQL Server contains an extended stored procedure with inappropriate permission settings. Description Microsoft SQL Server 7.0 and Microsoft SQL Server 2000 contain an extended stored procedure, xpexecresultset , that permits an unprivileged user of a database to gain administrative...

Oracle Configurator discloses version and host information via "test" argument passed to servlet

Overview A servlet component of Oracle Configurator may post sensitive version and host information to any Web user that makes a crafted request to the server. Description Oracle Configurator is an Internet application used to configure Oracle Application and Database Servers. If a user sends a...

Microsoft IIS / Site Server codebrws.asp Arbitrary Source Disclosure

Microsoft's IIS 5.0 web server is shipped with a set of sample files to demonstrate different features of the ASP language. One of these sample files allows a remote user to view the source of any file in the web root with the extension .asp, .inc, .htm, or .html. %NASLMINLEVEL 70300 This script...

cqure.net.20020412.netware_client.a

cqure.net Security Vulnerability Report No: cqure.net.20020412.netwareclient.a ======================================== Vulnerability Summary --------------------- Problem: Multiple buffer overflow conditions exist in the Novell Netware client for Windows. Threat: An attacker could crash any...

OpenSSH Security Advisory (adv.token)

A buffer overflow exists in OpenSSH's sshd if sshd has been compiled with Kerberos/AFS support and KerberosTgtPassing or AFSTokenPassing has been enabled in the sshdconfig file. Ticket and token passing is not enabled by default. 1. Systems affected: All Versions of OpenSSH compiled with...

[SNS Advisory No.51] Compaq Tru64 UNIX libc Buffer Overflow Vulnerability

---------------------------------------------------------------------- SNS Advisory No.51 Compaq Tru64 UNIX libc Buffer Overflow Vulnerability Problem first discovered: Sun, 18 Nov 2001 Published: Thu, 17 Apr 2002 ---------------------------------------------------------------------- Overview:...

[SECURITY] [DSA 119-1] ssh channel bug

Package: openssh Vulnerability: local root exploit, remote client exploit Debian-specific: no Joost Pol [email protected] reports that OpenSSH versions 2.0 through 3.0.2 have an off-by-one bug in the channel allocation code. This vulnerability can be exploited by authenticated users to gain root...

OpenSSH 2.x/3.0.1/3.0.2 - Channel Code Off-by-One

source: https://www.securityfocus.com/bid/4241/info OpenSSH is a suite implementing the SSH protocol. It includes client and server software, and supports ssh and sftp. It was initially developed for BSD, but is also widely used for Linux, Solaris, and other UNIX-like operating systems. A...

[ Hackerslab bug_paper ] Xkas application vulnerability

============================================================================= Hackerslab bugpaper Xkas application vulnerability ============================================================================= File : /usr/etc/appletalk/xkas application SYSTEM : tested irix 6.5 INFO : Xkas is a serve...

SysV /bin/login Environment Remote Overflow (telnet check)

The remote /bin/login seems to crash when it receives too many environment variables. This is likely due to a buffer overflow vulnerability which might allow an attacker to execute arbitrary code on the remote host. C Tenable Network Security, Inc. Sun's patch makes /bin/login exits when it...

WS-FTP Server vulnerable to buffer overflow via long string sent as argument to ftp command

Overview A remotely exploitable buffer overflow exists in the IPSWITCH WSFTP Server. Description Defcom Labs has discovered a remotely exploitable buffer overflow vulnerability in the IPSWITCH WSFTP Server on all platforms that allows intruders to execute arbitrary code with the privileges of the...

BEA WebLogic Hex Encoded Request JSP Source Disclosure

The version of BEA WebLogic installed on the remote host may be tricked into revealing the source code of JSP scripts by using simple URL encoding of characters in the filename extension. %NASLMINLEVEL 70300 This script was written by Gregory Duchemin See the Nessus Scripts License for details...

Check Point RDP Bypass Vulnerability

Overview Check Point VPN-1/FireWall-1 version 4.0 & 4.1 may allow an intruder to pass traffic through the firewall on port 259. Description Firewall-1 and VPN-1 include support for RDP, but do not provide adequate security controls for RDP data. By adding a faked RDP header to typical UDP traffic...

Trend Micro InterScan VirusWall catinfo CGI Overflow

The remote cgi /catinfo seems to be vulnerable to a buffer overflow when it receives a too long input strings, allowing any user to execute arbitrary commands as root. This CGI usually comes with the VirusWall suite. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...