@stake Advisory: PalmOS Password Retrieval and Decoding (A092600-1)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 @stake, Inc. www.atstake.com Security Advisory Advisory Name: PalmOS Password Retrieval and Decoding A092600-1 Release Date: 09/26/2000 Application: PalmOS 3.5.2 and below Platform: All PalmOS Platform Devices Severity: Moderate. Passwords can easily ...

CVE-2000-1008

PalmOS 3.5.2 and earlier uses weak encryption to store the user password, allowing attackers with physical access to decrypt the password and gain access to the device. The vulnerability affects the password storage mechanism and is exploitable only with local access; no exploit details or mitiga...

mandrake.urpmi.txt

Local Exploit Issue with: /usr/bin/urpmi The urpmi executable perl script root@localhost /root ls -al /usr/bin/urpmi -rwsr-x--- 1 root urpmi 9352 Apr 4 2000 /usr/bin/urpmi This requires an account in the urpmi group. Possibly physical access to the box as well. On Mandrake 7.1 the package urpmi w...

CVE-2000-0759

Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error message that includes the physical path...

CVE-2000-0710

The shtml.exe component of Microsoft FrontPage 2000 Server Extensions 1.1 allows remote attackers to determine the physical path of the server components by requesting an invalid URL whose name includes a standard DOS device name...

Palm OS 3.5.2 - Weak Encryption

source: https://www.securityfocus.com/bid/1715/info Palm OS is shipped with a security feature which enables a user to set password protection on various applications.The HotSync process allows a user to connect to a machine on the network through their Palm device. This process involves the devi...

CVE-2000-0759

Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error message that includes the physical path...

Xato Advisory: FrontPage DOS Device DoS

----------------------------------------------------------------------- Xato Network Security, Inc. www.xato.net Security Advisory XATO-082000-01 August 17, 2000 FRONTPAGE SERVER EXTENSIONS SHTML.EXE DENIAL OF SERVICE --DOS Device DoS--...

@stake iKey 1000 Security Advisory

@Stake Inc. L0pht Research Labs www.atstake.com www.L0pht.com Security Advisory Advisory Name: iKey 1000 Administrator Access and Data Compromise Release Date: July 20, 2000 Application: N/A Platform: Rainbow Technologies' iKey 1000 Severity: An attacker can login as administrator and access all...

Локальная уязвимость iKey

Мастер-ключ хранится в EPROM, может быть извлечен или подменен при наличии физического доступа к устройству...

CVE-2000-0427

CVE-2000-0427 affects the Aladdin Knowledge Systems eToken device. Attackers with physical access can reset the PIN in the device’s EEPROM , allowing access to sensitive information without the owner’s PIN. The provided documents do not specify affected models/firmware versions or any vendor-issu...

CVE-2000-0427

The Aladdin Knowledge Systems eToken device allows attackers with physical access to the device to obtain sensitive information without knowing the PIN of the owner by resetting the PIN in the EEPROM...

Aladdin eToken 3.3.3.x Hardware USB Key Private Data Extraction

@Stake Inc. L0pht Research Labs www.atstake.com www.L0pht.com Security Advisory Advisory Name: eToken Private Information Extraction and Physical Attack Release Date: May 4, 2000 Application: N/A Platform: Aladdin eToken USB Key 3.3.3.x Severity: An attacker can access all private information...

Проблемы с eToken

При наличии физического доступа к устройству возможно подменить PIN/ключ доступа путем перепрошивки EPROM...

CVE-2000-0427

The Aladdin Knowledge Systems eToken device allows attackers with physical access to the device to obtain sensitive information without knowing the PIN of the owner by resetting the PIN in the EEPROM...

Aladdin Knowledge Systems eToken 3.3.3 - eToken PIN Extraction

source: https://www.securityfocus.com/bid/1170/info Alladin Knowledge Systems eToken is a USB smartcard-like device used for authentication, file integrity, and encryption. Access to the eToken device itself and entering the PIN number encoded in the eToken will grant authorization to a local use...

CVE-1999-0593

Windows NT permits shutdown without authentication due to the Winlogon ShutdownWithoutLogon default setting. Affected: Windows NT; component: Winlogon registry entry ShutdownWithoutLogon. Root cause: default configuration. Impact: local shutdown without login (availability). No exploit details or...

CVE-1999-0593

The default setting for the Winlogon key entry ShutdownWithoutLogon in Windows NT allows users with physical access to shut down a Windows NT system without logging in...

CERN httpd Virtual Web Path Disclosure

The remote host appears to be running CERN httpd. It was possible to get the physical location of a virtual web directory by issuing the request : GET /cgi-bin/ls HTTP/1.0 A remote attacker could use this information to mount further attacks. C Tenable Network Security, Inc. include"compat.inc";...

CVE-1999-1452

GINA in Windows NT 4.0 allows attackers with physical access to display a portion of the clipboard of the user who has locked the workstation by pasting CTRL-V the contents into the username prompt...