955 matches found
yaSSL多个远程溢出及无效内存访问漏洞
BUGTRAQ ID: 27140 yaSSL是用于实现SSL的开源软件包。 yaSSL实现上存在多个远程溢出及无效内存访问问题，远程攻击者可能利用此漏洞控制服务器。 ------------------------------------------- A ProcessOldClientHello缓冲区溢出 ------------------------------------------- 用于包含客户端所接收的Hello报文中的数据的缓冲区结构如下（源自yasslimp.hpp）： class ClientHello : public HandShakeBase...
AOL YGPPicEdit.dll ActiveX控件多个远程溢出漏洞
BUGTRAQ ID: 27026 YGPPicEdit.dll是AOL产品所安装的图形编辑ActiveX控件。 YGPPicEdit.dll没有正确地验证多个属性的参数，如果用户受骗打开了恶意网页的话，就可能触发缓冲区溢出，导致执行任意指令。 AOL YGPPicEdit.dll 9.5.1.8 厂商补丁： AOL --- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.aol.com/ html head script language="JavaScript" DEFER function Check var s...
PeerCast < 0.1218 servhs.cpp handShakeHTTP Function Remote Overflow
Binary data 4318.prm...
CUPS < 1.3.5 Back End SNMP Response Remote Overflow
Binary data 4320.prm...
WFTPD Explorer Pro 1.0 - Remote Heap Overflow (PoC)
WftpdExpProHeapPoC.py Discovered by r4x Kamil Szczerba [email protected] Soft : WFTPD Explorer Pro 1.0 Vendor : Texas Imperial Software Vuln : Heap Overwlow Res: LIST Exploit : PoC Reg Overwrite Reg: EAX = 41414141 ECX = 41414141 EDX = 00a57b38 ASCII "AAAA..." ESI = 00a57b30 ASCII "AAAA..."...
Microsoft Windows FTP客户端多个远程溢出漏洞
Microsoft Windows是微软发布的非常流行的操作系统。 Windows系统自带的FTP客户端实现上存在缓冲区溢出漏洞，远程攻击者可能利用此漏洞控制客户端。 Windows操作系统所捆绑的FTP客户端没有正确地验证mget、dir、user、password、ls等命令，如果用户使用FTP客户端连接到了FTP服务器上带有超长文件夹名或文件名的目录并发布了上述命令的话，就可以触发缓冲区溢出，导致拒绝服务或执行任意指令。但这个漏洞较难利用，因为需要社会工程学且必须以有漏洞命令参数的形式注入shellcode。 Microsoft Windows XP Microsoft Windo...
Samba NMBD登录请求远程溢出漏洞
BUGTRAQ ID: 26454 CVECAN ID: CVE-2007-4572 Samba是一套实现SMB（Server Messages Block）协议、跨平台进行文件共享和打印共享服务的程序。 Samba的nmbd在处理GETDC登录服务器请求时存在缓冲器溢出漏洞，可能导致非预期的服务器行为。 如果远程攻击者发送了畸形的GETDC请求的话就可以触发这个漏洞，但无法利用这个溢出执行任意指令，在大多数情况下也不会导致Samba服务器崩溃。仅在将Samba服务器配置为主或备份域控制器时才会出现这个漏洞。 Samba 3.0.0 - 3.0.26a 临时解决方法：...
GOM Player 2.1.6.3499 (GomWeb3.dll 1.0.0.12) Remote Overflow Exploit
Exploit for unknown platform in category remote exploits ==================================================================== GOM Player 2.1.6.3499 GomWeb3.dll 1.0.0.12 Remote Overflow Exploit ==================================================================== //open calc.exe scode =...
GOM Player 2.1.6.3499 (GomWeb3.dll 1.0.0.12) Remote Overflow Exploit
No description provided by source. !-- GOM Player 2.1.6.3499 GomWeb Control GomWeb3.dll 1.0.0.12 remote buffer overflow poc exploit ie6/xp sp2 quote from Wikipedia: "GOM PlayerGretech Online Movie Player is South Korea's most popular media player; as of July 2007, it had 8.4 million users,...
eXtremail <= 2.1.1 Remote Heap Overflow PoC
No description provided by source. !/usr/bin/perl extremail-v8.pl Copyright c 2007 by [email protected] eXtremail =2.1.1 remote PoC by mu-b - Wed Jan 31 2007 Tested on: eXtremail 2.1.1 lnx eXtremail 2.1.0 lnx - Private Source Code -DO NOT DISTRIBUTE -...
DriveLock DriveLock.exe HTTP Request Processing Remote Overflow
DriveLock, an application for controlling access to computer devices, is installed on the remote host. According to its version, the DriveLock Agent component, which acts as a web server, on the remote host fails to properly handle long HTTP requests. An unauthenticated, remote attacker may be ab...
FSD 2.052/3.000 - 'sysuser.cc sysuser::exechelp' 'HELP' Remote Overflow
source: https://www.securityfocus.com/bid/25883/info FSD is prone to multiple remote buffer-overflow vulnerabilities because the application fails to perform adequate boundary-checks on user-supplied data. An attacker can exploit these issues to execute arbitrary code within the context of the...
HP - ActiveX 'hpqutil.dll' ListFiles Remote Heap Overflow (PoC)
:. GOODFELLAS Security Research TEAM .: :. http://goodfellas.shellcode.com.ar .: ActiveX hpqutil!ListFiles hpqutil.dll - Remote heap overflow. ============================================================= Internal ID: VULWAR200706041 introduction ------------ GOODFELLAS security research team has...
PPStream (PowerPlayer.dll 2.0.1.3829) Activex Remote Overflow Exploit-vulnerability warning-the black bar safety net
Source: milw0rm // author: dummy // written by [email protected] 2 0 0 7 define CRTSECURENODEPRECATE include windows. h include stdio. h const unsigned char shellcode1 7 4 = 0xE8, 0x00, 0x00, 0x00, 0x00, 0x6A, 0x03, 0xEB, 0x21, 0x7E, 0xD8, 0xE2, 0x73, 0x98, 0xFE, 0x8A, 0x0E, 0x8E, 0x4E, 0x0E, 0xEC,...
PPStream (PowerPlayer.dll 2.0.1.3829) Activex Remote Overflow Exploit
No description provided by source. // author: dummy // written by [email protected] 2007 define CRTSECURENODEPRECATE include windows.h include stdio.h const unsigned char shellcode174 = 0xE8, 0x00, 0x00, 0x00, 0x00, 0x6A, 0x03, 0xEB, 0x21, 0x7E, 0xD8, 0xE2, 0x73, 0x98, 0xFE, 0x8A, ...
PPStream (PowerPlayer.dll 2.0.1.3829) Activex Remote Overflow Exploit
Exploit for unknown platform in category remote exploits ===================================================================== PPStream PowerPlayer.dll 2.0.1.3829 Activex Remote Overflow Exploit ===================================================================== // author: dummy // written by...
Hexamail Server 3.0.0.001 (pop3) pre-auth Remote Overflow PoC
No description provided by source. ?php / Hexamail Server 3.0.0.001 pop3 pre-auth remote overflow poc by rgod http://retrogod.altervista.org tested against the Lite one this one crashes the entire server you are in control of eax and ecx, I think arbitrary code execution is possible but a little...
PPStream - PowerPlayer.dll 2.0.1.3829 ActiveX Remote Overflow
PPStream - PowerPlayer.dll 2.0.1.3829 ActiveX Remote Overflow // author: dummy // written by [email protected] 2007 define CRTSECURENODEPRECATE include include const unsigned char shellcode174 = 0xE8, 0x00, 0x00, 0x00, 0x00, 0x6A, 0x03, 0xEB, 0x21, 0x7E, 0xD8, 0xE2, 0x73, 0x98, 0xFE, 0x8A, 0x0E, 0x8...
PPStream - 'PowerPlayer.dll 2.0.1.3829' ActiveX Remote Overflow
// author: dummy // written by [email protected] 2007 define CRTSECURENODEPRECATE include include const unsigned char shellcode174 = 0xE8, 0x00, 0x00, 0x00, 0x00, 0x6A, 0x03, 0xEB, 0x21, 0x7E, 0xD8, 0xE2, 0x73, 0x98, 0xFE, 0x8A, 0x0E, 0x8E, 0x4E, 0x0E, 0xEC, 0x55, 0x52, 0x4C, 0x4D, 0x4F, 0x4E, 0x00,...