Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow

/ rpcexp.c RPC LOCATOR Exploit Autor: Marcin Wolak mail: [email protected] Last update: 30 march 2003 / / About Compilation: What You need to compile rpcexp.c ? 1. MS Platform SDK August SDK is sufficient. 2. Compilator f.e. MS Visual C++ 6.0. rpcns4.lib is needed for linking. / / Usage You want to...

Sendmail < 8.12.9 NOCHAR Control Value prescan Overflow

The remote Sendmail server, according to its version number, may be vulnerable to a remote buffer overflow allowing remote users to gain root privileges. Sendmail versions from 5.79 to 8.12.8 are vulnerable. NOTE: manual patches do not change the version numbers. Vendors who have released patched...

Sun RPC XDR xdrmem_getbytes Function Remote Overflow

The RPC library has an integer overflow in the function xdrmemgetbytes. An attacker may use this flaw to execute arbitrary code on this host with the privileges your RPC programs are running with typically root, by sending a specially crafted request to them. Note that this issue affects Solaris,...

AIX lpd Multiple Functions Remote Overflow

The remote lpd daemon seems to be vulnerable to various buffer overflows in the functions sendstatus, killprint and chkfhost. Nessus solely relied on the version number of the remote operating system to issue this warning, so this might be a false positive C Tenable Network Security, Inc. This is...

Solaris mibiisa MIB Parsing Remote Overflow

The remote host is running mibiisa. There is a buffer overflow in older versions of this software, which may allow an attacker to gain a root shell on this host. Note that Nessus did not actually check for this vulnerability so this might be a false positive. C Tenable Network Security, Inc. XXXX...

ISC BIND < 9.2.2 DNS Resolver Functions Remote Overflow

The remote BIND 9 DNS server, according to its version number, is vulnerable to a buffer overflow which may allow an attacker to gain a shell on this host or to disable this server. C Tenable Network Security, Inc. Ref: https://www.isc.org/downloads/bind/...

Cyrus IMAP Server login Command Remote Overflow

According to its banner, the remote Cyrus IMAP server is vulnerable to a pre-login buffer overrun. An attacker without a valid login could exploit this, and would be able to execute arbitrary commands as the owner of the Cyrus process. This would allow full access to all users' mailboxes. This...

IBM WebSphere HTTP Request Header Remote Overflow

It was possible to kill the WebSphere server by sending an invalid request for a .jsp with a too long Host: header. An attacker may exploit this vulnerability to make your web server crash continually. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. References... From:"PeterGrundl"...

Null httpd Content-Length Header Handling Remote Overflow

The NullLogic Null HTTPd web server crashed when sent an invalid POST HTTP request with a negative Content-Length field. An attacker may exploit this flaw to disable your service or even execute arbitrary code on your system. C Tenable Network Security, Inc. References: Date: Sun, 22 Sep 2002...

Microsoft Data Access Components RDS Data Stub Remote Overflow

The remote DLL /msadc/msadcs.dll is accessible by anyone. Several flaws have been found in it in the past. We recommend that you restrict access to MSADC only to trusted hosts. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid11161; scriptversion "1.41";...

Multiple OS /bin/login Remote Overflow

The remote implementation of the /bin/login utility, used when authenticating a user via telnet or rsh contains an overflow which allows an attacker to gain a shell on this host, without even sending a shell code. An attacker may use this flaw to log in as any user except root on the remote host....

Web Server HTTP 1.1 Header Remote Overflow

It was possible to kill the web server by sending an invalid request with a too long HTTP 1.1 header Accept-Encoding, Accept-Language, Accept-Range, Connection, Expect, If-Match, If-None-Match, If-Range, If-Unmodified-Since, Max-Forwards, TE, Host. This vulnerability could be exploited to crash t...

Sambar Server Multiple CGI Remote Overflow

It is possible to kill the Sambar web server 'server.exe' by sending it a long request like: /cgi-win/testcgi.exe?XXXX...X /cgi-win/cgitest.exe?XXXX...X /cgi-win/Pbcgi.exe?XXXXX...X or maybe in /cgi-bin/ An attacker may use this flaw to cause the server to crash continuously. %NASLMINLEVEL 70300 ...

Web Server HTTP 1.0 Header Remote Overflow

It was possible to kill the web server by sending an invalid request with a too long HTTP 1.0 header From, If-Modified-Since, Referer or Content-Type. This vulnerability could be exploited to crash the web server. It might even be possible to execute arbitrary code on your system. As this is a...

MS02-045: Microsoft Windows SMB Protocol SMB_COM_TRANSACTION Packet Remote Overflow DoS (326830) (uncredentialed check)

The remote host is vulnerable to a denial of service attack in its SMB stack. An attacker may exploit this flaw to crash the remote host remotely, without any authentication. C Tenable Network Security, Inc. This script was written by Renaud Deraison Thanks to Ivan Arce who provided me with all t...

WS_FTP Server SITE CPWD Command Remote Overflow

This host is running a version of WSFTP FTP server prior to 3.1.2. Versions earlier than 3.1.2 contain an unchecked buffer in routines that handle the 'CPWD' command arguments. The 'CPWD' command allows remote users to change their password. By issuing a malformed argument to the CPWD command, a...

Web Server HTTP Header Handling Remote Overflow

It was possible to kill the web server by sending an invalid request with a long header name or value. A remote attacker may exploit this vulnerability to make the web server crash continually or even execute arbitrary code. C Tenable Network Security, Inc. include"compat.inc"; if description...

Web Server HTTP Method Handling Remote Overflow

It was possible to kill the web server by sending an invalid request with a long HTTP method field. A remote attacker may exploit this vulnerability to make the web server crash continually or possibly execute arbitrary code. C Tenable Network Security, Inc. Script audit and contributions from...

wwwoffle-2.7b and prior segfaults with negative Content-Length value

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 QITEST1 SECURITY ADVISORY 005 wwwoffle-2.7b and prior segfaults with negative Content-Length value PROGRAM DESCRIPTION WWWOFFLE, World Wide Web Offline Explorer, is a proxy HTTP/FTP server for computers with dial-up internet access. DETAILS When...

WU-IMAP 2000.287(1-2) - Remote Overflow

/ 7350owex- x86/linux WU-IMAP 2000.2871-2 remote exploit TESO CONFIDENTIAL - SOURCE MATERIALS This is unpublished proprietary source code of TESO Security. The contents of these coded instructions, statements and computer programs may not be disclosed to third parties, copied or duplicated in any...