Advisory CA-2002-20 Multiple Vulnerabilities in CDE ToolTalk

-----BEGIN PGP SIGNED MESSAGE----- CERT Advisory CA-2002-20 Multiple Vulnerabilities in CDE ToolTalk Original release date: July 10, 2002 Last revised: -- Source: CERT/CC A complete revision history can be found at the end of this file. Systems Affected Systems running CDE ToolTalk Overview Two...

Common Desktop Environment (CDE) ToolTalk RPC database server (rpc.ttdbserverd) does not adequately validate file descriptor arguement to _TT_ISCLOSE()

Overview The Common Desktop Environment CDE ToolTalk RPC database server does not adequately validate a client-supplied argument, allowing attackers to overwrite certain locations in memory with zeros. This vulnerability could be exploited in a number of ways, potentially allowing attackers to:...

Common Desktop Environment (CDE) ToolTalk RPC database server (rpc.ttdbserverd) does not adequately validate file operations

Overview The Common Desktop Environment CDE ToolTalk RPC database server does not adequately validate file operations and follows symbolic links, allowing a local attacker to overwrite any file that is writeable by the server. The ToolTalk RPC database server typically runs with root privileges...

CVE-2002-0573

Format string vulnerability in RPC wall daemon rpc.rwalld for Solaris 2.5.1 through 8 allows remote attackers to execute arbitrary code via format strings in a message that is not properly provided to the syslog function when the wall command cannot be executed...

CVE-2002-0359

xfsmd for IRIX 6.5 through 6.5.16 uses weak authentication, which allows remote attackers to call dangerous RPC functions, including those that can mount or unmount xfs file systems, to gain root privileges...

SGI IRIX 6.x - rpc.xfsmd Remote Command Execution

SGI IRIX 6.x - rpc.xfsmd Remote Command Execution // source: https://www.securityfocus.com/bid/5075/info Throghout the implementation of the supported remote procedure calls, the server uses the popen libc function. When popen is used, arguments passed to the RPC are included in the command strin...

tcpdump vulnerable to buffer overflow via improper decoding of AFS RPC (Rx) packets

Overview A vulnerability exists in tcpdump that could allow an attacker to execute arbitrary code with the privileges of tcpdump, typically root. Description tcpdump is a widely-used network sniffer that is capable of decoding AFS traffic. A buffer overflow vulnerability has been discovered in...

[LSD] Solaris cachefsd remote buffer overflow vulnerability

Solaris cachefsd remote buffer overflow vulnerability We would like to report another security vulnerability in the Solaris cachefsd program, which allows remote root access to the vulnerable system. The following information has been sent to Sun Microsystems some time ago, yet we have not receiv...

Solaris rpc.rwalld Remote Format String Arbitrary Code Execution

The rpc.walld RPC service is running. Some versions of this server allow an attacker to gain root access remotely, by consuming the resources of the remote host then sending a specially formed packet with format strings to this host. Solaris 2.5.1, 2.6, 7, 8 and 9 are vulnerable to this issue...

eSecurityOnline Security Advisory 4197 - Sun Solaris cachefsd den ial of service vulnerability

eSO Security Advisory: 4197 Discovery Date: October 29, 2001 ID: eSO:4197 Title: Sun Solaris cachefsd denial of service vulnerability Impact: Remote attackers can cause a denial of service condition Affected Technology: Solaris 2.6, 7, 8 SPARC and x86 Vendor Status: Vendor notified Discovered By:...

DCOM information leakage

Some RPC request may contain data from uninitialized memory...

CVE-2002-0039

CVE-2002-0039 affects SGI IRIX 6.5 (and older) where rpcbind is vulnerable to remote DoS via malformed RPC packets with invalid lengths, causing a crash. The issue is in the rpcbind/portmap handling and can be triggered remotely without local credentials. SGI released patches and fixes in IRIX 6....

IRIX rpc/HOSTALIASES vulnerability

-----BEGIN PGP SIGNED MESSAGE----- SGI Security Advisory Title: IRIX rpc/HOSTALIASES vulnerability Number: 20020306-01-P Date: March 28, 2002 Reference: CVE CAN-2002-0039 RPC Reference: CVE CAN-2002-0040 HOSTALIASES - ----------------------- - --- Issue Specifics --- - ----------------------- It'...

IRIX rpc/HOSTALIASES vulnerability

Malformed RPC packet can result DoS against system. Priveleged application can be overflowed by HOSTALIASES environment variable resulting to local privelege elevation...

CVE-2002-0039

rpcbind in SGI IRIX 6.5 through 6.5.15f, and possibly earlier versions, allows remote attackers to cause a denial of service crash via malformed RPC packets with invalid lengths...

CVE-2002-0085

cachefsd in Solaris 2.6, 7, and 8 allows remote attackers to cause a denial of service crash via an invalid procedure call in an RPC request...

CVE-2001-1124

CVE-2001-1124 affects HP-UXRpcbind on HP-UX 11.00, 11.04 and 11.11. The issue arises from malformed RPC portmap requests, potentially tied to a buffer overflow, and can cause a denial of service (core dump). The information in the connected OpenVAS entry points to an HP-UX update for rpcbind (HPS...

CVE-2001-0662

CVE-2001-0662 affects the RPC Endpoint Mapper in Windows NT 4.0. A remote attacker can cause a denial of service by sending a malformed request, leading to loss of RPC services. The vulnerability lies in the RPC service’s endpoint mapper; exploitation results in service disruption (no information...

CVE-2001-0662

RPC endpoint mapper in Windows NT 4.0 allows remote attackers to cause a denial of service loss of RPC services via a malformed request...

CVE-1999-1127

CVE-1999-1127 affects Windows NT 4.0. The vulnerability stems from improper handling of invalid named pipe RPC connections, leading to resource exhaustion and a denial of service when a remote attacker establishes a sequence of connections sending malformed data. The issue is tied to the shutdown...