[argv] BitchX-353 Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Mon Feb 17 15:26:06 EST 2003 1. Topic: BitchX IRC Client 2. Relevant versions: Vulnerable: BitchX-75p3 BitchX-1.0c16 BitchX-1.0c19 BitchX-1.0c20cvs Not Vulnerable: BitchX-1.0c18 3. Problem description: A denial of service vulnerability exists in BitchX. Sending ...

HPUX Wall Buffer Overflow

Hi all, after looking to check if this had been reported before I couldn't find anything, so here's my two cents: HPUX /usr/sbin/wall Buffer Overflow. bash-2.04$ ls -las /usr/sbin/wall 40 -r-xr-sr-x 1 bin tty 20480 Nov 7 1997 /usr/sbin/wall Wall on HPUX works in the following way: echo "Something...

CVE-2003-0037

CVE-2003-0037 affects the noffle offline news server (versions

Melange Chat Server 1.10 - Remote Buffer Overflow

/ Proof of Concept for Melange Chat Server 1.10 a lame remote bof exploit by innerphobia 12/24/02 Credits go to: - iDefense Labs for the advisory - blink for discovering the bug - Irian for the shellcode With careful calculation it is possible to control even the EIP, not just one byte of EIP...

SAP database local root via symlink

This local attack upon SAP is based on sapdb-server-linux-32bit-i386-73029.tgz it is currently unknown if this affects other SAP flavors. elguapo@rh8 pgm$ pwd /usr/sapdb/depend/pgm elguapo@rh8 pgm$ ls -al lserver -rwsrwxr-x 1 root sapdb 15673 Oct 22 10:42 lserver Using ltrace we can see an attemp...

TracerouteNG - never ending story

Hi everyone, I want to provide some additional information about the recently discovered traceroute-ng flaw. I decided to disclose to details right now because I do not believe that the flaw is easily exploitable. 1 The vulnerablilty. The patch provided by vendors like SuSE is not sufficient. It...

Buffer-overflow vulnerability in Midnight Commander

Overview The mcedit component of some versions of Midnight Commander contains a buffer-overflow vulnerability. Description Midnight Commander is a file manager for open source operating systems, distributed under the GNU General Public License GPL. In version 4.5.1 of Midnight Commander, the mced...

New advisory + exploit from LByte

+- Limpid Byte Advisory 003---------------------------------+ | | | Program: 2fax | | Version: all =2.02 | | OS: Linux/Windows | | Bug: Buffer Overflow in -bpcx option | | Homepage: http://www.atbas.org | | | | Discovered by Crazy Einstein [email protected] | | |...

How to reproduce OpenSSH Overflow.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The R7 team did a little investigating into one of the OpenSSH vulnerabilities. The following are instructions on how to reproduce a segmentation violation in sshd v3.2.3p1: 0. Compile with PAM and S/KEY support. 1. Apply the following patch to the ss...

Another flaw in Apache?

Hello. While playing with the SetEnv directive with Apache, I noticed that httpd processes are dying with a signal 11 if the data stored in an environment variable was too long. I simply triggered the bug by creating a .htaccess file so a regular user can do it with : SetEnv DATELOCALE "..." The...

solaris 9 sparc rcp

hallo, freshly installed solaris 9 sparc. one more suid segfault: bash-2.05$ uname -a SunOS solaris9 5.9 Generic sun4u sparc SUNW,Ultra-510 bash-2.05$ ls -l /usr/sbin/static/rcp -r-sr-xr-x 1 root bin 787700 Apr 6 16:58 /usr/sbin/static/rcp bash-2.05$ /usr/sbin/static/rcp perl -e 'print "A" x 1000...

procmail heap overflow

hi, i found a heap overflow in procmail up until latest some time ago. flatline@intra:/usr/bin$ ls -la procmail -rwsr-xr-x 1 root mail 64344 Jun 3 2001 procmail flatline@intra:/usr/bin$ ./procmail perl -e 'print "A"x10240'=A procmail: Exceeded LINEBUF Segmentation fault flatline@intra:/usr/bin$ a...

Interbase 6.0 malloc() issues

====================================================================== Strategic Reconnaissance Team Security Advisory SRT2002-06-17-1043 Topic : Interbase 6.0-1 Date : June 17, 2002 Credit : KF dotslashatsnosoft.com Site : http://www.snosoft.com...

ISS X-Force response

This vulnerability was originally detected auditing the Apache 2.0 source tree. Apache 2.0 uses the same function to determine the chunk size, and has the same vulnerable signed comparison. It is, however, not vulnerable by luck? due to a signed comparison deep within the buffered reading routine...

TRU64 /bin/chsh overflow

oops forgot one ... more soon. = /bin/chsh perl -e 'print "A" x 9000' Segmentation fault uname -a OSF1 alpha.snosoft.com V5.1 732 alpha ls -al /bin/chsh -rws--x--x 3 root bin 32944 Aug 24 2000 /bin/chsh dbx ./chsh core dbx version 5.1 Type 'help' for help. Core file created by program "chsh"...

Sar -o exploitation process info.

Caldera recently released an update for the suid sar binary. At one point in time someone pointed out that sar -f had an overflow Brok Tellier or k2 probably I can't remember. The -f overflow was fixed but the -o option which I have seen in private security advisorys floating around also had an...

Happy Easter / April Fools from Snosoft (Oracle 8.1.5 tnslsnr)

This is ment to be an April fools joke but if you still use old Oracle its not to funny I guess: After I ate a few too many hard boiled eggs this weekend I decided to install Oracle and play with it a little. Being poor I didn't have 800 bones to shell out on Oracle 16i so I had to settle with...

Progress Software suid overflows again.

Yet another b0f in progress software due to pstcopy Progress Software corp. http://www.progress.com STILL can't seem to validate user input... this is in their latest patch level for Progress 9.1C 91C09.tar.Z root@localhost bin cat ../version echo PROGRESS PATCH Version 9.1C09 as of February 26,...

compress(vul) + ftpd(?)

hyph@port $ rpm -qf which compress ncompress-4.2.4-21 hyph@port $ compress perl -e 'print "A" x 1100' AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA...

Censoft TERM Emu bOf

Vendor: www.censoft.com Product: TERM for UNIX / Linux Emulations Wyse 60, SCO ANSI, VT220 Terminal Supports SCO, AIX, HP, DEC, Solaris Operating Environmenttm software, and Linuxtm I WAS going to purchase this product after trying the eval however I changed my mind for some reason...I would...