hhp's Expect advisory/exploit/patch.

------------------------------------------------------------------------------- hhp adv-17 Sec-Advisory/Exploit/Patch www.hhp-programming.net ------------------------------------------------------------------------------- Topic: Expect. Versions: 5.31.8 and 5.28.1, maybe others. Date: 12/12/2000...

ssldump 0.9 b1 - Format String

ssldump 0.9 b1 - Format String source: https://www.securityfocus.com/bid/2096/info ssldump is a traffic analyzer for monitoring network traffic in real time. It is written and maintained by Eric Rescorla. A problem exists which could allow the arbitrary execution of code. The problem exists in th...

Nokia firewalls

Hi, Well I just unwrapped my shiny new Nokia IP440 integrated Firewall-1/IDS appliance and thought to give it a once over. It appears to be a older fBSD kernel + some firewall checkpoint 4.1 + some IDS ISS + remote admin SSH/http. Now these vulnerabilities all require an authenticated user,...

DoS possibility in syslog-ng

BalaBit security advisory Advisory ID: BB-2000/01 Package: syslog-ng Versions affected: versions prior to and including 1.4.8 Problem type: remote DoS attack Date: 2000-11-22 1 Background syslog-ng is a portable syslog implementation. Its highlights include regexp based log selection, TCP transpo...

quakeworldex.txt

tested on qwsv-2.30-glibc-i386-unknown-linux2.0 The Quakeworld server unix rcon feature contains a buffer overflow which crashes the server, segfaults and core dumps. There are a bunch of different quakeworld servers out, picking a different one would probably be a good idea. RCONEX by...

Ntop -w remote exploit

Problem: ntop has a stack-based BOF when it's requested too long filename. 2. Tested Version ntop-1.2a1 I only tested this version. 3. Example 1. first run ntop -w 8080 2. run this script $ printf "GET /perl -e 'print "A"x240'rnrn" |nc localhost 8080 3. the ntop goes seg. fault. $ ntop -w 8080...

Ntop -w remote exploit

Problem: ntop has a stack-based BOF when it's requested too long filename. 2. Tested Version ntop-1.2a1 I only tested this version. 3. Example 1. first run ntop -w 8080 2. run this script $ printf "GET /perl -e 'print "A"x240'rnrn" |nc localhost 8080 3. the ntop goes seg. fault. $ ntop -w 8080...

Possible remote vulnerability problem in TIS FWTK x-gw?

Hello all, I got around to checking out TIS FWTK for format string problems. It's a free-for-non-commercials firewall proxy package. The sources etc. can be obtained from http://www.tis.com/research/software/fwtkreadme.html. Tried to contact [email protected], mail bounced. Oh well. This is usuall...

Security bugs in nokia voyager, BO dev.

Voyager works with a multipurposes cgi called htmlpage that make a call to htmlgen with a filename as a template script. Htmlgen produce the final html page returned by apache. if u test this kind of url:...

Very interesting traceroute flaw

Hi, CREDIT ====== I'm starting with a credit section because I did not discover this flaw. The flaw was discovered by Pekka Savola [email protected], who noted that traceroute could be caused to crash, which is pretty suboptimal behaviour for a suid-root program :- I took this forward and specula...

SEGFAULTING Interbase 6 SS Linux

Hi Doodz, while doing some coding i found out a serious bug in Interbase 6 SuperServer for Linux final Version. If you hand a server a query with 0 bytes, it will say goodbye with a nice SEGFAULT. My test-environment is: SuSE Linux 6.4, Kernel 2.2.14, IB6SS. regards, mephisto/pandora...

[ Hackerslab bug_paper ] HP-UX bdf -t option buffer overflow vul.

================================================================================ Hackerslab bugpaper HP-UX bdf -t option buffer overflow vul ================================================================================ File : /usr/bin/bdf SYSTEM : HP-UX 11.00 Tested by HP-UX B.11.00 INFO : bdf...

Problems with: xcdroast, gatos, xkobo, xbill, iagno, ++

---------------------------------------------------------------- - A result of too much time - [email protected] anno 2000 - ---------------------------------------------------------------- xcdroast Version 0.96e ======================== Comes with Mandrake 7.0, others? I am not sure about...

gnapster dos(?)

Hello, Can anyone else verify this :- Gnapster Version : 1.3.9 & 1.3.10 Host: FreeBSD 4.0-Release, x86 first we do gdb run Starting program: /usr/local/bin/gnapster meanwhile .... yes "GET AAAAAAAAA...MANY As....." | nc localgnapsterlisteningport result.... Program received signal SIGSEGV,...

Kmail heap overflow

Hi When a letter sent to a kmail user has an attachment with long about 250 bytes long filename, kmail 1.0.28 segfaults. EIP does NOT get overwritten, only EAX. Dear gurus, is it exploitable? : Byez -- Lez [email protected] http://w3.swi.hu/lezli...

imapd4r1 v12.264

Newest RH: OK nimue IMAP4rev1 v12.264 server ready 1 login lcamtuf test 1 OK LOGIN completed 1 list "" AAAAAAAAAAAAAAAAAAAAAAAAAAA...yes, a lot of 'A's ; Program received signal SIGSEGV, Segmentation fault. 0x41414141 in ?? sigh Privledges seems to be dropped, but, anyway, it's nice way to get...

tcsh.6.07.bof.txt

Date: Mon, 17 May 1999 09:53:19 +0200 From: arkth To: [email protected] Subject: tcsh overflow While few days ago there was discussion about bash overflow on bugtraq i found another overflow in tcsh-6.07.09-1 rh 5.2 . The problem is in too long $HOME evironment variable very old thing - zgv...

CGIc-DoS.txt

CGIc Library is vulnerable to a buffer overflow attack CGIc, an ANSI C-language library for creating CGI based World Wide Web applications, is vulnerable to a buffer overflow which may be used by a malicious user to gain root access. Thomas Boutell's CGIc library version 1.05 can be attacked usin...

lynx-2.8.x-BOF.txt

Date: Sun, 6 Sep 1998 00:53:24 +0200 From: Michal Zalewski To: [email protected] Subject: Sendmail, lynx, Netscape, sshd, Linux kernel twice Bugs in lynx 2.8.x including latest development versions: ----------------------------------------------------------- Trivial overflows in protocol...

sun.5.6.lpset.txt

Date: Tue, 11 May 1999 11:43:46 +0900 From: kim yong-jun homepage=ce.hannam.ac.kr/s96192 To: [email protected] Subject: SunOS 5.6 X86 lpset vulnerability This is my second post to ButTraq. If this is old, I'm sorry. It's buffer overflow in "/usr/bin/lpset". View this command : loveyou@/ %...