Nokia firewalls

Hi, Well I just unwrapped my shiny new Nokia IP440 integrated Firewall-1/IDS appliance and thought to give it a once over. It appears to be a older fBSD kernel + some firewall checkpoint 4.1 + some IDS ISS + remote admin SSH/http. Now these vulnerabilities all require an authenticated user,...

DoS possibility in syslog-ng

BalaBit security advisory Advisory ID: BB-2000/01 Package: syslog-ng Versions affected: versions prior to and including 1.4.8 Problem type: remote DoS attack Date: 2000-11-22 1 Background syslog-ng is a portable syslog implementation. Its highlights include regexp based log selection, TCP transpo...

quakeworldex.txt

tested on qwsv-2.30-glibc-i386-unknown-linux2.0 The Quakeworld server unix rcon feature contains a buffer overflow which crashes the server, segfaults and core dumps. There are a bunch of different quakeworld servers out, picking a different one would probably be a good idea. RCONEX by...

Ntop -w remote exploit

Problem: ntop has a stack-based BOF when it's requested too long filename. 2. Tested Version ntop-1.2a1 I only tested this version. 3. Example 1. first run ntop -w 8080 2. run this script $ printf "GET /perl -e 'print "A"x240'rnrn" |nc localhost 8080 3. the ntop goes seg. fault. $ ntop -w 8080...

Ntop -w remote exploit

Problem: ntop has a stack-based BOF when it's requested too long filename. 2. Tested Version ntop-1.2a1 I only tested this version. 3. Example 1. first run ntop -w 8080 2. run this script $ printf "GET /perl -e 'print "A"x240'rnrn" |nc localhost 8080 3. the ntop goes seg. fault. $ ntop -w 8080...

Possible remote vulnerability problem in TIS FWTK x-gw?

Hello all, I got around to checking out TIS FWTK for format string problems. It's a free-for-non-commercials firewall proxy package. The sources etc. can be obtained from http://www.tis.com/research/software/fwtkreadme.html. Tried to contact [email protected], mail bounced. Oh well. This is usuall...

Security bugs in nokia voyager, BO dev.

Voyager works with a multipurposes cgi called htmlpage that make a call to htmlgen with a filename as a template script. Htmlgen produce the final html page returned by apache. if u test this kind of url:...

Very interesting traceroute flaw

Hi, CREDIT ====== I'm starting with a credit section because I did not discover this flaw. The flaw was discovered by Pekka Savola [email protected], who noted that traceroute could be caused to crash, which is pretty suboptimal behaviour for a suid-root program :- I took this forward and specula...

SEGFAULTING Interbase 6 SS Linux

Hi Doodz, while doing some coding i found out a serious bug in Interbase 6 SuperServer for Linux final Version. If you hand a server a query with 0 bytes, it will say goodbye with a nice SEGFAULT. My test-environment is: SuSE Linux 6.4, Kernel 2.2.14, IB6SS. regards, mephisto/pandora...

[ Hackerslab bug_paper ] HP-UX bdf -t option buffer overflow vul.

================================================================================ Hackerslab bugpaper HP-UX bdf -t option buffer overflow vul ================================================================================ File : /usr/bin/bdf SYSTEM : HP-UX 11.00 Tested by HP-UX B.11.00 INFO : bdf...

Problems with: xcdroast, gatos, xkobo, xbill, iagno, ++

---------------------------------------------------------------- - A result of too much time - [email protected] anno 2000 - ---------------------------------------------------------------- xcdroast Version 0.96e ======================== Comes with Mandrake 7.0, others? I am not sure about...

gnapster dos(?)

Hello, Can anyone else verify this :- Gnapster Version : 1.3.9 & 1.3.10 Host: FreeBSD 4.0-Release, x86 first we do gdb run Starting program: /usr/local/bin/gnapster meanwhile .... yes "GET AAAAAAAAA...MANY As....." | nc localgnapsterlisteningport result.... Program received signal SIGSEGV,...

Kmail heap overflow

Hi When a letter sent to a kmail user has an attachment with long about 250 bytes long filename, kmail 1.0.28 segfaults. EIP does NOT get overwritten, only EAX. Dear gurus, is it exploitable? : Byez -- Lez [email protected] http://w3.swi.hu/lezli...

imapd4r1 v12.264

Newest RH: OK nimue IMAP4rev1 v12.264 server ready 1 login lcamtuf test 1 OK LOGIN completed 1 list "" AAAAAAAAAAAAAAAAAAAAAAAAAAA...yes, a lot of 'A's ; Program received signal SIGSEGV, Segmentation fault. 0x41414141 in ?? sigh Privledges seems to be dropped, but, anyway, it's nice way to get...

espernet-irc.txt

Date: Fri, 24 Jul 1998 19:05:35 -0500 From: McClain Looney Subject: espernet irc services I didn't think anyone cared about irc, but seeing the mIRC posts on this list, here goes: Espernet irc services below version 3.3.5 are vulnerable to a bug in the add/remove code for chanserv which causes a...

lynx-2.8.x-BOF.txt

Date: Sun, 6 Sep 1998 00:53:24 +0200 From: Michal Zalewski To: [email protected] Subject: Sendmail, lynx, Netscape, sshd, Linux kernel twice Bugs in lynx 2.8.x including latest development versions: ----------------------------------------------------------- Trivial overflows in protocol...

ftpd.locate.findutils.txt

Date: Fri, 30 Apr 1999 11:07:20 +0300 From: Sergey V. Kolychev To: [email protected] Subject: Buffer overflow in ftpd and locate bug Hi. I had problem with locate from findutils-4.1.24.rpm from Redhat-5.1 It segfaults if we have huge directory at incoming ftp which created by exploits for ftpd...

sun.5.6.lpset.txt

Date: Tue, 11 May 1999 11:43:46 +0900 From: kim yong-jun homepage=ce.hannam.ac.kr/s96192 To: [email protected] Subject: SunOS 5.6 X86 lpset vulnerability This is my second post to ButTraq. If this is old, I'm sorry. It's buffer overflow in "/usr/bin/lpset". View this command : loveyou@/ %...

SDI.03-99.iss-scanner.txt

Sekure SDI http://www.sekure.org --------------------------- Brazilian Information Security Team - Internet Scanner Buffer Overflow - SDI.03-99.iss-scanner --- complexity : medium critical level : medium --- 1. Introduction Internet Scanner I.S is a wide known tool to audit the security level of ...

irc.services.DoS.txt

Date: Thu, 22 Apr 1999 22:53:42 EDT From: Andy Church To: [email protected] Subject: Bug in Services for IRC Networks 4.2.2 A bug has been found in versions through 4.2.2 of Services for IRC Networks which allows any IRC user to crash the program. The channel service's SET SUCCESSOR command do...