CVE-2004-1142

Ethereal 0.9.0 through 0.10.7 allows remote attackers to cause a denial of service CPU consumption via a certain malformed SMB packet...

ethereal -- multiple vulnerabilities

An Ethreal Security Advisories reports: Issues have been discovered in the following protocol dissectors: Matthew Bing discovered a bug in DICOM dissection that could make Ethereal crash. An invalid RTP timestamp could make Ethereal hang and create a large temporary file, possibly filling availab...

Shortcuts may insecurely store SMB authentication information

Overview SMB authentication information may be stored as plain text within URI shortcuts. As a result, a local attacker may be able read the authentication information and gain access to the share. Description SMB is a protocol for sharing data and resources between computers. Many operating...

CVE-2004-1171

KDE 3.2.x and 3.3.0 through 3.3.2, when saving credentials that are 1 manually entered by the user or 2 created by the SMB protocol handler, stores those credentials for plaintext in the user's .desktop file, which may be created with world-readable permissions, which could allow local users to...

CVE-2004-1171

KDE 3.2.x and 3.3.0–3.3.2 store saved credentials (entered by user or via SMB handler) in plaintext in the user’s .desktop file, which may be world-readable and allow local users to obtain usernames/passwords for remote resources (e.g., SMB shares). Affected components include KDE core libraries ...

Hydra: SMB

This plugin runs Hydra to find SMB accounts and passwords by brute force, using the smb2 module. To use this plugin, Hydra must be installed in the same machine as your scanner. To configure the a scan policy to use Hydra, go to 'Assessment Brute Force' and check the 'Always enable Hydra slow'...

KDE SMB share link cleartext password

SMB password is stored cleartext if desktop shortcut is created...

[Full-Disclosure] Password Disclosure for SMB Shares in KDE's Konqueror

------------------------------------------------------------------------- | Password Disclosure for SMB Shares in KDE's Konqueror | ------------------------------------------------------------------------- Date: Nov. 29, 2004 Author: Daniel Fabian Product: KDE, Konquerer Vendor: KDE e. V...

SecureCRT telnet URI Arbitrary Configuration Folder Remote Command Execution

The remote host is using a vulnerable version of SecureCRT, a SSH/Telnet client built for Microsoft Windows operation systems. It has been reported that SecureCRT does not safely check the protocol handler. As a result, an attacker may be able to exploit it by setting up a malicious SMB share. C...

CUPS stores user account details in plain text in log file

Overview When an SMB printer is configured, CUPS stores plain text login information to the log file. Description CUPS is a cross-platform printing system for UNIX environments. It can use the IPP, LPD, SMB, and JetDirect protocols to interact with printers. The SMB protocol is used to communicat...

[Full-Disclosure] Advisory 13/2004: Samba 3.x QFILEPATHINFO unicode filename buffer overflow

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 e-matters GmbH www.e-matters.de -= Security Advisory =- Advisory: Samba 3.x QFILEPATHINFO unicode filename buffer overflow Release Date: 2004/11/15 Last Modified: 2004/11/15 Author: Stefan Esser [email protected] Application: Samba 3 = 3.0.7...

CUPS: Leakage of sensitive information

Background The Common UNIX Printing System CUPS is a cross-platform print spooler. Description When printing to a SMB-shared printer requiring authentication, CUPS leaks the user name and password to a logfile. Impact A local user could gain knowledge of sensitive authentication data. Workaround...

RHEL 2.1 : samba (RHSA-2004:498)

Updated samba packages that fix an input validation vulnerability are now available. Samba provides file and printer sharing services to SMB/CIFS clients. Karol Wiesek discovered an input validation issue in Samba prior to 3.0.6. An authenticated user could send a carefully crafted request to the...

konqueror -- Password Disclosure for SMB Shares

When browsing SMB shares with Konqueror, shares with authentication show up with hidden password in the browser bar. It is possible to store the URL as a shortcut on the desktop where the password is then available in plain text...

Fedora Core 2 : cups-1.1.20-11.4 (2004-331)

This update fixes an information leakage problem when printing to SMB shares requiring authentication. The Common Vulnerabilities and Exposures project cve.mitre.org has assigned the name CVE-2004-0923 to this issue. Note that Tenable Network Security has extracted the preceding description block...

Debian DSA-374-1 : libpam-smb - buffer overflow

libpam-smb is a PAM authentication module which makes it possible to authenticate users against a password database managed by Samba or a Microsoft Windows server. If a long password is supplied, this can cause a buffer overflow which could be exploited to execute arbitrary code with the privileg...

CVE-2004-0829

The provided connected documents confirm CVE-2004-0829 is a DoS vulnerability in Samba prior to 2.2.11, where sending a FindNextPrintChangeNotify without a preceding FindFirstPrintChangeNotify can crash the daemon (as demonstrated by the Windows XP SP2 SMB client). Affected product: Samba (before...

Ethereal fails to properly handle malformed SMB packets

Overview Ethereal contains a vulnerability in the way it processes Server Message Block SMB packets. Description The Server Message Block SMB protocol is used for sharing files, printers, and other resources between computers. SMB is used in Microsoft Windows to provide file and print services...

CVE-2002-1534

Macromedia Flash Player contains a vulnerability where a remote attacker can read arbitrary files by manipulating XML script inside a .swf hosted on a remote SMB share. The issue arises from how the SWF processes XML data from an SMB-based source, enabling file read access without local interacti...

CVE-2002-1256

The SMB signing capability in the Server Message Block SMB protocol in Microsoft Windows 2000 and Windows XP allows attackers to disable the digital signing settings in an SMB session to force the data to be sent unsigned, then inject data into the session without detection, e.g. by modifying gro...