PaX 2.6 Kernel Patch - Denial of Service

PaX 2.6 Kernel Patch - Denial of Service / source: https://www.securityfocus.com/bid/10264/info PaX for 2.6 series Linux kernels has been reported prone to a local denial of service vulnerability. The issue is reported to present itself when PaX Address Space Layout Randomization Layout ASLR is...

CVE-2004-1983

The archgetunmappedarea function in mmap.c in the PaX patches for Linux kernel 2.6, when Address Space Layout Randomization ASLR is enabled, allows local users to cause a denial of service infinite loop via unknown attack vectors...

CVE-2004-0407

The HTML form upload capability in ColdFusion MX 6.1 does not reclaim disk space if an upload is interrupted, which allows remote attackers to cause a denial of service disk consumption by repeatedly uploading files and interrupting the uploads before they finish...

How to crash a harddisk - the Ipswitch WS_FTP Server way

Advisory Name: How to crash a harddisk - the Ipswitch WSFTP Server way Impact : Denial of Service Discovered by: Hugh Mann [email protected] Tested progs : Ipswitch WSFTP Server 4.0.2.EVAL Description It's possible for any user with write access to a directory, even when there's a limit to how...

xploit_dbg.cpp.txt

/ Discovered and coded Jan 25, 2004 Copyright C2004 [email protected] / include include typedef int NTSTATUS; define NTAPI stdcall const IA32SYSENTERCS = 0x174; const IA32SYSENTERESP = 0x175; const IA32SYSENTEREIP = 0x176; const SelCodeKernel = 0x8; const CmosIndx = 0x0E; // CMOS Diagnostic...

security flaw

Various routines for the ppc64 architecture on Linux kernel 2.6 prior to 2.6.2 and 2.4 prior to 2.4.24 do not use the copyfromuser function when copying data from userspace to kernelspace, which crosses security boundaries and allows local users to cause a denial of service...

Important: Red Hat Bug Fix Advisory: Updated kernel resolves 32-bit address space issue on AMD64

Updated kernel packages are now available that allow 32-bit compatibility-mode applications to utilize a larger address space on the AMD64 architecture. Updated 01 Dec 2003 Note: This errata also fixed a bug in the dobrk function, which has now been found to have security consequences: allowing a...

PT-2003-1958 · Sco · Open Unix +1

Name of the Vulnerable Software and Affected Versions: SCO UnixWare versions 7.1.1, 7.1.3 Open UNIX version 8.0.0 Description: The issue allows local users to bypass protections for the address space file for a process ID by obtaining a procfs file descriptor for the file and calling execve on a...

CVE-2003-0699

The C-Media PCI sound driver in Linux before 2.4.21 does not use the getuser function to access userspace, which crosses security boundaries and may facilitate the exploitation of vulnerabilities, a different vulnerability than CVE-2003-0700...

Ifenslave 0.0.7 - Argument Local Buffer Overflow (3)

Ifenslave 0.0.7 - Argument Local Buffer Overflow 3 // source: https://www.securityfocus.com/bid/7682/info ifenslave for Linux has been reported prone to a buffer overflow vulnerability. The issue is reportedly due to a lack of sufficient bounds checking performed on user-supplied data before it i...

Ifenslave 0.0.7 - Argument Local Buffer Overflow (2)

Ifenslave 0.0.7 - Argument Local Buffer Overflow 2 // source: https://www.securityfocus.com/bid/7682/info ifenslave for Linux has been reported prone to a buffer overflow vulnerability. The issue is reportedly due to a lack of sufficient bounds checking performed on user-supplied data before it i...

Maelstrom Server 3.0.x - Argument Buffer Overflow (3)

// source: https://www.securityfocus.com/bid/7630/info Maelstrom for Linux has been reported prone to a buffer overflow vulnerability. The issue is reportedly due to a lack of sufficient bounds checking performed on user-supplied data before it is copied into an internal memory space. It may be...

ScriptLogic sets insecure permissions on "LOGS$" share

Overview Version 4.01 of ScriptLogic contains a vulnerability in the default permissions assigned to the network share used for logging. Description The ScriptLogic product from ScriptLogic, Inc. provides remote system administration capabilities for Microsoft Windows systems in a domain...

DEBIAN-CVE-2002-1384

Integer overflow in pdftops, as used in Xpdf 2.01 and earlier, xpdf-i, and CUPS before 1.1.18, allows local users to execute arbitrary code via a ColorSpace entry with a large number of elements, as demonstrated by cups-pdf...

DEBIAN-CVE-2002-2016

User-mode Linux UML 2.4.17-8 does not restrict access to kernel address space, which allows local users to execute arbitrary code...

CVE-2002-2016

User-mode Linux UML 2.4.17-8 does not restrict access to kernel address space, which allows local users to execute arbitrary code...

Multiple Web Server Encoded Space (%20) Request ASP Source Disclosure

It appears possible to get the source code of the remote ASP scripts by appending a '%20' to the request. ASP source code usually contains sensitive information such as logins and passwords. This has been reported in Simple HTTPD shttpd, Mono XSP for ASP.NET and vWebServer. This type of request m...

Trend Micro Interscan VirusWall for Windows NT 3.52 - Space Gap Scan Bypass

Trend Micro Interscan VirusWall for Windows NT 3.52 - Space Gap Scan Bypass source: https://www.securityfocus.com/bid/5259/info A vulnerability has been reported in certain VirusWall versions. Reportedly, it is possible to bypass the scanning mechanism of VirusWall by adding extraneous spaces in...

CVE-2001-1248

CVE-2001-1248 affects vWebServer 1.2.0, enabling remote attackers to view arbitrary ASP scripts by requesting an ASP file that ends with a URL-encoded space (%20). The issue is classified as a information-disclosure vulnerability (CVSSv2 base score 5.0, AV:N/AC:L/Au:N/C:P/I:N/A:N); no exploit spe...

d_path() truncating excessive long path name vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Name: Linux kernel Version: up to 2.2.20 and 2.4.18 Homepage: http://www.kernel.org/ Author: Wojciech Purczynski [email protected] Date: March 26, 2002 Issue: ====== In case of excessively long path names dpath kernel internal function returns truncated...