How to crash a harddisk - the Ipswitch WS_FTP Server way

Advisory Name: How to crash a harddisk - the Ipswitch WSFTP Server way Impact : Denial of Service Discovered by: Hugh Mann [email protected] Tested progs : Ipswitch WSFTP Server 4.0.2.EVAL Description It's possible for any user with write access to a directory, even when there's a limit to how...

xploit_dbg.cpp.txt

/ Discovered and coded Jan 25, 2004 Copyright C2004 [email protected] / include include typedef int NTSTATUS; define NTAPI stdcall const IA32SYSENTERCS = 0x174; const IA32SYSENTERESP = 0x175; const IA32SYSENTEREIP = 0x176; const SelCodeKernel = 0x8; const CmosIndx = 0x0E; // CMOS Diagnostic...

security flaw

Various routines for the ppc64 architecture on Linux kernel 2.6 prior to 2.6.2 and 2.4 prior to 2.4.24 do not use the copyfromuser function when copying data from userspace to kernelspace, which crosses security boundaries and allows local users to cause a denial of service...

CVE-2003-0984: Undefined Security Weakness

Real time clock RTC routines in Linux kernel 2.4.23 and earlier do not properly initialize their structures, which could leak kernel data to user space...

Important: Red Hat Bug Fix Advisory: Updated kernel resolves 32-bit address space issue on AMD64

Updated kernel packages are now available that allow 32-bit compatibility-mode applications to utilize a larger address space on the AMD64 architecture. Updated 01 Dec 2003 Note: This errata also fixed a bug in the dobrk function, which has now been found to have security consequences: allowing a...

PT-2003-1958 · Sco · Open Unix +1

Name of the Vulnerable Software and Affected Versions: SCO UnixWare versions 7.1.1, 7.1.3 Open UNIX version 8.0.0 Description: The issue allows local users to bypass protections for the address space file for a process ID by obtaining a procfs file descriptor for the file and calling execve on a...

CVE-2003-0937: Undefined Security Weakness

SCO UnixWare 7.1.1, 7.1.3, and Open UNIX 8.0.0 allows local users to bypass protections for the "as" address space file for a process ID PID by obtaining a procfs file descriptor for the file and calling execve on a setuid or setgid program, which leaves the descriptor open to the user...

CVE-2003-0699

The C-Media PCI sound driver in Linux before 2.4.21 does not use the getuser function to access userspace, which crosses security boundaries and may facilitate the exploitation of vulnerabilities, a different vulnerability than CVE-2003-0700...

Ifenslave 0.0.7 - Argument Local Buffer Overflow (2)

Ifenslave 0.0.7 - Argument Local Buffer Overflow 2 // source: https://www.securityfocus.com/bid/7682/info ifenslave for Linux has been reported prone to a buffer overflow vulnerability. The issue is reportedly due to a lack of sufficient bounds checking performed on user-supplied data before it i...

Ifenslave 0.0.7 - Argument Local Buffer Overflow (3)

Ifenslave 0.0.7 - Argument Local Buffer Overflow 3 // source: https://www.securityfocus.com/bid/7682/info ifenslave for Linux has been reported prone to a buffer overflow vulnerability. The issue is reportedly due to a lack of sufficient bounds checking performed on user-supplied data before it i...

Maelstrom Server 3.0.x - Argument Buffer Overflow (3)

// source: https://www.securityfocus.com/bid/7630/info Maelstrom for Linux has been reported prone to a buffer overflow vulnerability. The issue is reportedly due to a lack of sufficient bounds checking performed on user-supplied data before it is copied into an internal memory space. It may be...

ScriptLogic sets insecure permissions on "LOGS$" share

Overview Version 4.01 of ScriptLogic contains a vulnerability in the default permissions assigned to the network share used for logging. Description The ScriptLogic product from ScriptLogic, Inc. provides remote system administration capabilities for Microsoft Windows systems in a domain...

DEBIAN-CVE-2002-1384

Integer overflow in pdftops, as used in Xpdf 2.01 and earlier, xpdf-i, and CUPS before 1.1.18, allows local users to execute arbitrary code via a ColorSpace entry with a large number of elements, as demonstrated by cups-pdf...

DEBIAN-CVE-2002-2016

User-mode Linux UML 2.4.17-8 does not restrict access to kernel address space, which allows local users to execute arbitrary code...

CVE-2002-2016

User-mode Linux UML 2.4.17-8 does not restrict access to kernel address space, which allows local users to execute arbitrary code...

Multiple Web Server Encoded Space (%20) Request ASP Source Disclosure

It appears possible to get the source code of the remote ASP scripts by appending a '%20' to the request. ASP source code usually contains sensitive information such as logins and passwords. This has been reported in Simple HTTPD shttpd, Mono XSP for ASP.NET and vWebServer. This type of request m...

Trend Micro Interscan VirusWall for Windows NT 3.52 - Space Gap Scan Bypass

Trend Micro Interscan VirusWall for Windows NT 3.52 - Space Gap Scan Bypass source: https://www.securityfocus.com/bid/5259/info A vulnerability has been reported in certain VirusWall versions. Reportedly, it is possible to bypass the scanning mechanism of VirusWall by adding extraneous spaces in...

CVE-2002-0637: Undefined Security Weakness

InterScan VirusWall 3.52 build 1462 allows remote attackers to bypass virus protection via e-mail messages with headers that violate RFC specifications by having or missing space characters in unexpected places aka "space gap", such as 1 Content-Type :", 2 "Content-Transfer-Encoding :", 3 no spac...

CVE-2001-1248

CVE-2001-1248 affects vWebServer 1.2.0, enabling remote attackers to view arbitrary ASP scripts by requesting an ASP file that ends with a URL-encoded space (%20). The issue is classified as a information-disclosure vulnerability (CVSSv2 base score 5.0, AV:N/AC:L/Au:N/C:P/I:N/A:N); no exploit spe...

CVE-2001-1248: Undefined Security Weakness

vWebServer 1.2.0 allows remote attackers to view arbitrary ASP scripts via a request for an ASP script that ends with a URL-encoded space character %20...