Microsoft Windows NT 4.0/SP1/SP2/SP3/SP4/SP5 - RASMAN Privilege Escalation

source: https://www.securityfocus.com/bid/645/info Any authenticated NT user ie domain user can modify the pathname for the RASMAN binary in the Registry. The next time the RAS Service is started, the trojan service referenced by the RASMAN pathname will be executed with system privileges. This...

nt.case.symbolic.txt

Date: Fri, 12 Mar 1999 13:03:57 -0700 From: Mark To: [email protected] Subject: ALERT Case Sensitivity and Symbolic Links Prasad Dabak of Cybermedia Software Private Limited has discovered yet another security risk in Windows NT involving the operating system's case sensitivity...

retina.vs.iis4-round2-the.exploit.txt

http://www.eeye.com/database/advisories/ad06081999/ad06081999-exploit.html Retina vs. IIS4, Round 2 - The Exploit We contemplated releasing this exploit and decided to do it. Here Is Why. We are a full disclosure security team, and we were not working under any non disclosure agreements with...

adobe.acrobat.netbus.trojan.txt

Date:Tue, 6 Apr 1999 07:41:06 -0600 Reply-To:"Wamsley, James R" Sender:Windows NT BugTraq Mailing List From:"Wamsley, James R" Subject:Adobe put Trojan horse in Acrobat. Comments:To: "[email protected]" Comments:cc: "Samos, Randy B." We recently found an alarming problem with Adobe's...

tcp_wrappers-CERT.txt

Date: Fri, 22 Jan 1999 20:12:36 -0500 From: Eric To: [email protected] Subject: CERT Advisory CA-99.01 - TCP Wrappers Trojan Horse fwd Date: Fri, 22 Jan 1999 16:42:00 -0500 Message-Id: From: CERT Advisory To: [email protected] Subject: CERT Advisory CA-99.01 - TCP Wrappers Trojan Hor...

promail.1.21.trojan.txt

Date: Fri, 19 Mar 1999 09:41:18 +0100 From: Aeon Labs To: [email protected] Subject: security/privacy news Perhaps this might be of interest to Your readers. ProMail v1.21, an advanced freeware mail program spread through several worldwide distribution networks SimTel.net, Shareware.co...

ie0199.exe-trojan.txt

Date: Thu, 28 Jan 1999 20:12:39 -0500 From: Mark E. Duck To: [email protected] Subject: E-mailed Trojan There is a trojan horse circulating the Internet as an attachment in email with a spoofed email address of Microsoft Corporation. It contains an announcement and an attachment that is...

trojan-backdoor-ftp.win.tue.nl.txt

Date: Sun, 24 Jan 1999 09:03:42 -0500 From: Trevor Johnson To: [email protected] Subject: Re: util-linux compromised I just received the following letter: Date: Sun, 24 Jan 1999 04:01:55 -0500 EST From: John Stange Subject: util-linux compromised? I grabbed util-linux-2.9g yesterday from...

Microsoft Windows NT 4.0SP 1SP 2Sp 3SP 4SP 5 - Malformed Dialer Entry

Microsoft Windows NT 4.0SP 1SP 2Sp 3SP 4SP 5 - Malformed Dialer Entry // source: https://www.securityfocus.com/bid/554/info Dialer.exe has an unchecked buffer in the part of the program that reads dialer entries from %systemroot%\dialer.ini. A specially-formed entry could cause arbitrary code to ...

BackOrifice Software Detection

The remote host seems to be running BackOrifice 1.x with no password. BackOrifice is a trojan which allows an intruder to take control of the remote computer. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid10024;...

Portal of Doom Backdoor Detection

Portal of Doom is installed. This backdoor allows anyone to partially take the control of the remote system. An attacker may use it to steal your password or prevent your from working properly. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

NetSphere Backdoor Detection

The NetSphere backdoor is installed on the remote host. By connecting to it, a remote attacker can gain control of the affected system. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid10005; scriptversion"$Revision: 1.26 $"; scriptcvsdate"$Date: 2015/10/21 20:34:20 $";...

CVE-1999-1365

Windows NT searches a user's home directory %systemroot% by default before other directories to find critical programs such as NDDEAGNT.EXE, EXPLORER.EXE, USERINIT.EXE or TASKMGR.EXE, which could allow local users to bypass access restrictions or gain privileges by placing a Trojan horse program...

CVE-1999-1019

SpectroSERVER in Cabletron Spectrum Enterprise Manager 5.0 installs a directory tree with insecure permissions, which allows local users to replace a privileged executable processd with a Trojan horse, facilitating a root or Administrator compromise...

Finger Backdoor Detection

The remote finger daemon seems to be a backdoor, as it seems to react to the request : cmdrootsh@target If a root shell has been installed as /tmp/.sh, then this finger daemon is definitely a trojan, and this system has been compromised. C Tenable Network Security, Inc. include"compat.inc"; if...

Microsoft Windows NT 4.04.0 SP14.0 SP24.0 SP34.0 SP4 - Server Operator to Administrator Privilege Escalation: System Key

Microsoft Windows NT 4.04.0 SP14.0 SP24.0 SP34.0 SP4 - Server Operator to Administrator Privilege Escalation: System Key // source: https://www.securityfocus.com/bid/182/info The default ACL over the HKEYLocalMachine\Software\Microsoft\Windows NT\CurrentVersion\Winlogon key "System" value include...

Microsoft Windows NT 4.0/4.0 SP1/4.0 SP2/4.0 SP3/4.0 SP4 - Server Operator to Administrator Privilege Escalation: System Key

// source: https://www.securityfocus.com/bid/182/info The default ACL over the HKEYLocalMachine\Software\Microsoft\Windows NT\CurrentVersion\Winlogon key "System" value includes an entry for Server Operators:Special. The Special setting allows Server Ops to "Set" this value. A malicious System...

CVE-1999-0660

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: None. Reason: this candidate is not about any specific product, protocol, or design, so it is out of scope of CVE. It might be more appropriate to cover under the Common Configuration Enumeration CCE. Notes: the former description is:...

CVE-1999-0661

A system is running a version of software that was replaced with a Trojan Horse at one of its distribution points, such as 1 TCP Wrappers 7.6, 2 util-linux 2.9g, 3 wuarchive ftpd wuftpd 2.2 and 2.1f, 4 IRC client ircII ircII 2.2.9, 5 OpenSSH 3.4p1, or 6 Sendmail 8.12.6...

CVE-1999-1555

Cheyenne InocuLAN Anti-Virus Server in Inoculan 4.0 before Service Pack 2 creates an update directory with "EVERYONE FULL CONTROL" permissions, which allows local users to cause Inoculan's antivirus update feature to install a Trojan horse dll...