OpenBSD local DoS

-----BEGIN PGP SIGNED MESSAGE----- A local denial of service attack against OpenBSD was published today Sunday Dec 02 to the [email protected] mailing list by Marco Peereboom [email protected]. I'm forwarding his message on to the general security community. The effect of the attack is to crash...

Microsoft Windows 2000 Telnet Service searches all trusted domains for user accounts

Overview The Microsoft Windows 2000 Telnet Service contains a vulnerability that allows remote attackers to log in using domain accounts without providing a specific domain name. Description The Microsoft Windows 2000 Telnet Service allows users to establish connections using either local account...

CVE-1999-1467

The CVE-1999-1467 issue affects the rcp service on SunOS 4.0.x. The underlying problem is tied to the configuration of the nobody user, enabling remote attackers from trusted hosts to execute arbitrary commands as root. The connected PT-1989-1001 entry confirms SunOS 4.0.x as the affected platfor...

Cisco CatOS VACM read-write Community String Device Configuration Manipulation

It is possible to obtain the remote private community strings using the View-Based Access Control MIB VACM of the remote Cisco router. An attacker may use this flaw to gain read/write SNMP access on this router. Note that a value in this table does not necessarily mean that an instance with the...

Microsoft Internet Explorer (IE) permits modification of URL displayed in address bar

Overview A vulnerability exists in Microsoft Internet Explorer which could could enable an attacker to spoof trusted web sites. Description A vulnerability exists in Microsoft Internet Explorer. This vulnerability could enable a web page to display the URL from a different web site in the IE...

ISC Bind 4 nslookupComplain() Buffer Overflow Vulnerability

Description BIND is a server program that implements the domain name service protocol. It is in extremely wide use on the Internet, in use by most of the DNS servers. Version 4 of BIND contains a stack overflow that may be exploitable to remote attackers. The vulnerability is due to unsafe use of...

CVE-2000-1104

Variant of the "IIS Cross-Site Scripting" vulnerability as originally discussed in MS:MS00-060 CVE-2000-0746 allows a malicious web site operator to embed scripts in a link to a trusted site, which are returned without quoting in an error message back to the client. The client then executes those...

CVE-2000-1104

CVE-2000-1104 is a variant of the IIS Cross-Site Scripting vulnerability described in MS00-060 (CVE-2000-0746). The vulnerability affects Microsoft IIS 4.0 and 5.0, where a malicious site can embed scripts in a link to a trusted site, which are returned unquoted in an error message and executed i...

EUVD-2000-1089

Variant of the "IIS Cross-Site Scripting" vulnerability as originally discussed in MS:MS00-060 CVE-2000-0746 allows a malicious web site operator to embed scripts in a link to a trusted site, which are returned without quoting in an error message back to the client. The client then executes those...

SNMP Request Network Interfaces Enumeration

It is possible to obtain the list of the network interfaces installed on the remote host by sending SNMP requests with the OID 1.3.6.1.2.1.2.1.0 An attacker may use this information to gain more knowledge about the target host. TRUSTED...

CVE-2000-0746

Vulnerabilities in IIS 4.0 and 5.0 do not properly protect against cross-site scripting CSS attacks. They allow a malicious web site operator to embed scripts in a link to a trusted site, which are returned without quoting in an error message back to the client. The client then executes those...

Group-writable executable in OpenLDAP

OpenLDAP installs the ud binary in $binpath with mode 775 and default group i.e. either you primary gid or the directories gid. Of course the consequences depend on which group this actually is. This was checked with 1.2.11 latest stable, but probably also exists in earlier versions, since the...

Security Bulletin (MS00-039)

Microsoft Security Bulletin MS00-039 - -------------------------------------- Patch Available for "SSL Certificate Validation" Vulnerabilities Originally posted: June 05, 2000 Summary ======= Microsoft has released a patch that eliminates two security vulnerabilities in Microsoftr Internet...

NAI WebShield SMTP GET_CONFIG Information Disclosure

The remote NAI WebShield SMTP Management tool gives away its configuration when it is issued the command : GETCONFIG This may be of some use to an attacker to gain more knowledge about this system. C Tenable Network Security, Inc. include 'compat.inc' ; ifdescription scriptid10424; scriptversion...

CVE-2000-0159

CVE-2000-0159 affects HP Ignite-UX. The issue: when imaging a trusted system, Ignite-UX does not save /etc/passwd, which can leave the password field blank and enable privilege escalation. The description and connected documents confirm the vulnerable component and the underlying behavior, but do...

CVE-1999-0992

HP VirtualVault with the PHSS17692 patch allows unprivileged processes to bypass access restrictions via the Trusted Gateway Proxy TGP...

CVE-1999-0992

HP VirtualVault with the PHSS17692 patch allows unprivileged processes to bypass access restrictions via the Trusted Gateway Proxy TGP...

CVE-1999-0992

CVE-1999-0992 affects HP VirtualVault with the PHSS_17692 patch. The issue is a bypass of access restrictions via the Trusted Gateway Proxy (TGP), enabling unprivileged processes to gain restricted access. The vulnerability is tied to HP VirtualVault and the TGP configuration as described in the ...

Microsoft Internet Explorer 4.04.0.15.05.0.15.5 - preview Security Zone Settings Lag

Microsoft Internet Explorer 4.04.0.15.05.0.15.5 - preview Security Zone Settings Lag Microsoft Internet Explorer 4.0 for Windows 3.1/Windows 95,Internet Explorer 5.0 for Windows 2000/Windows 95/Windows 98/Windows NT 4,Internet Explorer 5.5 preview,Internet Explorer 4.0.1 for Windows 98/Windows NT...

[SECURITY] New version of sendmail-wide released

The version of sendmail-wide that was distributed with Debian GNU/Linux 2.1 has a slight problem in the code to regenerate the aliases database. Sendmail allowed any user to run sendmail with the -bi option to reinitialize the aliases database. The user could then interrupt sendmail and leave the...