Cisco IP Phone 7940 - 10 SIP Messages Remote Denial of Service

!/usr/bin/perl use IO::Socket::INET; die "Usage $0 " unless $ARGV3; $socket=new IO::Socket::INET-newPeerPort=$ARGV1, Proto='udp', PeerAddr=$ARGV0; $msg = "INVITE sip:$ARGV2@$ARGV0 SIP/2.0\r\nVia: SIP/2.0/UDP $ARGV3;branch=01;rport\r\nFrom: ;tag=01\r\nTo: \r\nCall-ID: 01@$ARGV3\r\nCSeq: 7532...

Cisco IP Phone 7940 - 3 SIP Messages Remote Denial of Service

!/usr/bin/perl use IO::Socket::INET; die "Usage $0 " unless $ARGV2; $socket=new IO::Socket::INET-newPeerPort=$ARGV1, Proto='udp', PeerAddr=$ARGV0; $msg = "INVITE sip:$ARGV2@$ARGV0 SIP/2.0\r\nVia: SIP/2.0/UDP\t192.168.1.2;rport;branch=00\r\nFrom: ;tag=00\r\nTo: ;tag=00\r\nCall-ID:...

CVE-2007-4444

CVE-2007-4444 involves multiple buffer overflows in Image Space rFactor 1.250 and earlier. The issue allows remote attackers to execute arbitrary code by sending a UDP packet to port 34297 with ID 0x80 or 0x88, related to the buffer containing the server version number. Affected software: Image S...

CVE-2007-4445: Undefined Security Weakness

Image Space rFactor 1.250 and earlier allows remote attackers to cause a denial of service daemon crash via 1 an ID 0x30 packet, 2 an ID 0x38 packet, and an invalid 13-bit integer in 3 an ID 0x60 packet and 4 an ID 0x68 packet; and a denial of service UDP port block via 5 an ID 0x20 packet and 6 ...

CVE-2007-4445

Image Space rFactor 1.250 and earlier allows remote attackers to cause a denial of service daemon crash via 1 an ID 0x30 packet, 2 an ID 0x38 packet, and an invalid 13-bit integer in 3 an ID 0x60 packet and 4 an ID 0x68 packet; and a denial of service UDP port block via 5 an ID 0x20 packet and 6 ...

rFactor多个拒绝服务和代码执行漏洞

BUGTRAQ ID: 25358 rFactor是一款电脑赛车模拟游戏。 rFactor处理ID 0x80或0x88报文的函数中存在缓冲区溢出，但这个溢出不会覆盖返回地址，只能修改服务器的某些缓冲区。如果要利用这个漏洞，攻击者必须查询服务器UDP 34297端口，通过设置超长的服务器版本创建回复，触发第二次溢出，然后才能覆盖返回地址。 如果向发送了ID 0x30或0x38的报文的话，就会导致服务器出现Connection lost消息后崩溃。 如果所发送的ID...

Code injection

Babo Violent 2 2.08.00 and earlier allows remote attackers to cause a denial of service application crash via 1 a value greater than 0x27 for the a 0xca, b 0xcb, c 0xcc, d 0xce, e 0xcf, or f 0xd0 data ID; 2 a nonexistent map name; or 3 a UDP packet that specifies a large data size...

CVE-2007-4379

Babo Violent 2 2.08.00 and earlier allows remote attackers to cause a denial of service application crash via 1 a value greater than 0x27 for the a 0xca, b 0xcb, c 0xcc, d 0xce, e 0xcf, or f 0xd0 data ID; 2 a nonexistent map name; or 3 a UDP packet that specifies a large data size...

CVE-2007-4379

Babo Violent 2 2.08.00 and earlier allows remote attackers to cause a denial of service application crash via 1 a value greater than 0x27 for the a 0xca, b 0xcb, c 0xcc, d 0xce, e 0xcf, or f 0xd0 data ID; 2 a nonexistent map name; or 3 a UDP packet that specifies a large data size...

CVE-2007-4379: Undefined Security Weakness

Babo Violent 2 2.08.00 and earlier allows remote attackers to cause a denial of service application crash via 1 a value greater than 0x27 for the a 0xca, b 0xcb, c 0xcc, d 0xce, e 0xcf, or f 0xd0 data ID; 2 a nonexistent map name; or 3 a UDP packet that specifies a large data size...

Buffer overflow

Multiple buffer overflows in the 1 client and 2 server in Racer 0.5.3 beta 5 allow remote attackers to execute arbitrary code via a long string to UDP port 26000...

CVE-2007-4370

Multiple buffer overflows in the 1 client and 2 server in Racer 0.5.3 beta 5 allow remote attackers to execute arbitrary code via a long string to UDP port 26000...

CVE-2007-4370

CVE-2007-4370 describes multiple buffer overflows in Racer 0.5.3 beta 5 that affect both the client and server. An attacker can trigger via a long UDP payload to port 26000, potentially allowing remote arbitrary code execution. Connected sources show public exploit activity (Metasploit/Exploit-DB...

[Full-disclosure] Multiple vulnerabilities in Babo Violent 2 2.08.00

Luigi Auriemma Application: Babo Violent 2 http://www.rndlabs.ca http://baboviolent.net Versions: = 2.08.00 Platforms: Windows and Linux Bugs: A crash through malformed value B format string C crash through unexistent map D crash through malformed UDP packet Exploitation: A, B and C versus server...

Babo Violent game multiple security vulnerabilities

Crash on UDP packet with malformed data. Format string vulnerability...

CVE-2007-4370: Undefined Security Weakness

Multiple buffer overflows in the 1 client and 2 server in Racer 0.5.3 beta 5 allow remote attackers to execute arbitrary code via a long string to UDP port 26000...

racer-overflow.txt

!/usr/bin/perl Credit's to n00b. Racer v0.5.3 beta 5 12-03-07 remote exploit. Racer is also prone to a buffer over flow in the server and client.Automatically the game open's Udp port 26000 and is waiting for a msg buffer. If we send an overly long buffer we are able to Control the eip register a...

Racer v0.5.3 beta 5 Remote Buffer Overflow Exploit

Exploit for unknown platform in category remote exploits ================================================== Racer v0.5.3 beta 5 Remote Buffer Overflow Exploit ================================================== !/usr/bin/perl Credit's to n00b. Racer v0.5.3 beta 5 12-03-07 remote exploit. Racer is...

Racer 0.5.3 Beta 5 - Remote Buffer Overflow

Racer 0.5.3 Beta 5 - Remote Buffer Overflow !/usr/bin/perl Credit's to n00b. Racer v0.5.3 beta 5 12-03-07 remote exploit. Racer is also prone to a buffer over flow in the server and client.Automatically the game open's Udp port 26000 and is waiting for a msg buffer. If we send an overly long buff...

WengoPhone 2.x SIP Phone Remote Denial of Service Exploit

Exploit for unknown platform in category dos / poc ========================================================= WengoPhone 2.x SIP Phone Remote Denial of Service Exploit ========================================================= /main.cpp/ include include using namespace std; ifdef WIN32 include prag...