Denial of service attack against tcpdump

Greetings. There is a way to disable tcpdump running on a remote host. By sending a carefully crafted UDP packet on the network which tcpdump monitors, it is possible, under certain circonstances, to make tcpdump fall into an infinite loop. This undesired behaviour has serious consequences for an...

CVE-2000-0339

ZoneAlarm 2.1.10 and earlier does not filter UDP packets with a source port of 67, which allows remote attackers to bypass the firewall rules...

CVE-2000-0221

The Nautica Marlin bridge allows remote attackers to cause a denial of service via a zero length UDP packet to the SNMP port...

CVE-2000-0221

The CVE-2000-0221 entry concerns the Nautica Marlin bridge, where remote attackers can cause a denial of service by sending a UDP packet of zero length to the SNMP port. The core issue is a zero-length UDP packet handling on SNMP, leading to DoS. Public details in connected sources describe the v...

Objectserver vulnerability

Since the patches are now officially released, I feel I can finally release the details of the SGI objectserver vulnerability. This vulnerability was initailly reported to CERT and SGI Security on October 6, 1997. A beta version of patch 2849 was provided in February 1998. Howard ----- Forwarded...

Security Problems with Linux 2.2.x IP Masquerading

Security Problems with Linux 2.2.x IP Masquerading Summary: Due to lax checking in the masquerading kernel code, an attacker is able to rewrite a linux masq gateway's UDP masquerading entries so that the remote host and port are whatever they choose. This creates a tunnel between whatever host an...

Be BeOS 4.04.55.0 - IP Packet Length Field

Be BeOS 4.04.55.0 - IP Packet Length Field source: https://www.securityfocus.com/bid/1100/info The networking process in BeOS can crash if certain malformed packets are transmitted to it. If the length field is set to a number less than the total length of the IP and protocol TCP or UDP headers...

Be BeOS 4.0/4.5/5.0 - IP Packet Length Field

source: https://www.securityfocus.com/bid/1100/info The networking process in BeOS can crash if certain malformed packets are transmitted to it. If the length field is set to a number less than the total length of the IP and protocol TCP or UDP headers alone, the process will halt and require...

linux-masq-udp.txt

Security Problems with Linux 2.2.x IP Masquerading Summary: Due to lax checking in the masquerading kernel code, an attacker is able to rewrite a linux masq gateway's UDP masquerading entries so that the remote host and port are whatever they choose. This creates a tunnel between whatever host an...

Проблемы с маскарадингом в Linux

анализируя ICMP-ответы при сканировании портов, отведенных под маскарадинг по-умолчанию 61000 - 65096 можно обнаружить и перехватить активные UDP-сеансы...

CVE-2000-0289

IP masquerading in Linux 2.2.x allows remote attackers to route UDP packets through the internal interface by modifying the external source IP address and port number to match those of an established connection...

CVE-1999-0189

Solaris rpcbind exposes the RPC portmapper on a non-standard high UDP port in addition to the expected port 111. This port discovery can enable attackers to bypass basic firewall rules by querying the portmapper for the port numbers of RPC services. The issue is documented across multiple sources...

CVE-1999-0189

Solaris rpcbind listens on a high numbered UDP port, which may not be filtered since the standard port number is 111...

Talk Service (talkd, in.talk, ntalk) Detection

The remote service responded to a talk request. A talk server also known as 'talkd', 'in.talk', or 'ntalk' is a service that works over UDP and notifies a user when someone wants to initiate a conversation. Note that talk is nowadays considered by many to be obsolete. C Tenable Network Security,...

CVE-2000-0221

The Nautica Marlin bridge allows remote attackers to cause a denial of service via a zero length UDP packet to the SNMP port...

Nortel Networks Nautica Marlin - Denial of Service

source: https://www.securityfocus.com/bid/1009/info A vulnerability exists in the Nortel/Bay Networks Nautica Marlin router pruduct. Sending a 0 byte UDP packet to port 161 SNMP to one of these routers will cause it to crash. This attack can be trivially performed using NMAP or other UDP port...

Nortel Networks Nautica Marlin - Denial of Service

Nortel Networks Nautica Marlin - Denial of Service source: https://www.securityfocus.com/bid/1009/info A vulnerability exists in the Nortel/Bay Networks Nautica Marlin router pruduct. Sending a 0 byte UDP packet to port 161 SNMP to one of these routers will cause it to crash. This attack can be...

SNMP Zero Length UDP Packet Remote DoS

It was possible to crash either the remote host or the firewall in between us and the remote host by sending an UDP packet of null size going to port 161 snmp This flaw may allow an attacker to shut down your network. C Tenable Network Security, Inc. Thanks to Christophe Grenier for pointing this...

CVE-1999-1379

DNS allows remote attackers to use DNS name servers as traffic amplifiers via a UDP DNS query with a spoofed source address, which produces more traffic to the victim than was sent by the attacker...

CVE-1999-1066

Quake 1 server responds to an initial UDP game connection request with a large amount of traffic, which allows remote attackers to use the server as an amplifier in a "Smurf" style attack on another host, by spoofing the connection request...