Mod_Survey ENV tag vulnerability

Attached is a security advisory for ModSurvey, which is a modperl module for apache see attachment. The advisory was first published 2003-03-23 at http://gathering.itm.mh.se/modsurvey/SA20030323.txt More info about ModSurvey can be found on its home page, which is available at...

Important: Red Hat Security Advisory: kernel security update

Updated kernel packages are now available that fix a ptrace-related vulnerability which can lead to elevated root privileges. The Linux kernel handles the basic functions of the operating system. A vulnerability has been found in version 2.4.18 of the kernel. This vulnerability allows a local use...

OpenWebMail < 1.90 Multiple Vulnerabilities

According to its banner, the remote host is running a version OpenWebMail older than 1.90. Such versions are reportedly affected by multiple vulnerabilities : - It may be possible to execute arbitrary commands with super user privilges. - An information disclosure vulnerability could diclose user...

ProFTPD 1.2.0rc2 Malformed cwd Command Format String

The remote ProFTPd server is as old or older than 1.2.0rc2 There is a very hard to exploit format string vulnerability in this version that could allow an attacker to execute arbitrary code on this host. The vulnerability is believed to be nearly impossible to exploit though. C Tenable Network...

Thunderstone Software TEXIS Nonexistent File Request Path Disclosure

The Thunderstone Software TEXIS application running on the remote host is affected by an information disclosure vulnerability that allows an unauthenticated, remote attacker to obtain the full path of the web root directory by making a specially crafted request for a nonexistent file. %NASLMINLEV...

CVS Malformed Directory Request Double-free Privilege Escalation

According to its version number, the CVS server running on the remote host has a double free bug, which could allow a malicious user to elevate their privileges. C Tenable Network Security, Inc. include"compat.inc"; References: From: Stefan Esser Subject: Advisory 01/2003: CVS remote vulnerabilit...

rsync I/O Functions Multiple Signedness Errors RCE

The remote rsync server is affected by multiple signedness errors in the I/O functions. An unauthenticated, remote attacker can exploit these to cause a denial of service or execute arbitrary code. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid11390; scriptversion...

smb2www Unspecified Arbitrary Remote Command Execution

The remote host is running smb2www - a SMB to WWW gateway. There is a flaw in the version of this CGI which allows anyone to execute arbitrary commands on this host by sending a malformed argument to smbshr.pl, one of the components of this solution. %NASLMINLEVEL 70300 C Tenable Network Security...

Qpopper pop_msg() Macroname Remote Overflow

The remote Qpopper server, according to its banner, is vulnerable to a one-byte overflow ih its popmsg function after a call to Qvsnprintf. An attacker may use this flaw to execute code with the privileges of the Qpopper service usually non-root, provided that he has a valid POP account to log in...

[SNS Advisory No.63] DeleGate Pointer Array Overflow May Let Remote Users Execute Arbitrary Code

---------------------------------------------------------------------- SNS Advisory No.63 DeleGate Pointer Array Overflow May Let Remote Users Execute Arbitrary Code Problem first discovered on: Sun, 02 Mar 2003 Published on: Mon, 10 Mar 2003...

IBM Lotus Domino Directory Traversal Arbitrary File Access

It is possible to read arbitrary files on the remote server by prepending %00%00.nsf/../ in front of it. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid11344; scriptversion"1.26";...

popper_mod PHP Administration Script Authentication Bypass

It is possible to administrate the remote poppermod CGI by requesting the /admin directory directly. An attacker may use this flaw to obtain the passwords of your users. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; ifdescription...

Automatic File Content Type Recognition Tool contains memory allocation problem

Overview A memory allocation problem exists in the "Automatic File Content Type Recognition Tool" versions of the file1 package prior to 3.41. Description According to an OpenPKG advisory, a memory allocation problem exists in the "Automatic File Content Type Recognition Tool" AFCTR tool versions...

Automatic File Content Type Recognition Tool vulnerable to stack overflow

Overview A buffer overflow vulnerability exists in the "Automatic File Content Type Recognition Tool" versions of the file1 package prior to 3.41. Description The file1 package is used to examine files on the system. According to an OpenPKG advisory, a stack overflow vulnerability exists in the...

FreeBSD-SA-03:04.sendmail

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-03:04.sendmail Security Advisory The FreeBSD Project Topic: sendmail header parsing buffer overflow Category: contrib Module: contribsendmail Announced: 2003-03-0...

TYPO3 < 3.5.0 Multiple Vulnerabilities

The remote host is running an old version of TYPO3. An attacker can use it to read arbitrary files and execute arbitrary commands on this host. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. From: Martin Eiszner To: [email protected] Subject: typo3 issues Message-Id:...

Usermin 'miniserv.pl' Base-64 String Metacharacter Handling Session Spoofing

The remote server is running a version of Usermin which is vulnerable to Session ID spoofing. An attacker may use this flaw to log in as the 'root' user, and gain full control of the remote host. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

Moderate: Red Hat Security Advisory: vnc security update

Updated VNC packages are available to fix a weak cookie vulnerability. VNC is a tool for providing a remote graphical user interface. The VNC server acts as an X server, but the script for starting it generates an MIT X cookie which is used for X authentication without using a strong enough rando...

Lotus Domino Web Server vulnerable to denial of service via incomplete POST request

Overview Lotus Domino Web Server is an application that provides access to Lotus Notes databases via HTTP requests. A vulnerability exists that could permit a remote attacker to cause a denial-of-service situation for HTTP requests. Description Lotus Domino Web Server contains a vulnerability in...

OpenSSL < 0.9.6j / 0.9.7b Multiple Vulnerabilities

According to its banner, the remote host is using a version of OpenSSL older than 0.9.6j or 0.9.7b. This version is vulnerable to a timing-based attack that could allow an attacker to guess the content of fixed data blocks and may eventually be able to guess the value of the private RSA key of th...