GnuPG contains format-string vulnerability in handling of encrypted data filename

Overview Some versions of Gnu Privacy Guard GPG contain a format-string vulnerability from improper handling of filenames when decrypting files. Description GPG is an OpenPGP-compliant alternative to PGP to protect electronic communications using public-key cryptography. Versions of GPG prior to...

KPMG-2002005: BitVise WinSSH Denial of Service

-------------------------------------------------------------------- -=BitVise WinSSH Denial of Service=- courtesy of KPMG Denmark BUG-ID: 2002005 Released: 18th Mar 2002 -------------------------------------------------------------------- Problem: ======== Using "ill-intended connection attempts...

Apache-SSL < 1.3.23+1.46 i2d_SSL_SESSION Function SSL Client Certificate Overflow

The remote host is using a version of Apache-SSL that is older than 1.3.22+1.46. Such versions are vulnerable to a buffer overflow that, albeit difficult to exploit, may allow an attacker to execute arbitrary commands on this host subject to the privileges under which the web server operates. C...

Squid Proxy Server contains buffer overflow in parsing of the authentication portion of FTP URLs

Overview There is a remotely exploitable buffer overflow in the Squid proxy/cache server. Exploitation of this vulnerability could lead to an intruder gaining a shell on the target Squid server. Description Squid versions 2.3 and 2.4 are vulnerable to a buffer overflow in the code that parses FTP...

CUPS ippRead&#40;&#41; attribute name buffer overflow

cups-ippread-bo 8192 High Risk CUPS ippRead attribute name buffer overflow Description: Common Unix Printing System CUPS versions 1.1.13 and earlier are vulnerable to a denial of service attack caused by a buffer overflow in the handling of attribute names in the ippRead function. By setting a ve...

[SA-2002:00] Slashcode login vulunerability

SA-2002:00 Slashcode login vulunerability RISK FACTOR: HIGH SYNOPSIS Slash, the code that runs Slashdot and many other web sites, has a vulnerability in recent versions that allows any logged-in user to log in as any other user. This allows users to take nearly full control of a Slash system post...

FreeBSD-SA-02:01.pkg_add

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-02:01 Security Advisory FreeBSD, Inc. Topic: Directory permission vulnerability in pkgadd REVISED Category: core Module: pkginstall Announced: 2002-01-04 Revised: 2002-01-07...

[Exim] Potential security problem

From: Philip Hazel [email protected] To: [email protected], [email protected] Subject: Exim Potential security problem X-BeenThere: [email protected] Date: Wed, 19 Dec 2001 14:35:41 +0000 GMT Important. Please read. Amongst other things, Exim 3.34 and Exim 3.952 alpha for Exim 4, which ...

Problem with HP r-cmnds

Overview A problem existed with HP versions of the r-commands remshd, rexecd, rlogin, rlogind, remsh, rcp, rexec, rdist in use circa December, 1998. Description See HEWLETT-PACKARD COMPANY SECURITY BULLETIN: 00090, registration required 07 December 1998 for a description of the problem. No other...

GNOME libgtop Daemon Remote Format String

It seems that libgtop is/was running on this port and is vulnerable to a format string attack which may allow an attacker to gain a shell on this host with the privileges of 'nobody'. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10812; scriptversion"1.20";...

MBDMS Database Server Long String Remote Overflow

According to its banner, the remote host is running a beta version of MDBMS. It is very likely this version has a remote buffer overflow vulnerability. A remote attacker could exploit this to crash the service, or execute arbitrary code. C Tenable Network Security, Inc. include"compat.inc"; if...

Samba NETBIOS Name Traversal Arbitrary Remote File Creation

The remote Samba server, according to its version number, allows creation of arbitrary remote files. This vulnerability allows an attacker to overwrite arbitrary files by supplying an arbitrarily formed NetBIOS machine name to this server, and to potentially become root on the remote server. An...

Re: Bug found in ht://Dig htsearch CGI

Name: ht://Dig htsearch CGI Versions affected: 3.1.0b2 and more recent, including 3.1.5 and 3.2.0b3 Vulnerability: Potential remote exposure. Denial of Service. Details: The htsearch CGI runs as both the CGI and as a command-line program. The command-line program accepts the -c filename to read i...

Apache Auth Module SQL Injection

The 'modauthpgsqlsys' module is prior to 0.9.6. It is, therefore, affected by a SQL injection vulnerability that allows an attacker to bypass authentication. Script to check for Apache Authentication Modules SQL Insertion Vulnerability This script is copyright c 2001 Matt Moore modifications by r...

phpSecurePages allows remote code execution

Overview There is an input validation vulnerability in phpSecurePages that may allow a remote intruder to execute arbitrary code with the privileges of the running web server. Description phpSecurePages is a tool for password protecting portions of websites on PHP enabled webservers. The...

Zope ZClass Modification Local DoS

The remote web server is Zope 2.2.5. Such versions allow any Zope user to create a denial of service by modifying Zope data structures, thus rendering the site unusable. Since Nessus solely relied on the version number of the server, consider this a false positive if the hotfix has already been...

SSH 3.0.0 Locked Account Remote Authentication Bypass

The remote host is running SSH 3.0.0. There is a bug in this release which allows any user to log into accounts whose password entry is two characters long or less. An attacker might gain root privileges using this flaw. C Tenable Network Security, Inc. include"compat.inc"; ifdescription...

Lotus Domino vulnerable to DoS via crafted HTTP header requests

Overview The Lotus Domino Web Server contains a flaw that could be exploited to cause a denial of service. Description HTTP requests with uniquely crafted headers using "Accept", "Accept-Charset", "Accept-Encoding", "Accept-Language" or "Content-Type" are not freed properly. This means that...

GoodTech FTP Server Connection Saturation DoS

The remote host appears to be running GoodTech FTP Server for Windows. It was possible to disable the remote FTP server by connecting to it about 3000 separate times. If the remote server is running from within xinetd, this is a feature and the FTP server should automatically be back in a couple ...

Linux gpm daemon allows arbitrary file removal

Overview gpm version 1.19.2 and earlier are vulnerable due to a flaw that allows a local user to delete arbitrary files. Description gpm General Purpose Mouse is the program that lets you use the mouse in console mode when not using XWindows. It is usually included in Linux distributions, and can...