Cgisecurity.com Advisory #3.1

The staff at cgisecurity.com have found a security issue with a forum script that is widley used. Below is the advisory along with the vendor patch. -zenomorph Cgi Security Advisory 3.1 [email protected] bbsforum.cgi Found January 3rd 2001 Vendor Contacted January 3rd 2001 Public Release...

KTH Kerberos filesystem race condition on tickets stored in /tmp

Overview There may be a race condition during the creation of Kerberos ticket files in the /tmp directory. This race condition may allow intruders with local access to the system to gain root privileges. Description During the creation of ticket files in the /tmp directory, a sequence of calls...

Cgisecurity.com advisory on dcforum

The staff of cgisecurity.com have found a remote input validation error in the dcforum cgi script. NOTE: The vendor was very quick to issue a patch on this and becuase of this i decided to release it so soon after finding it. Below is a paste of the advisory. -zenomorph Cgi Security Advisory 2...

Race condition in periodic

Overview A race condition in the 'periodic' script allows local files to be overwritten. We believe that 'periodic' is typically used only with FreeBSD systems, though it may be installed on other systems. Description 'periodic' is a script used in conjunction with cron to execute jobs at specifi...

Format string vulnerability in libutil pw_error(3) function

Overview There is an input validation vulnerability in the OpenBSD libutil system library that allows local users to gain superuser access via the chpass utility. Description On June 30, 2000, the OpenBSD development team repaired an input validation vulnerability in the pwerror function of the...

@stake Advisory: NTLM Replaying via Windows 2000 Telnet Client (A 091400-1)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I wish this could have gone out sooner but there was an issue with the initial Microsoft patch which we found during our testing. They subsequently decided to fix the patch which delayed things a bit. We feel that if a vendor is taking an issue...

OS/2 Warp 4.5 FTP Server DoS

OS/2 Warp 4.5 FTP Server DoS Advisory Code: VIGILANTE-2000006 Release Date: August 15, 2000 Systems Affected: - OS/2 Warp 4.5 FTP server V4.0/4.2 - OS/2 Warp 4.5 FTP server V4.3 - Probably other versions of the software as well. THE PROBLEM The FTP server that comes with OS/2 Warp 4.5 TCP/IP can ...

Lotus Domino SMTP MAIL FROM Command Remote Overflow

The remote Lotus Domino SMTP server is affected by a buffer overflow vulnerability that can be triggered by an overly long argument to the 'MAIL FROM' command. This problem may allow an attacker to crash the mail server or even allow the execution of arbitrary code on this system. C Tenable Netwo...

Rover POP3 Server Username Remote Overflow

The remote pop3 server seems vulnerable to a buffer overflow when issued a very long user name 10,000 chars This may allow an attacker to execute arbitrary commands as root on the remote POP3 server. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid10206; scriptversion...

Netscape Enterprise Server SSL Handshake DoS

There is an SSL handshake bug in the remote secure web server that could lead to a denial of service attack. An attacker may use this flaw to prevent your site from working properly. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

ATT VNC Windows Client Buffer Overflow

Advisory ID Internal CORE-21011503 Bugtraq ID: 2305 CVE Name: CAN-2001-0167 Title: ATT VNC Windows Client Buffer Overflow Class: Boundary Error Condition Buffer Overflow Remotely Exploitable: yes Locally Exploitable: yes Release Mode: USER RELEASE Vulnerability Description: As stated in the VNC...