ISC DHCPD contains format string vulnerability when logging DNS-update requests

Overview The DHCP daemon DHCPD is a server that is used to allocate network addresses and assign configuration parameters to dynamically configured hosts. A format string vulnerability may permit an intruder to execute code with the privileges of the DHCP daemon typically root. Description The...

2nd Buffer Overflow in Talentsoft's Web+ (#NISR13032002)

NGSSoftware Insight Security Research Advisory Name: Web+ Buffer Overflow Systems Affected: Web+ 4.6/5.0 on Windows NT/2000, Solaris, Linux Severity: High Risk Vendor URL: http://www.talentsoft.com Author: David Litchfield [email protected] Date: 13th March 2002 Advisory number: NISR13032002...

Multiple Vendor Malformed SNMP Message-Handling DoS

It was possible to disable the remote SNMP daemon by sending a malformed packet advertising bogus length fields. An attacker may use this flaw to prevent you from using SNMP to administer your network or use other flaws to execute arbitrary code with the privileges of the SNMP daemon. C Tenable...

NSI RWhoisd contains format string vulnerability in print_error()

Overview A remotely exploitable format string vulnerability exists in the Referral Whois server daemon RWhoisd. Description As the Internet has grown, the centralized whois database was not able to scale. In order to deal with scaling the whois system, Referral Whois was developed. Referral Whois...

IBM AIX line printer daemon contains a buffer overflow in send_status()

Overview The Line Printer daemon lpd shipped with AIX systems contains a buffer overflow in sendstatus that potentially allow a malicious remote user to gain root privileges. Description A buffer overflow exists in the sendstatus function of the line printer daemon lpd on AIX systems. An intruder...

Default installations of the Lotus Domino web server disclose system information via HTTP headers

Overview The default configuration of the Lotus Domino web server discloses system characteristics to anonymous remote users. Description The default configuration of the Lotus Domino web server discloses system information in the HTTP headers it returns to a web browser. If these headers are...

BSD Line Printer Daemon vulnerable to buffer overflow via crafted print request

Overview The line printer daemon enables various clients to share printers over a network. There exists a buffer overflow vulnerability in this daemon that permits remote execution of arbitrary commands with elevated privileges. Description There is a buffer overflow in several implementations of...

Critical Path directory products contain multiple vulnerabilities in LDAP handling code

Overview Multiple Critical Path directory products contain vulnerabilities that may allow denial-of-service attacks, unauthorized privileged access, or both. These vulnerabilities were revealed using the PROTOS LDAPv3 test suite and are documented in CERT Advisory CA-2001-18. If your site uses th...

Multiple vendor telnet daemons vulnerable to buffer overflow via crafted protocol options

Overview The telnetd program is a server for the telnet remote virtual terminal protocol. There is a remotely exploitable buffer overflow in telnet daemons derived from BSD source code. This vulnerability can crash the server, or be leveraged to gain root access. Description There is a remotely...

Multiple versions of OpenLDAP are vulnerable to denial-of-service attacks

Overview Multiple versions of OpenLDAP contain vulnerabilities that may allow denial-of-service attacks. These vulnerabilities were revealed using the PROTOS LDAPv3 test suite and are documented in CERT Advisory CA-2001-18. If your site uses this product, the CERT/CC encourages you to follow the...

iPlanet Directory Server contains multiple vulnerabilities in LDAP handling code

Overview The iPlanet Directory Server contains vulnerabilities that may allow denial-of-service attacks, unauthorized privileged access, or both. These vulnerabilities were revealed using the PROTOS LDAPv3 test suite and are documented in CERT Advisory CA-2001-18. If your site uses this product,...

BroadVision One-To-One Enterprise Nonexistent JSP Request Path Disclosure

BroadVision reveals the physical path of the webroot when asked for a nonexistent .jsp file if it is configured incorrectly. While displaying errors is useful for debugging applications, this feature should not be enabled on production servers. A remote attacker could use this information to moun...

cgisecurity.com Advisory #5

Well I had about 3 advisories I was working on but my HD died and this was the only thing I could salvage. The vendor's patch is also contained below in a url. - zenomorph Cgi Security Advisory 5 [email protected] VirtualCart Shopping Cart Found April 2001 Public release June 2001 Vendor...

solaris 2.6, 7 yppasswd vulnerability

Vulnerability Report Vulnerability: Buffer overflow in yppasswd service Affects: Solaris 6, 7 SPARC tested, x86 unknown Exploit: In circulation http://www.hack.co.za/ Vendor Patch: Not yet. Various people have contacted Sun about this. No official word yet. Workarounds supplied included. Credits:...

Vulnerability discovered in SpearHead NetGap

Background --------------- SpearHead's NetGAP™ appliance physically disconnects a company's network from the Internet. The product consists of two separate computers, an Untrusted CPU and a Trusted CPU, that are never directly connected at any given time. NetGap™ includes a content checking engin...

iPlanet Certificate Management Traversal Arbitrary File Access

It is possible to read arbitrary files on the remote server by prepending /ca/../../ in front on the file name. C Tenable Network Security, Inc. XXX might be redundant with plugin 10589 include"compat.inc"; ifdescription scriptid10683; scriptversion "1.25"; scriptcveid"CVE-2000-1075";...

PerlCal (CGI) show files vulnerability

whizkunde security advisory: PerlCal CGI http://www.whizkunde.org | [email protected] ---------------------------------------------------------- Release date: April 27th 2001 Subject: PerlCal CGI security problem Systems affected: NIX not windows systems running PerlCal CGI script Vendor:...

def-2001-11: MDaemon 3.5.4 Dos-Device DoS

====================================================================== Defcom Labs Advisory def-2001-11 MDaemon 3.5.4 Dos-Device DoS Author: Peter Grьndl [email protected] Release Date: 2001-03-15 ======================================================================...

Cgisecurity.com Advisory #3.1

The staff at cgisecurity.com have found a security issue with a forum script that is widley used. Below is the advisory along with the vendor patch. -zenomorph Cgi Security Advisory 3.1 [email protected] bbsforum.cgi Found January 3rd 2001 Vendor Contacted January 3rd 2001 Public Release...

KTH Kerberos filesystem race condition on tickets stored in /tmp

Overview There may be a race condition during the creation of Kerberos ticket files in the /tmp directory. This race condition may allow intruders with local access to the system to gain root privileges. Description During the creation of ticket files in the /tmp directory, a sequence of calls...