ISC BIND < 4.9.8 / 8.2.3 Multiple Remote Overflows

The remote BIND server, according to its version number, is affected by various buffer overflow vulnerabilities that may allow an attacker to execute arbitrary code on the remote host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10605; scriptversion"1.29";...

Icecast utils.c fd_write Function Format String

The remote server claims to be running Icecast 1.3.7 or 1.3.8beta2. These versions are vulnerable to a format string attack that could allow an attacker to execute arbitrary commands on this host. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid10600; scriptversion...

Glibc Local Root Exploit

Hi all, This has been bouncing around on vuln-dev and the debian-devel lists. It effects glibc = 2.1.9x and it would seem many if not all OSes using these versions of glibc. Ben Collins writes, "This wasn't supposed to happen, and the actual fix was a missing comma in the list of secure env vars...

PHP 3.0.16/4.0.2 Remote Format Overflow Exploit

Exploit for linux platform in category remote exploits =============================================== PHP 3.0.16/4.0.2 Remote Format Overflow Exploit =============================================== / PHP 3.0.16/4.0.2 remote format overflow exploit. Copyright c 2000 Field Marshal Count August Ant...

Solaris 2.6/7.0 - 'locale' Format Strings noexec stack Overflow

/ exploit for locale subsystem format strings bug In Solaris with noexec stack. Tested in Solaris 2.6/7.0 If it wont work, try adjust retloc offset. e.g. ./ex -o -4 $gcc -o ex ex.c ldd /usr/bin/passwd|sed -e 's/^.lib\0-9a-zA-Z\.so./-l\1/' usages: ./ex -h Thanks for Ivan Arce who found this bug...

nathan purciful phpphotoalbum 0.9.9 - Directory Traversal

nathan purciful phpphotoalbum 0.9.9 - Directory Traversal source: https://www.securityfocus.com/bid/1650/info The explorer.php script within phpPhotoAlbum 0.9.9 and possibly previous versions are vulnerable to directory traversal. By requesting a URL composed of explorer.php and the ../ string in...

Dansie Shopping Cart Backdoor Detection

The script /cart/cart.cgi is present. If this shopping cart system is the Dansie Shopping Cart, and if it is older than version 3.0.8 then it is very likely that it contains a backdoor that allows anyone to execute arbitrary commands on this system. C Tenable Network Security, Inc...

CVE-1999-0235

Buffer overflow in NCSA WebServer 1.4.1 and below gives remote access...

AIX 4.1/4.2 - 'pdnsd' Remote Buffer Overflow

// source: https://www.securityfocus.com/bid/3237/info The Source Code Browser's Program Database Name Server Daemon pdnsd component of the C Set ++ compiler for AIX contains a remotely exploitable buffer overflow. This vulnerability allows local or remote attackers to compromise root privileges ...

[SECURITY] New versions of cfingerd fixes root exploit

We have received a report that the all versions of cfingerd prior to 1.4.0 and 1.3.2-18.1 are vulnerable to a root exploit - as posted on bugtraq. We recommend you upgrade your cfingerd package immediately or disable ALLOWEXECUTION. The latter is turned off in the default Debian configuration. wg...

CVE-1999-1159

SSH 2.0.11 and earlier allows local users to request remote forwarding from privileged ports without being root...

Qualcomm qpopper 2.4 - POP Server Buffer Overflow (2)

// source: https://www.securityfocus.com/bid/133/info A number of buffer-overflow issues reside in versions prior to 2.5 of Qualcomm's 'qpopper' program. Exploiting this issue allows a remote attacker to execute arbitrary commands on hosts that are running a vulnerable version. To determine if yo...

AIX 3.x - bugfiler Arbitrary File Creation

AIX 3.x - bugfiler Arbitrary File Creation source: https://www.securityfocus.com/bid/1800/info A vulnerability exists in AIX 3. versions of bugfiler, a utility which automates the process of reporting an filing system bugs. Bugfiler, installed setuid root, creates files in a directory specified b...