pop2d.fold.txt

While working to port ipop2d exploit to java discovered another hole in the FOLD command of ipop2d... The ability to read files that are readable via the pop2d userid. Attached is a ported exploit in java for bnc... as well as the pop2d exploit transcript. -d0tslash b10z EFnet 9x EFnet...

Max Feoktistov Small HTTP server 1.212 - Buffer Overflow

Max Feoktistov Small HTTP server 1.212 - Buffer Overflow source: https://www.securityfocus.com/bid/1355/info A buffer overflow is present in certain versions of the Small HTTP Server . The overflow in question is triggered by an overlong 65000 or more characters malformed HTTP GET request to the...

Microsoft IIS 4.05.0 - Malformed Filename Request

Microsoft IIS 4.05.0 - Malformed Filename Request source: https://www.securityfocus.com/bid/1193/info Requesting a known filename with the extension replaced with .htr preceeded by approximately 230 "%20" which is an escaped character that represents a space from Microsoft IIS 4.0/5.0 will cause...

FreeBSD-SA-00:17.libmytinfo

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:17 Security Advisory FreeBSD, Inc. Topic: Buffer overflow in libmytinfo may yield increased privileges with third-party software. Category: core Module: libmytinfo...

Solaris 2.67.0 - lpset -r Local Buffer Overflow (2)

Solaris 2.67.0 - lpset -r Local Buffer Overflow 2 // source: https://www.securityfocus.com/bid/1138/info A vulnerability exists in the handling of the -r option to the lpset program, as included in Solaris 7 from Sun Microsystems. The -r option is undocumented. As such, its use in unknown. Howeve...

LCDProc 0.4 - Remote Buffer Overflow

LCDProc 0.4 - Remote Buffer Overflow // source: https://www.securityfocus.com/bid/1131/info A vulnerability exists in the server portion of version 0.4 of the LCDProc package. Several remote buffer overflows exist that could allow a remote attacker to corrupt memory and execute arbitrary code. As...

Stalker CommuniGate Pro 3.2.4 - Arbitrary File Read

source: https://www.securityfocus.com/bid/1493/info A vulnerability exists in the CommuniGate Pro product, from Stalker. It is possible to exploit this vulnerability to read arbitrary files on the filesystem. As CommuniGate Pro runs as root, any file can be accessed. Using this flaw, it is possib...

Sam Hawker wmcdplay 1.0 beta1-2 - Local Buffer Overflow (1)

// source: https://www.securityfocus.com/bid/1047/info wmcdplay is cdplayer generally used with the WindowMaker X11 window-manager on unix systems. While wmcdplay is rarely installed at all by default, when it is installed it is typically set setuid root. wmcdplay is vulnerable to a buffer overfl...

wordpad-ie.txt

Georgi Guninski security advisory 7, 2000 Wordpad vulnerability, exploitable also in IE for Win9x Disclaimer: The opinions expressed in this advisory and program are my own and not of any company. The usual standard disclaimer applies, especially the fact that Georgi Guninski is not liable for an...

Microsoft Internet Explorer 4.04.0.15.05.0.15.5 - preview Security Zone Settings Lag

Microsoft Internet Explorer 4.04.0.15.05.0.15.5 - preview Security Zone Settings Lag Microsoft Internet Explorer 4.0 for Windows 3.1/Windows 95,Internet Explorer 5.0 for Windows 2000/Windows 95/Windows 98/Windows NT 4,Internet Explorer 5.5 preview,Internet Explorer 4.0.1 for Windows 98/Windows NT...

savant.dos.txt

Local / Remote D.o.S Attack in Savant Web Server V2.0 WIN9X / NT / 2K USSR Advisory Code: USSR-99026 Release Date: December 28, 1999 2/5 Systems Affected: Savant Web Server V2.0 Win9X / NT / 2K and possibly others versions. About The Software: Savant provides support for most modern web features...

majordomo.local.txt

---------- Forwarded message ---------- Date: 28 Dec 99 20:47:44 CST From: Brock Tellier Subject: majordomo local exploit OVERVIEW A vulnerability in majordomo allows local users to gain elevated privileges. BACKGROUND I've only tested the version of majordomo which comes with UnixWare 7.1 which ...

Linuxconf 1.1.6 r10 - Remote Buffer Overflow

Linuxconf 1.1.6 r10 - Remote Buffer Overflow // source: https://www.securityfocus.com/bid/2352/info Linuxconf is a Linux configuration utility from Solucorp. An attacker supplying excess data to the USERAGENT field in vulnerable versions of Linuxconf. This data can overflow the relevant buffer,...

WU-FTPD 2.4.22.5 .02.6.02.6.12.6.2 - FTP Conversion

WU-FTPD 2.4.22.5 .02.6.02.6.12.6.2 - FTP Conversion source: https://www.securityfocus.com/bid/2240/info Some FTP servers provide a "conversion" service that pipes a requested file through a program, for example a decompression utility such as "tar", before it is passed to the remote user. Under...

Microsoft Internet Explorer 5 Media Player - ActiveX Error Message

Microsoft Internet Explorer 5.0 for Windows 2000/Windows 95/Windows 98/Windows NT 4 Media Player ActiveX Error Message Vulnerability source: https://www.securityfocus.com/bid/793/info The Windows Media Player ActiveX control, shipped with IE 5, returns a specific error code if it is instructed to...

Axent Raptor Firewall Zero Length IP Remote DoS

It is possible to make the remote Axent raptor freeze by sending it a IP packet containing special options of length equals to 0 An attacker may use this flaw to make the remote firewall crash continuously, thus preventing the network from working properly. C Tenable Network Security, Inc. THIS...

National Science Foundation Squid Web Proxy 1.0/1.1/2.1 - Authentication Failure

source: https://www.securityfocus.com/bid/741/info There is a vulnerability present in certain versions of the Squid Web Proxy Cache developed by the National Science Foundation. This problem is only in effect when users of the cache are using an external authenticator. The following is quoted fr...

SCO Open Server 5.0.5 - X Library Buffer Overflow (1)

// source: https://www.securityfocus.com/bid/638/info A buffer overflow vulnerability in the shared X library may allows local users to obtain higher privileges. Any setuid applications linked against the library are possibly vulnerable. The vulnerability is in the handling of the '-bg' command...

[SECURITY] New versions of INN fixes "news" exploit

Attachment: pgpJuG6VvzzVu.pgp Description: PGP message...

Microsoft Internet Explorer 5 - ActiveX Object For Constructing Type Libraries For Scriptlets File Write

Microsoft Internet Explorer 5 - ActiveX Object For Constructing Type Libraries For Scriptlets File Write Microsoft Internet Explorer 5.0 for Windows 95/Windows 98/Windows NT 4 ActiveX "Object for constructing type libraries for scriptlets" Vulnerability source:...