[EXPL] Half-Life Exploit Code Released (Malformed Packet)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion In the US? Contact Beyond Security at our new California office housewarming rates on automated network vulnerability scanning. We also...

Xeneo Web Server 2.2.9.0 - Denial of Service

!/usr/bin/perl Xeneo Web Server DoS Vulnerable systems: Xeneo. Web Server 2.2.9.0 Written by badpack3t For SP Research Labs 04/21/2003 www.security-protocols.com usage: perl sp-xeneo.pl use IO::Socket; use strict; print ".:."x 20; print "\nXeneo Web Server 2.2.9.0 DoS, \n"; print ".:."x 20; print...

[UNIX] Apache mod_access_referer Denial of Service Issue

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion In the US? Contact Beyond Security at our new California office housewarming rates on automated network vulnerability scanning. We also...

Directory traversal vulnerabilities found in NITE ftp-server version 1.83

Directory traversal vulnerabilities found in NITE ftp-server version 1.83 Discovered by Dennis Rand www.Infowarfare.dk ------------------------------------------------------------------------ SUMMARY The NiteServer is a simple FTP-Server program with some special features. It is free and easy to...

XSS bug in php(Reactor)

Vulnerable systems: 1.2.7pl1 Exploit: forums/browse.php?fid=3&tid=46&go=scriptJavaScript:alert 'Hi';/script with out "" Solution: i thought this but i am not sure open browse.php and add this code in line 52: $go = HTMLSpecialChars$go; $go = PREGReplace"/A-Z&.;:!@$^''//i", "", $go;...

Bypassing TrendMicro InterScan VirusWall

Bypassing TrendMicro InterScan VirusWall Overview According to our tests, TrendMicro VirusWall can be bypassed when using : HTTP 1.1 chunked transfert encoding. HTTP 1.0 gzip content encoding for Windows platforms only. Description While HTTP/1.0 includes the Content-Encoding header, which...

Cisco 6400 NRP2 Unauthenticated Telnet Access (CSCdt65960)

The Cisco 6400 Access Concentrator Node Route Processor 2 NRP2 module allows Telnet access when no password has been set. The correct response is to disallow any remote access to the module until the password has been set. This vulnerability may result in users gaining unintended access to secure...

Oracle JSP Apache/Jserv Path Translation Arbitrary JSP File Execution

Detects Vulnerability in the execution of JSPs outside docroot. A potential security vulnerability has been discovered in Oracle JSP releases 1.0.x through 1.1.1 in Apache/Jserv. This vulnerability permits access to and execution of unintended JSP files outside the docroot in Apache/Jserv. For...

Open Bulletin Board javascript bug.

OpenBB is free php-based forum. Exploit: imgjavasCript:alert'Hello world.'/img Vulnerable systems: All versions of Open Bulletin Board including v.1.0.0 Immune systems: None Solution: All url's in img tags should start with "http://" Yurij Rumiantsev...

XMB cross-scripting vulnerability

XMB is a php-based forum. This product contain a Cross Site Scripting vulnerability that allows attackers to insert JavaScript code and other HTML code into existing messages, bypassing the internal JavaScript/HTML code stripper. Exploit: imgjavasCript:alert'Hello world.'/img Vulnerable systems:...

php.windows.txt

Title 17/2/2002 PHP for Windows Arbitrary Files Execution GIF, MP3 Summary Through PHP.EXE, an attacker can cause PHP to interpret any file as a PHP file, even if its extensions are not PHP. This would enable the remote attacker to execute arbitrary commands, leading to a system compromise. Detai...

ROTOS Remote SNMP Attack Tool

Internet Security Systems Security Alert February 12, 2002 PROTOS Remote SNMP Attack Tool Synopsis: ISS X-Force has learned of a powerful SNMP Simple Network Management Protocol attack tool that may be circulating in the computer underground. The PROTOS SNMP stress-testing tool sends thousands of...

Buffer overflows in Microsoft SQL Server 7.0 and SQL Server 2000

Overview There is a buffer overflow in Microsoft SQL Server 2000 and SQL Server 7.0 which could allow an intruder to execute arbitrary code on vulnerable systems. Description Microsoft Windows SQL Server 2000 and SQL Server 7.0 contain a buffer overflow in functions associated with text messages...

IBM AIX setsenv buffer overflow

Overview There is a buffer overflow in the IBM AIX setsenv command that may allow local attackers to gain root privileges. Description The setsenv command is used to set protected state environment variables. There is a buffer overflow in a variable value parameter to the setsenv command on IBM A...

MiM Simultaneous close attack

MiM simultaneous CLOSE attack Revision 1.1 For Public Release 2001 August 07 08:00 GMT +0200 Vulnerability : MiM simultaneous CLOSE attack Vendor : N/A Category : Man in the middle / Denial of service Date : 08/07/2001 Credits : Korhan Kaya [email protected] Document ID : MW-TCPMD-03...

Netscape SmartDownload 1.3 Buffer Overflow Vulnerability

--------------------------------------------------------------------------- Security Alert Subject: Netscape SmartDownload 1.3 Buffer Overflow Vulnerability BUGTRAQ ID: 2615 CVE ID: CAN-2001-0262 Published: April 13, 2001 Updated: April 18, 2001 Remote: Yes Local: No Class: Boundary Condition Err...

ICMP fragmentation required but DF set problems.

Hi all, The problem I'm exposing is quite obvious, but unfortunatelly can be used in a very simple way by script kiddies. SYNOPSIS It's possible to slowdown a lot connections between two arbirary hosts but at least one with the PMTU discovery enabled using some spoofed TCP/IP packet. Maybe you ca...

ProFTPD <= 1.2.0pre10 Remote Denial of Service Exploit

Exploit for unknown platform in category dos / poc ====================================================== ProFTPD = 1.2.0pre10 Remote Denial of Service Exploit ====================================================== / ProFTPd DoS version 1.1 Remote DoS in proFTPd Code by: JeT-Li -The Wushu Master-...

HP OpenView OmniBack II Generic Remote Exploit

Exploit for multiple platform in category remote exploits ============================================== HP OpenView OmniBack II Generic Remote Exploit ============================================== / HP OpenView OmniBack II generic remote Exploit by DiGiT - email protected Omniback is a network...

UDP Ping-pong in Win2k

Sorry if this is already well-known. Windows 2000 server with an open UDP Kerberos v5 port 464 is vulnerable to a UDP ping-pong attack where you send a packet with someone elses IP address and chargen source port to it. Drives CPU usage on my test system to approx. 70. AFAIK affected systems: Win...