phpBB < 2.0.10 - 'Santy.A Worm' 'highlight' Arbitrary File Upload

Santy.A - phpBB 3; open IN, $0 or exit; my $self = join '', ; close IN; unlink $0; while!GrabURL'http://www.google.com/advancedsearch' if$generation 3 PayLoad ; else exit; $self = s/my $generation = \d+;/'my $generation = ' . $1 + 1 . ';'/e; my $selfFileName = 'm1ho2of'; my $markStr =...

Microsoft IE FRAME/IFRAME/EMBED Tag Overflow (Bofra Worm Detection)

The remote host seems to have been infected with the Bofra worm or one of its variants, which infects machines via an Internet Explorer IFRAME exploit. It is very likely this system has been compromised. Bofra virus detection Author: Brian Smith-Sweeney [email protected]...

CVE-2004-1315

viewtopic.php in phpBB 2.x before 2.0.11 improperly URL decodes the highlight parameter when extracting words and phrases to highlight, which allows remote attackers to execute arbitrary PHP code by double-encoding the highlight value so that special characters are inserted into the result, which...

w32.spybot.fcd Worm Infection Detection

The remote system is infected with a variant of the worm w32.spybot.fcd. Infected systems will scan systems that are vulnerable in the same subnet in order to spread, creating a botnet that has been used for purposes such as DDoS attacks. This script was written by Jorge E Rodriguez - check the...

Trojan/Backdoor Detection - Sasser Worm

Binary data 1215.prm...

Witty Worm Detection

Binary data 1182.prm...

Zincite.A (MyDoom.M) Backdoor Detection

The backdoor 'BackDoor.Zincite.A' is installed on the remote host. It has probably been installed by the 'MyDoom.M' virus. This backdoor may allow an attacker to gain unauthorized access on the remote host. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid14184;...

W32.Dabber Worm Detection

The W32.Dabber worm is listening on this port. W32.Dabber propagates by exploiting a vulnerability in the FTP server component of W32.Sasser.Worm and its variants. It installs a backdoor on infected hosts and tries to listen on port 9898. If the attempt fails, it tries to listen on ports 9899...

Korgo Worm Detection

Nessus found that TCP ports 113 and 3067 are open. The Korgo worm is known to open a backdoor on these ports. It propagates by exploiting the LSASS vulnerability on TCP port 445 as described in Microsoft Security Bulletin MS04-011 Note that Nessus did not try to talk to the backdoor, so this migh...

Sasser Worm ftpd - Remote Buffer Overflow (port 5554)

Sasser Worm ftpd - Remote Buffer Overflow port 5554 / / // / / / / \ / / / / / / / // // / // / // //// - ROMANIAN SECURITY RESEARCH 2004 - sasser va-e exploit of its ftpd server exploit version 1.4, public author: mandragore date: Mon May 10 16:13:31 2004 vuln type: SEH ptr overwriting greets:...

Sasser Worm ftpd - Remote Buffer Overflow (port 5554)

/ / // / / / / \ / / / / / / / // // / // / // //// - ROMANIAN SECURITY RESEARCH 2004 - sasser va-e exploit of its ftpd server exploit version 1.4, public author: mandragore date: Mon May 10 16:13:31 2004 vuln type: SEH ptr overwriting greets: rosecurity team discovery: edcba note: sasser.e has...

CVE-2003-0533

The CVE-2003-0533 issue is a stack-based buffer overflow in LSASS (LSASRV.DLL) affecting multiple Windows platforms (NT 4.0 SP6a, 2000 SP2–SP4, XP SP1, Server 2003) and related products. The underlying flaw is in the DS RolerUpgradeDownlevelServer function invoked via DCERPC, which can cause an o...

CVE-2003-0533

Stack-based buffer overflow in certain Active Directory service functions in LSASRV.DLL of the Local Security Authority Subsystem Service LSASS in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute...

CVE-2004-0362

Multiple stack-based buffer overflows in the ICQ parsing routines of the ISS Protocol Analysis Module PAM component, as used in various RealSecure, Proventia, and BlackICE products, allow remote attackers to execute arbitrary code via a SRVMULTI response containing a SRVUSERONLINE response packet...

MS04-011: Microsoft Hotfix (credentialed check) (835732)

The remote host is missing a critical Microsoft Windows Security Update 835732. This update fixes various flaws that could allow an attacker to execute arbitrary code on the remote host. A series of worms Sasser are known to exploit this vulnerability in the wild. C Tenable Network Security, Inc...

CVE-2004-0362

Multiple stack-based buffer overflows in the ICQ parsing routines of the ISS Protocol Analysis Module PAM component, as used in various RealSecure, Proventia, and BlackICE products, allow remote attackers to execute arbitrary code via a SRVMULTI response containing a SRVUSERONLINE response packet...

Internet Security Systems Protocol Analysis Module (PAM) does not properly handle ICQ server response messages

Overview The Protocol Analysis Module PAM used by Internet Security Systems ISS intrusion detection and prevention products does not properly handle ICQ server response messages. An unauthenticated, remote attacker could execute arbitrary code by sending a specially crafted UDP packet. Descriptio...

Bagle.B Worm Detection

The remote host has the Bagle.B worm installed. This is a variant of the Bagle worm which spreads via email and has a backdoor that listens on port 8866. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid12063; scriptversion"1.26"; scriptcvsdate"Date: 2019/11/25";...

Bagle Worm Removal

The remote host had the Bagle worm installed. Nessus attempted to remove it by connecting to port 6777 of the host and using the built-in removal command. However, you should verify that : - The worm was removed properly - The remote host has not been altered in any other way. C Tenable Network...

CVE-2003-0746

Various Distributed Computing Environment DCE implementations, including HP OpenView, allow remote attackers to cause a denial of service process hang or termination via certain malformed inputs, as triggered by attempted exploits against the vulnerabilities CVE-2003-0352 or CVE-2003-0605, such a...