Section: .. / 0008-exploits /
| /// File Name: |
ufsdump-x86.c |
Description:
|
/usr/lib/fs/ufs/ufsdump local root exploit for solaris 2.6 2.7 x86.
| | Homepage: | http://lsd-pl.net | | File Size: | 3114 | | Last Modified: | Sep 7 22:47:58 2000 |
| MD5 Checksum: | a63386ba40bab5b3d8a4c7f49f5e9223 |
|
| /// File Name: |
VIGILANTE-2000005.txt |
Description:
|
Vigilante Security Advisory - Watchguard Firebox Authentication dos vulnerability. Sending a malformed URL to tcp port 4100 causes Watchguard to shut down and require a reboot to restart. Fix available here.
| | Author: | Vigilante | | Homepage: | http://www.vigilante.com | | File Size: | 2090 | | Last Modified: | Aug 16 00:44:08 2000 |
| MD5 Checksum: | 3f541d31e07cd77684a3542ad46821b9 |
|
| /// File Name: |
VIGILANTE-2000006.txt |
Description:
|
Vigilante Security Advisory - The OS/2 Warp 4.5 FTP Server contains denial of service vulnerabilities which allow anyone who can connect to port 21 to crash the service. Fix available here.
| | Author: | Vigilante | | Homepage: | http://www.vigilante.com | | File Size: | 1763 | | Last Modified: | Aug 16 00:48:42 2000 |
| MD5 Checksum: | 076354db31d3da7d9ef4e70cab192a03 |
|
| /// File Name: |
VIGILANTE-2000007 |
Description:
|
Vigilante Advisory #7 - A malicious user can crash an Intel Express 550F or a host behind it by sending a packet with a malformed header. To restart the box you need remove it from it's power source as the reset button loses functionality as well. Affected systems: Intel Express Switch 550F - Firmware version 2.63 - Firmware version 2.64.
| | Author: | Vigilante | | Homepage: | http://www.vigilante.com | | File Size: | 1871 | | Last Modified: | Aug 28 11:16:01 2000 |
| MD5 Checksum: | 70f964bfc3be8ff1be7c1a6ab323c0e2 |
|
| /// File Name: |
vpn-root.txt |
Description:
|
RapidStream has hard-coded the 'rsadmin' account into the sshd binary in the appliance OS. The account has been given a 'null' password in which password assignment and authentication was expected to be handled by the RapidStream software itself. The vendor failed to realize that arbitrary commands could be appended to the ssh string when connecting to the SSH server on the remote vpn. This in effect could lead to many things, including the ability to spawn a remote root shell on the vpn.
| | Author: | Loki | | File Size: | 2506 | | Last Modified: | Sep 1 00:55:18 2000 |
| MD5 Checksum: | e652b5019d76b70669b11034ae0542a7 |
|
| /// File Name: |
vqserver.dos.txt |
Description:
|
vqServer version 1.4.49 is vulnerable to a denial of service attack by sending a malformed URL request. Tested on Windows version. The latest edition of vqServer (1.9.47) is unaffected.
| | Author: | nemesystm | | Homepage: | http://dhcorp.cjb.net | | File Size: | 2228 | | Last Modified: | Aug 29 05:25:00 2000 |
| MD5 Checksum: | 303c9106b865941caabe75045152da02 |
|
| /// File Name: |
wais.pl.advisory.txt |
Description:
|
The wais.pl CGI written by Tony Sanders provides means to access the waisq WAIS client via the webserver. Waisq contains buffer overflows allowing remote code execution which can be exploited via wais.pl. In addition, files owned by nobody on the webserver can be overwritten with arbitrary content. Includes exploit for Linux/x86.
| | Author: | Scrippie | | Homepage: | http://www.synnergy.net | | File Size: | 13976 | | Last Modified: | Aug 14 19:36:58 2000 |
| MD5 Checksum: | 795f85e6d55de6d0878a8c35c77da7a9 |
|
| /// File Name: |
wcGoph.c |
Description:
|
Gopher+ v2.3.1p0 remote exploit - Spawns a remote shell on tcp port 36864 under the UID that the gopher+ daemon runs as. Tested against Linux Slackware 3.6 / 7.0.
| | Author: | WC | | File Size: | 7419 | | Last Modified: | Aug 14 02:04:33 2000 |
| MD5 Checksum: | a3b6c54833b546a3182097e891afa9ad |
|
| /// File Name: |
WDK_v1.0.vuln.txt |
Description:
|
The Javaserver Webserver Development Kit (WDK) v1.0 contains a .. vulnerability allowing remote attackers to read any file on the system with the permissions of the webserver. The server typically resides on TCP port 8080 and instructions for identifying this server are given.
| | Author: | Kevin Finisterre | | File Size: | 1517 | | Last Modified: | Aug 29 05:34:19 2000 |
| MD5 Checksum: | 942419ad40c9d395eabf61da00278016 |
|
| /// File Name: |
webmail.txt |
Description:
|
-Web Application Security Survey- Results show that Microsoft Hotmail, Excite, Altavista, E-Bay, Lycos, Netscape WebMail, E-Trade, Infoseek/Go.com and their users are all currently vulnerable to web based attack. The following report is the result of a two hour security survey of high profile webmail and auction services offered free over the internet. This survey is in no way extensive or thorough. It serves only as "proof of concept" that these types of services are vulnerable to attack on a wide scale. All the following vulnerabilities are currently active as of Aug. 25, 2000. The following webmail vulnerabilities all stem from the same problem. The attacker has the ability to pass unfiltered malicious HTML/JavaScript into the target users web environment.
| | Author: | D-Krypt. | | File Size: | 7708 | | Last Modified: | Aug 30 23:45:09 2000 |
| MD5 Checksum: | 03aafc9115dd4b8baf4a413167bc2ea3 |
|
| /// File Name: |
websitepro.txt |
Description:
|
WebSite Pro is a Web Server for Win95/98/NT platforms. The vulnerability (or bad server administration) allows any user to create arbitrary files with arbitrary text on the victim machine, from the Internet web browser.
| | Author: | a default installation, any user can create or uploads files to the victim machine running a vulnerable version of WebSite Pro. The problem is a bad "protection access" of the main directories on the machine. | | File Size: | 3528 | | Last Modified: | Sep 11 18:58:50 2000 |
| MD5 Checksum: | 923f9c6216a742ebff00f589bf593f03 |
|
| /// File Name: |
word-access.txt |
Description:
|
Georgi Guninski security advisory #17 - MS Word and MS Access 2000 (with or without Service Release 1a) allow executing arbitrary programs if a Word document is opened. This may be exploited also by visiting a web page with IE or opening/previewing HTML email message with Outlook. In order this to work, the user must be able to access a mdb file, which resides either on an UNC share or a local drive. This allows taking full control over user's computer. Demonstration exploit available here or here.
| | Author: | Georgi Guninski | | Homepage: | http://www.nat.bg/~joro | | File Size: | 2984 | | Last Modified: | Aug 10 01:23:51 2000 |
| MD5 Checksum: | eb038ae038008adf38ec1a34dbcc3916 |
|
| /// File Name: |
xgopher.c |
Description:
|
Gopher+ daemon v2.3 remote root buffer overflow exploit - Tested against Slackware Linux 3.6 and 7.0. Adds a line to /etc/passwd.
| | Author: | Vade79 | | Homepage: | http://www.realhalo.org | | File Size: | 7768 | | Last Modified: | Aug 13 00:57:45 2000 |
| MD5 Checksum: | c14ac8b3755c45bc40fc054898920107 |
|
| /// File Name: |
xitdos.c |
Description:
|
Xitami Webserver v2.4d3 and below are vulnerable to a remote dos attack. Sending malformed data to port 81 will cause the server to stop responding. Tested agasinst Xitami on Win95/98/NT4.0.
| | Author: | Mozy | | File Size: | 5547 | | Last Modified: | Aug 9 01:05:50 2000 |
| MD5 Checksum: | fe429b58f15ba97c9b34dc2ce6ffe97e |
|
| /// File Name: |
xlock-x86.c |
Description:
|
/usr/openwin/bin/xlock local root exploit for solaris 2.5 2.5.1 x86.
| | Homepage: | http://lsd-pl.net | | File Size: | 2152 | | Last Modified: | Sep 7 22:49:34 2000 |
| MD5 Checksum: | e400d0d4e9a157de2c7c3689ed622089 |
|
| /// File Name: |
xperl.sh |
Description:
|
Suidperl v5.00503 and below local root exploit which exploits an undocumented /bin/mail feature when perl wants to notify root on inode race conditions. Tested on Redhat 6.x/7.0.
| | Author: | Michal Zalewski | | Homepage: | http://lcamtuf.na.export.pl | | File Size: | 5756 | | Last Modified: | Aug 9 02:19:43 2000 |
| MD5 Checksum: | 50a48f4a8f99682d1282169e08046448 |
|
| /// File Name: |
xslrnpull.c |
Description:
|
Slrnpull.c exploits a local buffer overflow vulnerability in slrnpull version 0.9.6.2, which is setgid news. Tested against RedHat 6.2.
| | Author: | Vade79 | | Homepage: | http://www.realhalo.org | | File Size: | 2272 | | Last Modified: | Aug 23 01:39:37 2000 |
| MD5 Checksum: | 71914e4011b9a4a07c80e1c6268761eb |
|
| /// File Name: |
xsun-x86.c |
Description:
|
/usr/openwin/bin/xsun local root exploit for solaris 2.6 2.7 x86.
| | Homepage: | http://lsd-pl.net | | File Size: | 2138 | | Last Modified: | Sep 7 22:33:09 2000 |
| MD5 Checksum: | c39ce6d1de19677fe62ea2af0b62c33c |
|
| /// File Name: |
xsun.c |
Description:
|
/usr/openwin/bin/xsun local root exploit for solaris 2.6 2.7 sparc.
| | Homepage: | http://lsd-pl.net | | File Size: | 1683 | | Last Modified: | Sep 7 22:09:30 2000 |
| MD5 Checksum: | 50ff4d41f3cdbc4729c6a103a1fe385c |
|
|
|
|
|
![.:[ packet storm ]:.](/images/ps-ani.gif)
