|
|
Some of these exploits are from Bugtraq and Security Bugware |
|
To Change Sort Order, Click On A Category.
Sorted By: Downloads. |
| File Name |
Downloads |
File Size |
Last Modified |
| adv_telnet1.txt | 2918 | 2455 | Sep 7 12:54:11 2000 |
| Hyperterminal, the default telnet program on Windows 98, contains a buffer overflow vulnerability. It is possible to exploit via IE using a long telnet: URL. Homepage: http://www.meliksah.net. By Meliksah Ozoral |
| expl395.c | 2421 | 6615 | Sep 8 16:06:01 2000 |
| Screen 3.9.5 and below local root exploit for Linux. Tested against SuSE 6.1. By Ihaquer |
| glibc-language.c | 2296 | 4337 | Sep 8 16:02:45 2000 |
| GLIBC 2.1 language local root exploit. Includes bypassing Solar Designer Stack Patch. Tested against Debian 2.1/2.2, exploits Glibc and /usr/bin/msgfmt. By Z33d |
| klogd-linux.txt | 2192 | 3718 | Sep 18 18:41:44 2000 |
| Kernel logging daemon klogd in the sysklogd package for Linux contains a "format bug" making it vulnerable to local root compromise (successfully tested on Linux/x86). There's also a possibility for remote vulnerability under certain (rather unprobable) circumstances and a more probable semi-remote exploitableness with knfsd. Homepage: http://www.secmod.com. By Jouko Pynnen |
| icq.greeting-card.tx..> | 2175 | 383 | Sep 6 16:04:20 2000 |
| The ICQ Greeting Card service allows HTML commands to be sent to the target user. Any malicious HTML such as file:///c:/con/con can crash the system or exploit other HTML based vulnerabilities. Homepage: http://www.meliksah.net. By Meliksah Ozoral |
| napster.path-disclos..> | 2064 | 2168 | Sep 19 15:27:25 2000 |
| Napster sends the full path of all the MP3's it sends to the remote user. By Wade Lewis |
| win_2000.telnet.tgz | 1830 | 14812 | Sep 15 15:27:02 2000 |
| The Windows 2000 Telnet client can be launched via email or browser and automatically passes NTLM authentication credentials to a telnet server. Proof of concept exploit includes a modified telnet server which causes the w2k telnet client to auto authenticate and prehash-ntlm.c which can be used to launch a dictionary attack against a retrieved hash. By Monti |
| wu-lnx.c | 1797 | 7138 | Sep 28 15:06:26 2000 |
| Linux wu-ftpd - 2.6.0(1) (tested on RH6.2 wu from rpm). By vsz_ |
| netscape.overflow.tx..> | 1768 | 1478 | Sep 28 15:51:39 2000 |
| Netscape Navigator is vulnerable to trivial, remote buffer overflow attack when viewing prepared html. By Michal Zalewski |
| killbnc.c | 1572 | 2735 | Sep 8 09:41:25 2000 |
| BNC 2.6.4 remote denial of service exploit. Causes all users who are connected to IRC by BNC by exhausting the resources of the BNC server. Homepage: http://www.fakehalo.org. By Vade79 |
| tco.txt | 1471 | 4393 | Sep 21 17:05:59 2000 |
| Synnergy Laboratories Advisory SLA-2000-14 - The BSD/Linux telnet client has a stack overflow which is not usually a security problem, except in the case of a restricted shell environment which allows users to set environment variables and run telnet. Perl proof of concept exploit included. Homepage: http://www.synnergy.net. By Dethy |
| MultiHTML.txt | 1409 | 1392 | Sep 15 15:21:31 2000 |
| MultiHTML (/cgi-bin/multihtml.pl)is a CGI script which has a vulnerability allowing remote users to read any file on the webserver. By Niels Heinen |
| sambar-http.txt | 1352 | 2138 | Sep 14 17:37:10 2000 |
| Sambar Server 4.4 Beta 3 and below for WinNT, Win95 OSR2, (possibly Linux affected) contains a vulnerability which allows remote users to browse the filesystem of the webserver. Fix available here. Homepage: http://www.synnergy.net. By Dethy |
| multihtml.c | 1345 | 4884 | Sep 19 17:17:00 2000 |
| Multihtml.c is a remote exploit for /cgi-bin/multihtml.pl, versions previous to 2.2 which spawns a remote shell. Homepage: http://www.r00tabega.org. By Bansh33, Zillion |
| linstatex.c | 1252 | 6344 | Sep 28 15:17:44 2000 |
| Remote root overflow for linux rpc.statd SM_UNMON_ALL vulnerability. Author Unknown. |
| anyportal-0.1.txt | 1160 | 1731 | Sep 11 12:54:48 2000 |
| Anyportal v0.1 allows remote users to read any file on the webserver by submitting modified forms. Homepage: http://www.nightbird.free.fr. By Zorgon |
| axur.c | 941 | 18878 | Sep 28 15:12:17 2000 |
| Q-POP 2.53 Remote Overflow. By Gustavo Scotti |
| cpmdaemon.txt | 918 | 13346 | Sep 6 14:33:27 2000 |
| cpmdaemon is a program that runs as a daemon or a cgi which allows changing of passwords. It allows brute force dictionary attacks against user passwords without any logging. Includes exp_cpmdaemon.c proof of concept code. Homepage: http://www.s0d.org. By El Nahual |
| rovikingxploit.c | 896 | 10846 | Sep 12 21:28:58 2000 |
| Robotex Viking Server 1.0.6 Build 355 and prior for Windows 95 and NT remote buffer overflow exploit. Binds a shell to a port. By Wildcoyote |
| ezbounce.c | 871 | 6526 | Sep 29 15:27:58 2000 |
| Ezbounce version (0.85.2 and probably others) remote overflow exploit for RedHat 6.0. By SectorX |
| wftpd241-12-2.txt | 870 | 875 | Sep 5 22:08:25 2000 |
| WFTPD/WFTPD Pro 2.41 RC12 devulges sensitive information by revealing the full path of the current directory. This is fixed in WFTPD/WFTPD Pro 2.41 RC13. Exploit details included. Homepage: http://bluepanda.box.sk. By Blue Panda |
| horde-imp.txt | 809 | 3075 | Sep 12 17:21:12 2000 |
| The IMP-2.2.0 webmail interface contains a bug in the the library file "horde.lib" which allows commands to be executed under the UID which the webserver runs as. Exploit information included. Patch available here. By Christian Winter |
| rudp.c | 799 | 7767 | Sep 28 15:16:44 2000 |
| GDM Remote Exploit based on the original bug found by Chris Evans. Vulnerable version : gdm-2.0beta2-23 ( gnome and single version ). Not Vulnerable : 1.0.0.35. Vulnerable Platforms : RedHat 6.0-6.2. By Crashkiller |
| auction.weaver.pl | 789 | 2369 | Sep 6 16:10:39 2000 |
| Auction Weaver 1.02 Lite remote proof of concept exploit. Spawns an xterm by exploiting an insecure open() call. Homepage: http://teleh0r.cjb.net. By Telehor |
| phpPhotoAlbum.txt | 785 | 1649 | Sep 11 12:46:49 2000 |
| phpPhotoAlbum v0.99 and below for Windows and Unix allows remote users to read any file on the system with priviledges as the httpd. Fix available here. Homepage: http://www.synnergy.net. By Pestilence |
| innd.c | 782 | 7984 | Sep 28 15:23:02 2000 |
| INND/NNRP remote root overflow. Overflow occurs in the From: field. Affects INND/NNRP versions prior to 1.6.X. Author Unknown. |
| wftpd241-12.txt | 773 | 1603 | Sep 5 22:06:19 2000 |
| WFTPD/WFTPD Pro 2.41 RC12 contains a remote denial of service vulnerability which does not require a valid login/password. Perl exploit code included. Homepage: http://bluepanda.box.sk. By Blue Panda |
| yabb.txt | 771 | 2240 | Sep 12 21:31:58 2000 |
| Yabb 9.1.2000 and prior for Windows and Unix is a web based BBS system which has a vulnerability in YaBB.pl which allows remote attackers to view any file on the system. Homepage: http://www.synnergy.net. By Kostas Petrakis |
| VIGILANTE-2000008.tx..> | 710 | 2142 | Sep 6 14:41:23 2000 |
| Vigilante Advisory #8 - NTMail Configuration Service v5 & v6 denial of service. The web configuration running on TCP port 8000 does not flush incomplete HTTP requests, and thus it is possible to use up all the server ressources within a very short time. Homepage: http://www.vigilante.com. By Vigilante |
| locale.c | 690 | 3488 | Sep 12 21:39:31 2000 |
| locale.c is a local root exploit for the glibc / locale format string bug. Tested against RedHat 6.2 with kernel 2.2.16. Homepage: http://www.nsfocus.com. By Warning3 |
| webtv.tar.gz | 690 | 654 | Sep 21 16:59:40 2000 |
| Exploit for the recently published Denial of Service Vulnerability in WebTV for Windows discussed on Bugtraq ID 1671 published on 9/12/2000. By Doom and Netsym |
| mobiusdocdix.c | 686 | 9954 | Sep 12 21:26:10 2000 |
| Mobius DocumentDirect for the Internet 1.2 remote exploit. Binds a shell to a port. By Wildcoyote |
| VIGILANTE-2000012.tx..> | 678 | 2206 | Sep 18 16:59:56 2000 |
| Vigilante Advisory #12 - Mdaemon 3.1.1 for Windows NT includes Webconfig and Worldclient which listen to TCP port 3000 and 3001. They both are vulnerable to a heap overflow vulnerability which could be used to execute arbitrary code. Fix available here. Homepage: http://www.vigilante.com. By Vigilante |
| winshellcode.h | 670 | 23790 | Sep 28 14:57:20 2000 |
| WinShellCode. win32 portbinding shellcode. Homepage: http://www.cnns.net. By sunx |
| qpop3b.c | 648 | 8240 | Sep 28 15:01:33 2000 |
| QPOP 3.0beta AUTH remote root stack overflow (linux x86 version) |
| VIGILANTE-2000013.tx..> | 639 | 1335 | Sep 19 16:07:14 2000 |
| Vigilante Advisory #13 - WinCOM LPD V1.00.90 for Windows NT contains a denial of service vulnerability. A steady stream of LPD options sent to TCP port 515 will eventually consume all the memory on that host. Homepage: http://www.vigilante.com. By Vigilante |
| wu30.c | 633 | 8185 | Sep 28 15:08:53 2000 |
| Remote root exploit for wu-ftpd on SCO unix. Based on: ADMwuftpd.c from duke. By The Dark Raver |
| VIGILANTE-2000009.tx..> | 631 | 2184 | Sep 13 12:37:11 2000 |
| Vigilante Advisory #9 - Internet Information Server (IIS) 4.0 for Windows NT 4.0 is vulnerable to a denial of service attack as described in ms00-063 in which a certain series of requests can cause INETINFO.EXE to gradually consume all system ressources (99-100% CPU and all memory). When the pagefile can't expand any further, INETINFO.EXE is killed by the operating system. Homepage: http://www.vigilante.com. By Vigilante |
| typsoft-ftpd.txt | 601 | 2318 | Sep 12 11:27:39 2000 |
| TYPSoft FTP Server 0.78 for Windows 9X and WinNT is vulnerable to a denial of service attack. Sending a long user or pass commands causes the server to hang and increase system resources. Perl exploit included. Homepage: http://www.synnergy.net. By Dethy |
| 12250.c | 599 | 1405 | Sep 28 14:59:02 2000 |
| IMAPrev1 12.2xx exploit (lsub bug). Slackware 4.0 remote overflow. By del0rean |
| siemens.ipphone.txt | 582 | 2414 | Sep 28 15:50:02 2000 |
| The Siemens HiNet LP 5100 IP-phone is vulnerable to a buffer overflow when the GET request method is used with a large request size. Vulnerability can lead to a partial or complete crash of phone services. By Michal Zalewski |
| VIGILANTE-2000011.tx..> | 575 | 2082 | Sep 13 13:27:12 2000 |
| Vigilante Advisory #11 - Lotus Domino ESMTP Service Lotus Domino Release 5.0.2a contains a buffer overflow in the processing of SMTp commands, causing the service to crash. Tested on OS/2 Warp 4.5, it is assumed that other platforms are vulnerable as well. Homepage: http://www.vigilante.com. By Vigilante |
| klogd.exploit.txt | 569 | 3259 | Sep 27 14:01:49 2000 |
| Klogd Local Exploit. Envcheck is a Linux/x86 kernel module which strips dangerous environment variables before executing a new program, and which can be used to log these probably threatening events. However, a recent format string handling bug in klogd allows an attacker to overflow its buffer and execute arbitrary code. Homepage: http://www.iki.fi/ee/. By Esa Etelavuori |
| A092600-1 | 567 | 14389 | Sep 28 14:37:22 2000 |
| Atstake Security Advisory - PalmOS Password Retrieval and Decoding. Severity: Moderate. PalmOS offers a built-in Security application which is used for the legitimate user to protect and hide records from unauthorized users by means of a password. Passwords can easily be obtained and decoded allowing an attacker to access all private records on a Palm device. Homepage: http://www.atstake.com/research/advisories/2000/. By Kingpin |
| VIGILANTE-2000010.tx..> | 559 | 2336 | Sep 13 12:48:08 2000 |
| Vigilante Advisory #10 - Intel Express Switch series 500 crashes when a malformed ICMP packet is sent to the Intel Express Switch or a host behind it. The switch looses all routing functionality but continues to function as a switch, except for the fact that learning also crashes, so new connections are not "picked up". Fix available here. Homepage: http://www.vigilante.com. By Vigilante |
| fp-ext-dos.sh | 556 | 1026 | Sep 12 21:11:41 2000 |
| Frontpage Server Extension shtml.exe denial of service attack. Based on an advisory by www.xato.net. Vulnerable systems include Microsoft Windows 95, 98, NT 4.0 and NT 2000. Homepage: http://grazer.gz.ee. By Grazer |
| cisco.tar.gz | 521 | 7373 | Sep 23 12:49:02 2000 |
| Denial of service exploit for CiscoSecure ACS for Windows NT Server prior to release 2.4(3), as described in cisco.00-09-21.ciscosecure. Sends an oversized URL to TCP port 2002, causing the CSAdmin module to crash. Homepage: http://www.8op.com/rsh. By Doom and Netsym |
| thatware.txt | 513 | 2739 | Sep 1 11:00:20 2000 |
| Thatware is a news portal administration tool. The security vulnerabilities in Thatware allows attacker to gain administrative access to the application. Two exploits included. Fix: For a quick fix, simply rename admin.php3 and simply quote all numeric data in SQL statements. By Fabian Clone |
| tsql.c | 455 | 1640 | Sep 28 15:05:17 2000 |
| Msql local overflow. Author Unknown. |
| xsunsploit.c | 440 | 1589 | Sep 28 15:04:20 2000 |
| Solaris 7 Xsun(suid) local overflow - Solaris 2.7/(2.6?) x86 sploit no sparc code. By DiGiT |
| eject.locale.c | 429 | 4929 | Sep 12 20:12:50 2000 |
| Solaris 2.x locale exploit - exploits /usr/bin/msgfmt and /usr/bin/eject locale format bug for local root access. Homepage: http://www.nsfocus.com. By Warning3 |
| brwgate-dos.c | 420 | 1688 | Sep 27 14:48:46 2000 |
| Denial of service for NetcPlus BrowseGate 2.80 for Windows NT and 2000 when you sned more than 8000 characters in a GET / http-request, causing the system to crash. Homepage: http://securax.org/incubus. By incubus |
| DST2K0042.txt | 417 | 4607 | Sep 28 15:44:34 2000 |
| Delphis Consulting Plc Security Team Advisory DST2K0042 - The following vulnerability in Web+ Application Server under Linux has been discovered. Severity: High. If the default example scripts are installed it is possible to execute/read any file which Web+ user (default is 'nobody') has access to using the Web+Ping example. Homepage: http://www.delphisplc.com/thinking/whitepapers/. By Delphis Security Team |
| sco-httpx.c | 417 | 1653 | Sep 28 15:02:51 2000 |
| Scounix httpd Remote Exploit. |
| zgv-exploit.c | 413 | 1601 | Sep 12 20:43:37 2000 |
| Zgv 3.0 local exploit for Linux. Homepage: http://b0f.freebsd.lublin.pl. By Slash |
| screen-expl.c | 403 | 2125 | Sep 12 21:35:32 2000 |
| Screen 3.7.6 (and others) local root exploit. By Ihaquer |
| cxterm.c | 403 | 1699 | Sep 28 15:00:38 2000 |
| Local exploit for cxterm 5.1-p1. Tested on: RedHat 5.2/6.0, Slackware 3.6. By warning3@hotmail.com |
| pine421.txt | 399 | 3868 | Sep 27 14:44:05 2000 |
| Proof of Concept. There exists a vulnerability in Pine 4.21 involving the portion of code in charge of peroidically checking email when a pine client is open. By Arkane |
| alabanza.txt | 385 | 2474 | Sep 27 14:13:13 2000 |
| This hole is for the control panel of all Alabanza based resellers/hosts. There could be more bugs. This is serious enough since you can delete all resold domains for a particulr webhosting company. You can also change the default MX and CNAME records of all associated domains. By Weihan Leow |
| fi.sh | 382 | 1120 | Sep 28 15:13:56 2000 |
| FlagShip (from Red Hat Application CD) is a Database Development System for xBase based applications on nearly all Unix brands. Problem: /usr/bin/FSserial is world-writeable! We can replace it with an trojan and trick root to execute it. OS affected: Red Hat 6.0. By Narrow |
| unixware.scohelp.txt | 377 | 6643 | Sep 28 14:31:04 2000 |
| CORE SDI Security Advisory - SCO Unixware 7 default installation includes scohelp, an http server that listens on port 457/tcp and allows access to manual pages and other documentation files. The search CGI script provided for that purpose has a vulnerability that could allow any remote attacker to execute arbitrary code on the vulnerable machine with privileges of user "nobody". Homepage: http://www.core-sdi.com. By Ivan Arce |
| winweb.c | 365 | 1575 | Sep 12 21:20:00 2000 |
| winweb.c exploits the con/con bug to crash the Windows 98 webserver. By Castrol |
| xloadx.c | 357 | 2021 | Sep 28 15:10:36 2000 |
| Sco 5.0.4 local overflow using xload. Homepage: http://members.tripod.com/~ochodedos. By doble |
| explbsd395.c | 350 | 4506 | Sep 12 21:41:48 2000 |
| Screen 3.9.5 BSD local root exploit. Tested against OpenBSD. By Ihaquer |
| bland.c | 344 | 8862 | Sep 12 21:16:08 2000 |
| bland.c exploits a bug in Guantlet 5.0 which causes the firewall to hang when an invalid ICMP packet is sent to a machine which is forwarded through the firewall. Homepage: http://www.msg.net/firewalls/tis. By Mike Frantzen |
| DST2K0037.txt | 343 | 3730 | Sep 28 15:41:15 2000 |
| Delphis Consulting Plc Security Team Advisory DST2K0037 - It is possible to bypass the quotas imposed by QuotaAdvisor by utilizing data streams alternative to the default. Homepage: http://www.delphisplc.com/thinking/whitepapers/. By Delphis Security Team |
| i-was-bored.c | 309 | 4478 | Sep 12 11:30:50 2000 |
| Darxite Daemon v0.4 password authentication buffer overflow exploit. Spawns a remote shell. Homepage: http://www.synnergy.net. By Scrippie |
| SRADV00001.txt | 293 | 4805 | Sep 11 11:54:13 2000 |
| Secure Reality Pty Ltd. Security Advisory #1 - PHP's handling of uploads permits a remote attacker to manipulate PHP applications into opening arbitrary files on the server with the permission level of the user running the server. Almost any PHP program which provides upload capability is vulnerable. Homepage: http://www.securereality.com.au. By Secure Reality Advisories |
| Gopher2.3.1p0.c | 288 | 8477 | Sep 8 15:53:51 2000 |
| Gopher2.3.1p0 and below has many overflowable functions in the daemon. Most of them overflow with hardcoded data that gets passed along - making it not possible to change any pointers. The "halidate" function contains an exploitable buffer overflow - exploit code for linux included. Note: This is not related to the other vulnerability, authenticate.c, which has since been patched in 2.3.1p0. 2.3.1p0 is vulnerable to this. Homepage: http://www.fakehalo.org. By Vade79 |
| DST2K0032.txt | 268 | 4304 | Sep 28 15:28:05 2000 |
| DST2K0032: Multiple Issues with Talentsoft WebPlus Application Server. Delphis Consulting Internet Security Team (DCIST) discovered low to medium severity vulnerabilities in Webplus under Windows NT. Homepage: http://www.delphisplc.com/thinking/whitepapers/. By DCIST |
| DST2K0035.txt | 257 | 4910 | Oct 4 18:04:03 2000 |
| Delphis Consulting Plc Security Team Advisory DST2K0035 - CyberOffice Shopping Cart v2 under Windows NT allows remote users to gain access to the main database by default. Homepage: http://www.delphisplc.com/thinking/whitepapers. |
| rumple.tgz | 244 | 3072 | Sep 12 20:40:43 2000 |
| rumple.tgz exploits the recent ld.so unsetenv vulnerability in Caldera Openlinux. By Nimrood |
| hhp-kermit_smash.c | 241 | 1786 | Sep 19 15:13:47 2000 |
| C-Kermit local exploit. Versions 7.0.197 and below are vulnerable. Tested on Slackware 7, where it is not suid. It is suid on Olivetti X/OS R2.3, 3.x. Homepage: http://www.hhp-programming.net. By Loophole |
| csm.proxy.bypass.txt | 116 | 738 | Oct 5 18:21:05 2000 |
| The CSM proxy server's siteblocker feature can be bypassed by setting up your web browser to use an external proxy. By Hermann Tischendorf |
| 0009-exploits.tgz | 0 | 167744 | Nov 2 01:21:32 2000 |
| Packet Storm new exploits for September, 2000. |
 |
| |
| |
 |
