Section:  .. / 0305-exploits  /

Page 1 of 2
<< 1 2 >> Files 1 - 25 of 41
Currently sorted by: File SizeSort By: File Name, Last Modified

 ///  File Name: 0305-exploits.tgz
Description:
 Packet Storm new exploits for May, 2003.
File Size:77671
Last Modified:Jul 14 20:25:00 2003
MD5 Checksum:723abc458b5ea3d570004d5677c44135

 ///  File Name: b-WsMP3dvuln.txt
Description:
 INetCop Security Advisory #2003-0x82-017.b - New versions of WsMP3d are not patched against an old remote heap corruption overflow vulnerability. Remote exploit and advisory included.
Author:Xpl017Elz
Homepage:http://www.inetcop.org
File Size:20661
Last Modified:May 23 11:06:24 2003
MD5 Checksum:fee1e5ee6009d22f0754405163419c14

 ///  File Name: kerio.c
Description:
 Kerio Personal Firewall 2.1.4 and below remote code execution exploit that makes use of a replay attack against the channel for remote administration. Tested against Windows XP + SP1.
Author:Burebista
Homepage:http://www.reversedhell.net
File Size:11092
Last Modified:May 8 22:46:35 2003
MD5 Checksum:4ac52cfaa74d985b4484112a6cc52ee8

 ///  File Name: dsr-adv001.txt
Description:
 Firebird has 3 binaries: gds_inet_server, gds_drop, and gds_lock_mgr, which all use insufficent bounds checking in conjunction with getenv(), making each one susceptible to local exploitation. Enclosed are two local root exploits tested against versions 1.0.0 and 1.0.2 on FreeBSD.
Author:Bob, Knud Erik H jgaard
Homepage:http://www.dtors.net
File Size:10539
Last Modified:May 12 07:31:01 2003
MD5 Checksum:3b1e72930195b5834044974c51c259aa

 ///  File Name: core.axis.txt
Description:
 Core Security Technologies Advisory ID: CORE-2003-0403 - The Axis Network Camera HTTP server is vulnerable to an authentication bypass when a double slash is put in front of the admin directory in the URL. This allows a remote attacker to modify the configuration as they see fit and allows the root password to be reset. Doing this in conjunction with enabling the telnet server allows for a complete server compromise.
Author:Juliano Rizzo
Homepage:http://www.coresecurity.com/
File Size:6940
Last Modified:May 28 10:54:05 2003
MD5 Checksum:a5e3469f753ba4068c41d8a4e0396b5b

 ///  File Name: lsassaroot.zip
Description:
 Microsoft LSASS vulnerability auto rooter. Downloads and executes code from a FTP server.
Author:Sub
File Size:6891
Last Modified:May 17 16:24:57 2004
MD5 Checksum:54785e01d3034f714dbe01506d1c699f

 ///  File Name: kerio563.txt
Description:
 Kerio Mail Server 5.6.3 remote buffer overflow exploit. Adds wide open root account to /etc/passwd. Written based upon the vulnerability discussed here.
Author:B-r00t
File Size:6595
Last Modified:Jun 25 05:33:56 2003
MD5 Checksum:842c5e7826baf9519f128b2ea7d11c1b

 ///  File Name: sunone.txt
Description:
 The SunONE application server on Windows 2000 suffers from multiple vulnerabilities. The server allows a remote attacker to view the source code of JSPs, only logs the first 4042 characters of a request URI which allows an attacker to hide their attempts in the last 54 characters, has a cross site scripting issue, and has the username and password to the administrative server kept in clear text in a world readable file.
Author:SPI Labs
Homepage:http://www.spidynamics.com
File Size:5782
Last Modified:May 28 11:42:12 2003
MD5 Checksum:5695d1e0f86bf5009e22b5b2c09ac452

 ///  File Name: PFExploit.c
Description:
 Kerio Personal Firewall <= 2.1.4 and Tiny Personal Firewall <= 2.0.15 remote exploit that makes use of a buffer overflow condition discovered in the PFEngine used for both products.
Author:ThreaT
Homepage:http://s0h.cc/~threat
File Size:5500
Last Modified:May 9 02:50:00 2003
MD5 Checksum:c99e149fa6534d096f0bf1946334d73e

 ///  File Name: FTGatePro.txt
Description:
 Multiple buffer overflow vulnerabilities have been found in FTGate Pro Mail Server v. 1.22 (1328). The SMTP server for FTGate has unchecked buffers for the MAIL FROM and RCPT TO commands that allows for a remote attacker to overwrite the stack pointer and can lead to remote code execution.
Author:Dennis Rand
Homepage:http://www.Infowarfare.dk
File Size:5410
Last Modified:May 8 23:05:00 2003
MD5 Checksum:cb05dcfcd6da501e8cc1862aed2b8cac

 ///  File Name: shoutbox.txt
Description:
 Webfroot Shoutbox v2.32 and below suffers from a directory traversal and code injection vulnerability that allows a remote attacker to view any file on the system and the ability to commit remote command execution.
Author:pokleyzz
Homepage:http://www.scan-associates.net
File Size:5339
Last Modified:May 29 07:18:11 2003
MD5 Checksum:c7ef81a32642aa53a38a48220ff5a153

 ///  File Name: baby.txt
Description:
 Baby FTP server version 1.2 allows for a directory traversal attack that lets a remote attacker view any file on the system by using non-standard characters with CWD. The server will also crash if multiple connections from the same host occur.
Author:dr insane
File Size:5034
Last Modified:May 29 07:22:07 2003
MD5 Checksum:6a83ff2f09457fbac90e7f8623734cee

 ///  File Name: ne0.c
Description:
 Microsoft IIS versions 5.0 and 5.1 remote denial of service exploit that makes use of the vulnerability recently published by SPI dynamics. Full advisory located here.
Author:Shash
File Size:4859
Last Modified:May 31 05:14:21 2003
MD5 Checksum:d78db11ab87227da9b8cfab3f0c3f213

 ///  File Name: geeklog.txt
Description:
 Geeklog version 1.3.7ar1 and below is susceptible to multiple vulnerabilities. There is a SQL integer manipulation flaw in the authentication script that will allow a remote attacker to get administrative access and there is also a lack of error checking when images are uploaded that allow an attacker to upload files with php code that can be used to execute any command as apache user on remote server.
Author:pokleyzz
Homepage:http://www.scan-associates.net
File Size:4831
Last Modified:May 30 12:05:29 2003
MD5 Checksum:3dd132c2b949914f5bf8010768bf739e

 ///  File Name: unhappycgi.txt
Description:
 Happymall E-Commerce software versions 4.3 and 4.4 are vulnerable to remote command execution due to a lack of input validation in the normal_html.cgi script.
Author:revin aldi
File Size:3924
Last Modified:May 9 02:06:22 2003
MD5 Checksum:eea4bf616681ba3ff211c469fb4e6771

 ///  File Name: priv8cdr.pl
Description:
 Local root exploit for Cdrecord versions 2.0 and below under Linux. Version 1.10 is not vulnerable.
Author:wsxz
Homepage:http://www.priv8security.com
File Size:3448
Last Modified:May 14 00:19:43 2003
MD5 Checksum:c95424f34a72c67b6e9626c83e17528f

 ///  File Name: badblue052003.txt
Description:
 BadBlue web server versions 2.2 and below have a vulnerability that allows remote attackers to gain administrative control of a server. The engine attempts to restrict access to non-html files by requiring that 'ht' be the first letters of the target file's extension, and also requiring that requests to access '.hts' files are submitted by 127.0.0.1 and contain a proper 'Referer' header. This security feature is accomplished with a simple binary replace of the first two characters of the file extension. The two security checks are performed in an incorrect order, meaning that the first security check can inadvertently bypass the latter.
Author:Matthew Murphy
File Size:3384
Last Modified:May 23 18:01:40 2003
MD5 Checksum:54488984601b3f7a45a3c8af421f9df2

 ///  File Name: snitz_exec.txt
Description:
 Snitz Forums v3.3.3 has an SQL injection vulnerability in its register.asp page with its Email variable. Because register.asp does not check user input, remote users can execute stored procedures, such as xp_cmdshell, to arbitrarily run non-interactive commands on the system.
Author:sharpiemarker
File Size:3240
Last Modified:May 13 03:29:07 2003
MD5 Checksum:e42ffa559af965cebbaf2148bf04a648

 ///  File Name: Owl_Intranet_Engine.txt
Description:
 Owl v0.71, the multi user document repository, fails to actually authenticate a login name given. If a completely fake login name is passed, an attacker can get in without any valid session id.
Author:Christopher M Downs
Homepage:http://www.angrypacket.com
File Size:3149
Last Modified:May 15 04:20:03 2003
MD5 Checksum:77ea64312fa5085245a0e207ac560633

 ///  File Name: rk.zip
Description:
 A vulnerability exists in the TFTP protocol implementation of the Polycom 6100-4 NetEngine 3.4.8 ADSL router that allows a specially crafted packet to cause a denial of service.
Author:Lorenzo Cerulli, Fabio Annunziato
File Size:3148
Last Modified:May 7 23:41:42 2003
MD5 Checksum:5c2fae63a7418ad6e85bbba769f75539

 ///  File Name: katax.c
Description:
 Local root exploit for Leksbot binary KATAXWR that was accidentally packaged setuid. Tested against Debian Linux 3.0.
Author:gunzip
File Size:3003
Last Modified:May 13 03:18:55 2003
MD5 Checksum:7fc6383cee7a290c0d224a52030c144a

 ///  File Name: priv8gbn.pl
Description:
 Remote exploit for a buffer overflow in the Gnome Batalla Naval Game Server version 1.0.4. Gives user id of the account running the game server. Tested against Mandrake 9.0.
Author:wsxz
Homepage:http://Priv8security.com
File Size:2926
Last Modified:May 28 10:13:26 2003
MD5 Checksum:d975b9a72eb72639c21c11ad67d727b2

 ///  File Name: AudixShell.txt
Description:
 The Intuity Audix voicemail system by default is maintained over port 23 (telnet) in a restricted command interface. If an attacker has a known account/password, they can circumvent this interface and get an unrestricted shell using rexec.
Author:Cushman
File Size:2812
Last Modified:May 9 02:14:38 2003
MD5 Checksum:2c3a7d50bf7c2fc248591ce4639f8b04

 ///  File Name: 05.22.03.txt
Description:
 iDEFENSE Security Advisory 05.22.03 - iisPROTECT is a utility designed to provide password protection to web directories similar to the htaccess method utilized by Apache. When protected files are referenced through different URL-encoded representations, this authentication can be completely bypassed.
Homepage:http://www.idefense.com/
File Size:2767
Last Modified:May 23 10:32:29 2003
MD5 Checksum:3b4927deb5e89ac467996a11b1770203

 ///  File Name: jscriptdll.txt
Description:
 Microsoft's Windows Script Engine within the Windows operating system has a flaw in its implementation of jscript.dll. When a malicious web page is loaded with code that points to self.window() random errors and lock ups occur in Internet Explorer. Tested against IE versions: 5.01 (Win2000), 5.5(Win98SE), 6.0(WinXP). Vulnerable jscript.dll versions: 5.1.0.8513 (Win2000), 5.5.0.8513 (Win98SE), 5.6.0.6626 (WinXP Pro), 5.6.0.8513 (Win2000).
Author:Gregory R. Panakkal
Homepage:http://www.evilcreations.net/junkcode/
File Size:2699
Last Modified:May 13 04:00:09 2003
MD5 Checksum:5207dde07c93e540b2fe22ace39d7c89