Packet Storm new exploits for March, 2001.
dc41d0896e54183fb228e0b24db8af30Georgi Guninski security advisory #40 - Security bugs in interactions between IE 5.x, IIS 5.0 and Exchange 2000. If a malicious web page is browsed with IE it is possible to list the directories of arbitrary IIS 5.0 servers to which the browsing user has access. Under certain circumstances it is also possible to read the user's email or folders if it is stored on an Exchange 2000 server with web storage (it uses IIS 5.0). It is also possible to create (or probably modify) files on the Exchange 2000 server with web storage. Example exploit included.
85beec7e8445644e67cb4fa185ca6a0cASPSeek by SWSoft allows remote users to view any file on the webserver via a /../ bug.
46cec92ad366b836aa5f1751d55f8f0bRemote buffer overflow exploit for ASPSeek by SWSoft. Tested against Aspseek v1.0.3 running on Red Hat 6.2.
15c85aa9f9e12cb5b98990e84cd5315cManhole.c is a local exploit for man. Bypasses non-executable stack patches. Tested against Slackware 7.1, Debian 2.2, SuSE Linux 6.3, 6.4, and 7.0.
8b78e5731e6124a250d964d2c2e26d0dIIS 5.0 / Windows 2000 WebDAV remote denial of service exploit - Sends a specially crafted request, as described in MS01-016.
a2cab69356c0b04e87dc3307f26a0c1cNamed v8.2.x remote root exploit - Uses the tsig bug. Only includes linux shellcode.
572799a470381b834d7cc0e07e523894This code exploits a bug in the glob() function used in some ftpd's (like proftpd, netbsd ftpd, iis ftpd). It sends a 'ls' command for which will take up about 100% of a systems memory, creating a very effective dos.
df4760b5d6daa9e70c4e505232f87908ftpsed.pl is a perl script which exploits a denial of service vulnerability in Proftpd v1.2 and below. Requires a username and password.
cf4a3464c6ceaaa5e194728e22f67628Joe 2.8 local exploit - Requires sysadmin intervention. Tested on FreeBSD 4.2-Release.
530287f848a25dff1eb7741d70ba2035Suq Diq v1.00 is a remote exploit for IBM Net.Commerce, WebSphere and possibly other IBM and Lotus applications as well. These products use Tripple DES with a fixed key by default, allowing remote users to gain the usernames and plaintext passwords of all Net.Commerce accounts. Exploit URL's included.
b23af7e5a65ee8fcd01f9846db2e10a6OpenSSH-2.2.0 remote exploit - Includes a wrapper to brute force the offset.
a975d944823b58f0e067a2c6cca0ae53Local exploit for /usr/X11R6/bin/ascdc v0.3-2-i386 which overflows the -c switch.
9e219e72bf260f2bb0957bf175ab7dc1Ssh-brute.sh brute force guesses root's password without being logged. See CLABS200101 for more information.
986fe09b26708b20752e93a261f6b8b9Imapd v12.264 remote exploit for Red Hat - Exploits an overflow in the LSUB command, which requires an account. Tested on Red Hat 5.1, 5.2, 6.0, 6.1, and 6.2 with IMAP4rev1 v10.223, v11.241, v12.250, and v12.264.
2943c1787b72ce3bf2bfe737ce29b72eSFGate v5.1 p11 gives sensitive information by allowing one to view a few lines of text from a file via an error message. Exploit URL included.
f9ed84c3893940a2fda06ebdbbea9de5PHP-Nuke v4.4.1a contains remote vulnerabilities because arbitrary information can be passed to MySQL via the saveuser() function and several others. It's possible for the attacker to change the e-mail address of one of the users and ask for the password to be sent to the e-mail address that the attacker have provided. Exploit URL included.
678f89d8935aa6ca1cad7f09eab50496FreeBSD 3.5.1 and 4.2 ja-elvis and ko-helvis (ports packages) local root exploit. Both come with a utility called elvrec that is installed suid root by default.
4ca21b5b596030f13a6882a0b80a67f3A quick fix against RFP2101 - PHP-Nuke v4.4 and below allows users to steal accounts via sql hacking.
8037a25480af2b21fdd09bcb932d4a38
© 2012 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed