A vulnerability exists in Anaconda Foundation Directory which allows a remote user to traverse the filesystem of a target computer. This may lead to the disclosure of file and directory contents. Arbitrary files can be accessed through the use of double dot '../' techniques and by appending a null byte followed by '.html' to the extension of the filename in question. The file 'apexec.pl' in conjunction with the variable 'template' are subject to this directory traversal vulnerability.
A denial of service vulnerability exists in the JRun web application server. Requesting multiple malformed URLs by way of the java servlet, will cause the JRun application server to stop responding.
A remote user could gain read access to known files outside of the root directory in a SEDUM HTTP Server. Requesting a specially crafted URL composed of '../' or '.../' sequences will disclose the requested file.
A buffer overflow vulnerability exists in CGIs using qDecoder 4.0~5.0.8 due to boundary delimeter over 254 characters in the header Content-Type: multipart/form-data. An attacker can exploit this vulnerability by sending a maliciously crafted POST request to the vulnerable CGI, resulting in remote code execution with the privileges of the webserver.
A problem with the man command may allow for the elevation of privileges. Due to the handling of format strings by the -l argument of the man command, it may be possible for a local user to pass format strings through the man command, which could allow a user to write to a specific address in the stack and overwrite variables, including the return address of functions on the stack. man, as implemented with some distributions of the Linux operating system, is included as an SUID root binary. It may be possible for a malicious user with local access to execute arbitrary code on the stack, and potentially gain elevated privileges, including administrative access.
A problem in the ximp40 library packaged with Openwin could allow a user to gain elevated privileges. Due to a problem with the handling of input by the programs linked against ximp40.so.2, it is possible to supply a long string, approximately 272 bytes, to the arg0 of the command, which will overwrite stack variables, including the return address of the program.
Solaris 2.4, 2.5, and 2.51 x86 are vulnerable to a buffer overflow in nlps_server, a process residing on port 2766 when installed. Attackers can exploit this buffer overflow to gain remote root access.
A vulnerability in the IDENT function of sendmail 8.6.9 allows attackers to obtain remote root access. The exploit involves running a shell script on a remote host, which is then used to execute commands on the target machine. The attacker can then obtain the contents of the /etc/passwd file, which contains the usernames and passwords of all users on the system.
NSCA httpd prior to and including 1.5 and Apache Web Server prior to 1.0 contain a bug in the ScriptAlias function that allows remote users to view the source of CGI programs on the web server, if a ScriptAlias directory is defined under DocumentRoot. A full listing of the CGI-BIN directory can be obtained if indexing is turned on, as well. This is accomplished by adding multiple forward slashes in the URL. The web server fails to recognize that a ScriptAlias directory is actually redirected to a CGI directory when this syntax is used, and returns the text of the script instead of properly executing it. This may allow an attacker to audit scripts for vulnerabilities, retrieve proprietary information, etc.
When running in debug mode, Wu-ftpd logs user activity to syslog in an insecure manner. An attacker with control over the server's hostname resolving facility could exploit this vulnerability to get root access remotely on the victim host.
Services By CQR