WebWho+ is a free cgi script written by Tony Greenwood for executing whois queries via the www. Though it does perform checks for shell escape characters on some parameters, it misses the 'type' variable and allows for malicious input to be sent to a shell. It is possible to execute arbitrary commands on a webserver running WebWho+ v1.1 with the uid of the webserver (usually nobody).
GlFtpd is a popular alternative to the mainstream unix ftp daemons and is currently in wide use on the internet. There are three known serious vulnerabilities in GlFtpd. The first problem is an account which is created by default upon installation of the software. The username and password for this account are both “gltftpd” and the uid is 0 (root). This account can only be used by users connecting from localhost. This is a problem because “local users” can log into a host’s glftpd with root privileges (and compromise the entire system). The second problem is world writeable ~/site directory. The last problem is the possibility to execute arbitrary commands on the target host. Glftpd comes with a feature called ZIPCHK, which is a command sent to the ftpd to check the integrity of a zip file on the server remotely. ZIPCHK executes “unzip” on the file without validating the filename input. With a special filename such as “ ; ls”, it is possible to execute arbitrary commands as the uid of glftpd.
ZBServer Pro 1.5 has an unchecked buffer in the code that handles GET requests. This weakness allows for the execution of arbitrary code.
Using the window.external.NavigateAndFind() function it is possible for a remote server to execute arbitrary javascript code on an Internet Explorer client machine in the local security context. This function is used to load a web document and search it for specific strings, displaying the results in a secondary frame. However, the function will accept URLs of the form 'javascript:', and should such a URL to passed to the function, the javascript is executed in the security context of the content of the secondary frame, and has access to that frame's current content. This weakness could be used to retrieve pwl files, the local SAM database, cookies or any other locally stored information that the user has read access to. The attack could be made via the web, or in an HTML email or newsgroup posting.
WMMon is a multiple platform Window Maker docking application. It monitors useful system information such as CPU load and disk activity. The application also allows the user to define commands that can be launched by mouse clicks in the WMMon window. If the WMMon application is installed SUID or SGID, these privileges are not dropped before executing commands that have been defined by the user. Since the user can configure the application to execute any command, a user can run a shell or any other executable with the privileges that WMMon has been installed with. The FreeBSD ports version of WMMon installs SGID kmem and older versions installed it as SUID root.
SCO Openserver and SGI IRIX (6.2 confirmed, possibly others) are vulnerable to several buffer overflows in various shared libraries related to the X window system. This means that all programs which link to these libraries could be vulnerable to exploitation through buggy library calls. The vulnerable libraries are: LibX11, LibXt, LibXaw, LibXmu. This vulnerability may be similar to serious X library overflows, in our database as Bugtraq ID 237 (published in August, 1997) and the Sun X problems archived in our database as Bugtraq ID 238 (published in May, 1999).
The HELP function in GWWEB.EXE will reveal the path of the server, and combined with the '../' string, allow read access for any client to any .htm file on the server, as well as browseable directory listings. It is also possible to abend GWINTER.NLM by specifying a long string where the server expects a variable setting. Requesting the URL http ://victimhost/cgi-bin/GW5/GWWEB.EXE?HELP=../../../secret.htm or http ://victimhost/cgi-bin/GW5/GWWEB.EXE?HELP=../../../ will allow read access to any .htm file on the server, or browseable directory listings. Requesting the URL http ://victimhost/cgi-bin/GW5/GWWEB.EXE?[512+ chars] will abend GWINTER.NLM and may be possible to remotely execute arbitrary code via this buffer overflow.
DMI is the Desktop Management Interface, and is a suite of application management programs shipped with Sun's Solaris. Each application that is managed through DMI has a MIF record (which contains information about its managable components and properties) that can be inserted into the MIF database (/var/dmi/db) through the dmisp (DMI Service Providor) daemon. There is no authentication performed on who submits new MIFs, meaning anybody can do it. This creates two possible denial of service conditions. The first is consumption of disk space in /var. There are no limits (set by default) on how much space the DMI database can use. This may be used in conjunction with other vulnerabilities to prevent logging, etc. A second vulnerability is a buffer overflow condition in dmispd when MIFs are a certain size. It may be exploitable beyond being a simple denial of service (it may be possible to execute arbitrary code as root remotely). To exploit this vulnerability, an attacker can use the command 'echo `perl -e "print 'A' x 1000"` > /usr/home/btellier/my.mif' followed by 'dmi_cmd -CI ../../../usr/home/btellier/my.mif' which will cause dmispd to segfault.
Infoseek's Ultraseek enterprise search server listens on port 8765 by default for HTTP commands. The code that handles GET commands has an unchecked buffer that will allow arbitrary code to be executed if it is overflowed.
VDOLive Player v3.02 has an unchecked buffer that can allow arbitrary code to be executed if a specially-crafted .vdo file is loaded.
Services By CQR