Canna is a Japanese input system available as free software. Canna provides a unified user interface for inputting Japanese. Canna supports Nemacs(Mule), kinput2 and canuum. All of these tools can be used by a single customization file, romaji-to-kana conversion rules and conversion dictionaries, and input Japanese in the same way. Canna converts kana to kanji based on a client-server model and supports automatic kana-to-kanji conversion. The Canna subsystem on certain UNIX versions contains a buffer overflow in the 'canuum' program. Canuum is a Japanese input tty frontend for Canna using uum. Certain versions have a buffer overflow via unchecked user supplied data in the -k,-c,-n options. Since this program is installed SUID root this attack will result in a root level compromise.
Canna is a Japanese input system available as free software. Canna supports Nemacs(Mule), kinput2 and canuum. All of these tools can be used by a single customization file, romanji-to-kana conversion rules and conversion dictionaries, and input Japanese in the same way. Canna contains a buffer overflow in the 'uum' program. Uum is a Japanese input tty frontend for Canna. Regrettably, certain versions are vulnerable to a buffer overflow attack via unchecked user supplied data with the '-D' option. Since 'uum' is installed as SUID root this may result in a root level compromise.
The Avirt Mail Server 3.3a and 3.5 packages are vulnerable to a remote buffer overflow vulnerability. The buffer overflow can be initiated by passing 856 characters in the password field.
A specially crafted packet can cause a denial of service on an NT 4.0 host, rendering local administration and network communication nearly unusable. This attack will crash the "services" executable, which in turn, disables the ability for the machine to perform actions via named pipes. As a consequence, users will be unable to remotely logon, logoff, manage the registry, create new file share connections, or perform remote administration. Services such as Internet Information Server may also fail to operate as expected. The problem lies within the manner that srvsvc.dll makes calls to services.exe. Certain MSRPC calls will return NULL values which are not correctly interpreted by services.exe. This, in turn, may lead to a crash of Services.exe.
Netscape Messaging server will not de-allocate memory that is used to store the RCPT TO information for an incoming email. By sending enough long RCPT TO addresses, the system can be forced to consume all available memory, leading to a denial of service.
WFTPD is reported prone to a remote buffer overflow vulnerability. The issue exists due to a lack of sufficient bounds checking performed on MKD and CWD arguments. It is reported that superfluous data passed to MKD first and then to CWD results in the overflow. This vulnerability may be exploited by a remote authenticate attacker to execute arbitrary code in the context of the affected service.
When users of the Squid Web Proxy Cache are using an external authenticator, a vulnerability is present in certain versions of the cache. After decoding the base64 encoded 'user:password' pair given by the client, Squid does not strip out any '' or '' found in the resulting string. This allows a malicious user to gain access to sites they should not have access to.
There is a remotely exploitable buffer overflow vulnerability in the CGI program 'imagemap', which is distributed with Omnicron's OmniHTTPD. During operations made on arguments passed to the program, a lack of bounds checking on a strcpy() call can allow for arbitrary code to be executed on the machine running the server.
The linux version of cdwtools, which ships with S.u.S.E linux 6.1 and 6.2, is vulnerable to several local root compromises. It is known that there are a number of ways to exploit these packages, including buffer overflows and /tmp symlink attacks. This exploit is a shell script for Linux x86 cdda2cdr exploit which uses a buffer overflow to gain root access.
It is possible to remotely lock Axent Raptor firewalls by sending them packets with malformed IP options fields. According to an advisory posted to bugtraq by the perdue CERIAS labs, setting the SECURITY and TIMESTAMP IP options length to 0 can cause an infinite loop to occur within the code that handles the options (resulting in the software freezing).
Services By CQR