The Dragon-Fire IDS remote web interface under version 1.0 has an insecure CGI script which allows for users to remotely execute commands as the user nobody. This could lead to a remote compromise of the system running Dragon-Fire. Via the web interface for Dragon-Fire inside the IPONE field type your desired command prefaced with a | an example could be: |echo 'uname -a' The output of the command will then be displayed in the right hand window of the IDS WWW interface.
Netscape Enterprise Server 3.51 and above includes a search engine by default. The results it generates can be tailored using various configuration files, and one of the options is whether or not the full text of a resultant page is displayed. This option is turned off by default. However, even with this setting in place, it is possible to construct a specific query that will return the full text of a JHTML page (active content, similar to an IIS .asp page) or other scripted files.
Compaq computers come with a Java applet called SpawnApp. This applet is used to run Compaq diagnostic utilities from the local hard drive when certain Compaq websites are viewed. The problem is that the applet can run any program, and can be used by any webpage. This applet is signed as secure by Compaq. An attacker can exploit this vulnerability by creating a malicious webpage with a malicious JavaScript code that can execute arbitrary commands on the vulnerable system.
Gauntlet Firewall 5.0 is vulnerable to a remote denial of service attack. An attacker can construct a specially crafted packet containing an ICMP Protocol Problem header and an IP packet with a random protocol field and certain IP options set. When this packet is sent through the Gauntlet Firewall, the firewall will hang, looking for the packet in its transparency tables.
On Guard, a security program for MacOS, includes an emergency password feature in the event that the administrative password is lost or forgotten. If the user name 'emergency' is entered, On Guard will generate an Emergency Code. The user must then call Power On Software, and after registration validation is done, provide the Emergency Code. Power On Software will then provide an emergency password. However, the method used to generate this emergency password has been reverse engineered, and an exploit is publicly available that will automatically generate the emergency password with no phone call.
Autothenticate is an extension for MacOS that remembers usernames and passwords from visited websites, and atomatically enters them when the site is visited again. It can be configured to store the username and password, the username only, or nothing. It stores this information in encrypted form in a preference file called 'AutothenticatePreferences' located in the Preferences folder in the System Folder. The encryption mechanism used is weak and can be broken. This program, written by mSec, decrypts the Autothenticate information.
Screen to Screen is a remote control utility for systems running MacOS. To use it, an administrator password is stored in encrypted form in a file called 'Authorization' located in the System Folder under Preferences:Power On Preferences:Screen To Screen. There are two problems: 1: The file can be deleted, and then the next time Screen to Screen is started it will reset the username to 'administrator' and the password to 'admin'. 2: The encryption scheme is weak and can be broken. This program, written by mSec, will decrypt the administrator password for Screen to Screen.
A denial of service condition exists in some implementations of Firewall-1 by Checkpoint Software. This denial of service attack is possible due to the way Firewall-1 handles TCP connections. Typically to initiate a TCP connection, a SYN packet is sent to the destination host. On systems where Firewall-1 is installed, this packet is first passed through an internal stack maintained by the Firewall before it is passed onto the operating system's native stack. When Firewall-1 filters this packet, it checks it against the rule base. If the session is allowed where it's rulebase is concerned, it is added to the connections table with a timeout of 60 seconds. When the remote host responds with an ACK (Acknowledge) packet, the session is bumped up to a 3600 second timeout. However, if you initiate a connection with an ACK packet, Firewall-1 compares it against the rule base, if allowed it is added to the connections table. However, the timeout is set to 3600 seconds and does not care if a remote system responds. You now have a session with a 1 hour timeout, even though no system responded. If this is done with a large amount of ACK packets, it will result in a full connections table. This results in your Firewall-1 refusing subsequent connections from any source effectively rendering the Firewall-1 useless in a 'failed closed' state. Most companies allow http outbound. Run this command as root from an internal system, I give your FW about 10 to 15 minutes. If your internal network is a 10.x.x.x, try 172.16.*.* nmap -sP 10.*.*.* nmap is a very powerful port scanner. With this command it does only a PING and TCP sweep (default port 80), but uses an ACK instead of a SYN. To verify that your connections table is quickly growing, try 'fw tab -t connections -s' at 10 second intervals. Tested on ver 4.0 SP3 on Solaris x86 2.6.
A vulnerability affects Microsoft's Jet 3.51 and 4.0 driver (MSJET35.DLL and MSJET40.DLL). This vulnerability could allow an attacker to create malicious '.xls' or '.doc' files incorporating VBA shell commands. When the file is opened, the shell commands contained in the file will execute on the target system. Command execution will occur in the context of the user that is opening the file.
Internet Config is a third-party freeware utility for MacOS. It provides a means of centralizing frequently-required connection information, including passwords, for use by several programs. The passwords are stored in encrypted form in the Internet Preferences file in the Preferences folder. The encryption algorithm used is weak and easily broken. Find an encrypted password in the Internet Preferences file in the Preferences folder using a resource editor like ResEdit. Discard the first byte as it is merely the length of the password. AppleScript exploit by Dawid adix Adamski is also available to decrypt the password.
Services By CQR