Windows Media Player is an application used for digital audio, and video content viewing. An unsafe buffer copy involving remotely-obtained data exists in the Active Stream Redirector (ASX) component in Windows Media Player. The ASX enables a user to play streaming media residing on an intranet or external site. .ASX files are metafiles that redirect streaming media content from a browser to Windows Media Player. The contents of ASX files, when being interpreted by Windows Media Player, are copied into memory buffers for run-time use. When this data is copied, it is not ensured that the amount of data copied is within the predefined size limits. As a result, any extraneous data will be copied over memory boundaries and can overwrite neighbouring memory on the program's stack. Depending on the data that is copied, a denial of service attack could be launched or arbitrary code could be executed on the target host. Windows Media Player runs in the security context of the user currently logged on, therefore arbitrary code would be run at the privilege level of that particular user. If random data were entered into the buffer, the application would crash and restarting the application is required in order to regain normal functionality. If a user was misled to download a hostile .ASX file to the local machine, they would only have to single click on the file within Windows Explorer to activate the code. This is due to the 'Web View' option that is used by Windows Explorer to preview web documents automatically while browsing (this feature is enabled by default). In addition, a malformed .ASX file could be embedded into a HTML document and be configured to execute when opened via a browser or HTML compliant email client.
A vulnerability exists in all versions of RealServer 7 and below that could allow a remote attacker to gain administrative rights and access to server information and data belonging to other user sessions. RealServer will pass random pieces of the server's runtime memory which may contain information on previous sessions including cookies, usernames, passwords and the port number where the administrative server listens. This can be achieved by passing a specific URL request to the server.
A no-name ftp-server has a serious bug which leads to remote root. Anyway, we exploit vsprintf() via format-string.
A malicious website operator may verify the existence of files residing on a Windows 2000 system with Indexing Services enabled. The website operator is capable of searching for specific files by using the Indexing Services via specially malformed HTML containing the ActiveX Object 'ixsso.query'. Query results will display the full physical path of the file and will only be retrieved from directories that have been explicitly configured as searchable directories within the Indexing Service.
RPC (Remote Procedure Call) allows a program to request a service from a program located in another computer in a network without requiring detailed information on the network configuration. An attacker capable of forging a pmap_set/pmap_unset udp packet can cause the remote host to register or unregister arbitrary RPC programs. This can permit an attacker to carry out a denial of services by disabling key services on the target host, including mountd, nfsd and ypserv. Because it allows a malicious local user to register rpc programs on the server, depending on the program the attacker chooses to register, this vulnerability can allow a compromise of root privilege, potentially extending to other systems on the local network.
An exploitable buffer overflow vulnerability exists in certain non-current versions of the ISC host command. host can be used to issue an AXFR command to effect a zone transfer for a given domain name. In affected versions of host, if the AXFR query yields a response from the server which exceeds 512 bytes in length (possible, since TCP DNS messages can be up to 65535 bytes in length), the response can overflow the relevant buffer onto the stack, allowing the return address of the function to be modified. This may allow an operator of a malicious nameserver to gain control of a system on which host is being run when a query is made.
Kootenay Web Inc's Whois (release v.1.9) is vulnerable to command injection due to a failure to properly check user-supplied input to a form variable for shell metacharacters. A malicious remote user can trick the script into executing arbitrary code on the host system, allowing them to gain local shell access to the system with the privileges of the webserver.
Samba ships with a utility titled SWAT (Samba Web Administration Tool) which is used for remote administration of the Samba server and is by default set to run from inetd as root on port 701. Certain versions of this software ship with a vulnerability local users can use to leverage root access. This problem in particular is a permissions problem where users can take advantage of poor permission setting in SWAT's log files to read username and password data which SWAT records for all users which login to remotely administrate the server. If logging is turned on (it is not enabled by default) SWAT it logs by default to /tmp/cgi.log, which is world readable and contains usernames and passwords which local users may pull from the file (base64 encoded).
tcpdump is vulnerable to a remotely exploitable buffer overflow in it's parsing of AFS ACL packets. This is likely the result of the AFS packet fields received over a network interface being copied into memory buffers of predefined length without checks for size. The excessive data could be used to overwrite stack variables if constructed correctly and allow the attacker (who would have sent the custom ACL packets) to gain remote access to the victim host.
The vulnerability is in the processing of troff files, their conversion into postscript files for printing on a postscript printer. When the processing occurs, certain commands embedded in the troff file being processed can be executed -- with the privileges of the setgid lpr. This is the result of formatting programs being executed by the print filter in an unsafe manner.
Services By CQR