Anyone who can execute CGIMailer (anyone who can use the forms that use CGIMailer) can specify what configuration file to use and this can be any file on the system CGIMailer is running on. This allows for the existance of private files to be detected. There are more dangerous implications though: this vulnerability could possibly be exploited to obtain private files from the target system. If there is an FTP server running on the target system on which an attacker has upload priviledges, he/she could upload a malicious configuration file, and then run it using CGIMailer. Configuration files can be used to send files to the attacker via e-mail (among other things).
93e43f717e47063b7aa4ac1264f4e1f4436a2587838dfecd4a1ffd48d2008703This post is about accessing a printers file system through ordinary PostScript or PJL based print jobs -- since decades a documented feature of both languages. The attack can be performed by anyone who can print, for example through USB or network. It can even be carried out by a malicious website, using advanced cross site printing techniques in combination with a novel technique we call CORS spoofing.
c418874775830be69d70d766dd0802c21da19fba2301929c1dd21e23ad79ce68Windows 2000 Service Pack 3 can be crashed remotely via TCP port 135 due to a vulnerability in the DCE-RPC stack of Windows 2000 and related OS's. This vulnerability allows anyone who can connect to port 135 TCP to disable the RPC service. Disabling the RPC service causes the machine to stop responding to new RPC requests, disabling almost all functionality. Proof of concept available here.
542a8cc5b49599b1ff7b27bc7d61b0fce3dc381c63264d8103928579a9a3db5aMicrosoft Security Bulletin MS02-035 - SQL Server Installation Process May Leave Passwords on System. A security vulnerability results because of two factors: The files remain on the server after the installation is complete. Except for the setup.iss file created by SQL Server 2000, the files are in directories that can be accessed by anyone who can interactively log on to the system. The password information stored in the files is either in clear text (for SQL Server 7.0 prior to Service Pack 4) or encrypted using fairly weak protection. An attacker who recovered the files could subject them to a password cracking attack to learn the passwords, potentially compromising the sa password and/or a domain account password.
9f9beb2a328bbc2c0a237bce8101c3044e0ed4db04422219c2b498b9e29b18b5iXsecurity Security Vulnerability Report - The default installation of Compaq Web-Based Management on a Netware server reveals sensitive system files to anyone who can access TCP port 2301. Allows remote users to read the remote console password. Software version 2.28 verified vulnerable. Compaq advisory available here.
992ae643310081a28265d7edbe6fcf3cd675ed92732e4ecbee1271c805355517Security Point Advisories #2 - Diablo 2 TCP/IP Server has a DOS vulnerability that allows anyone who can connect on port 4000 to crash the game. Vulnerable versions: Diablo 2 1.0, 1.01, 1.02, 1.03. Fix available here.
b26f84a0c7361a7edf0e302f395e9b83e79ad0422df53972120ed1b86a2807b6Vigilante Security Advisory - The OS/2 Warp 4.5 FTP Server contains denial of service vulnerabilities which allow anyone who can connect to port 21 to crash the service. Fix available here.
dcb764dd372fa94bea264f25decd609cbc3da5a3d482b1c028224a0dfc38159bMicrosoft Security Bulletin (MS00-035) - Patch Available for "SQL Server 7.0 Service Pack Password" vulnerability. Microsoft has released a patch for a security vulnerability in Microsoft SQL Server 7.0 Service Packs 1 and 2 installation routine. With some configurations, the routines record the administrator password in plain text to a log file, where by default it can be read by anyone who can read files on the server. Microsoft FAQ on this issue available here
feb39363e4c4679149374ad9863858d555f192a8400d62b6ce7e2f4b909afa2cMailForm v1.91 for Windows 95 and NT 4.0 allows potentially dangerous parameters to be specified by anyone who can execute it. The web interface allows remote users to execute arbitrary commands. Exploit code included.
ec1657d7a461dfc355e9839059244543b53c114292ec4f73a2596f3a0c87c20cFreeBSD Security Advisory - The MySQL database server (versions prior to 3.22.32) has a flaw in the password authentication mechanism which allows anyone who can connect to the server to access databases without requiring a password, given a valid username on the database - in other words, the normal password authentication mechanism can be completely bypassed.
8230e066083883d0ae634555fe321c957b2a765e1a726ab577f60505e5cff7f5Hacking CGIMail.exe.
423b154aed23b4b6753ab94263562f39e86162a9013ee39b1b5dc066824a104c
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed