Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.

CVE-2006-3747

Multiple buffer overflows in STLport 5.0.2 might allow local users to execute arbitrary code via (1) long locale environment variables to a strcpy function call in c_locale_glibc2.c and (2) long arguments to unspecified functions in num_put_float.cpp.

*   LogicMonitor is the leading fully automated, cloud-based infrastructure monitoring and observability platform for enterprise IT and managed service providers. Gain IT insights, seamless data collaboration at scale, and visibility into networks, cloud, applications, servers, log data and more within one unified platform.
    
*   Ditch time-consuming emails! Give your internal team and clients the tools they need to quickly and easily report bugs and give feedback with annotated screenshots.
    
*   1
    
    Integrates Eclipse with the SAP NetWeaver Application Server.
    
    **Downloads:** 721,098 This Week
    
    **Last Update:** 2016-07-20
    
    See Project
    
*   2
    
    **movistartv**
    
    Movistar+ Deco Virtual - Software decodificador
    
    Kodi Movistar+ TV es un ADDON para XBMC/ Kodi que permite disponer de un decodificador de los servicios IPTV de Movistar integrado en uno de los mediacenters mas populares. El proyecto no trata solo de replicar los servicios de televisión, sino un concepto diferente de servicios integrados donde la TV tenga un protagonismo central pero no el único y que permita tanto ver la TV como un video de youtube, disponer un catalogo de películas y música .. Autor: Victor M. Juidiaz Portilla (https://www.linkedin.com/in/victor-manuel-juidiaz-portilla-27bb48106) Foro "Oficial": http://www.kodimania.com/index.php?topic=860.0 Las principales funcionalidades de TV son: - Actualización automática de canales. - Guía de programación (EPG). - Grabaciones en la Nube y en local. - Últimos 7 días - Visualización de grabaciones en la nube. - Sincronización de grabaciones a local para evitar su caducidad. - Gestión avanzada de series. - Timeshift. - DLNA
    
    **Downloads:** 450,575 This Week
    
    **Last Update:** 2020-02-08
    
    See Project
    
*   3
    
    This project is the old location for the plugin list for Notepad++ Plugin Manager. Please use https://github.com/bruderstein/npppluginmanager for any issues and current code
    
    **Downloads:** 380,219 This Week
    
    **Last Update:** 2019-07-19
    
    See Project
    
*   4
    
    Free alternative for Office productivity tools: Apache OpenOffice - formerly known as OpenOffice.org - is an open-source office productivity software suite containing word processor, spreadsheet, presentation, graphics, formula editor, and database management applications. OpenOffice is available in many languages, works on all common computers, stores data in ODF - the international open standard format - and is able to read and write files in other formats, included the format used by the most common office suite packages. OpenOffice is also able to export files in PDF format. OpenOffice has supported extensions, in a similar manner to Mozilla Firefox, making easy to add new functionality to an existing OpenOffice installation.
    
    **Downloads:** 244,296 This Week
    
    **Last Update:** 2022-04-27
    
    See Project
    
*   Alchemy serves over 1 million workers at 7,500 locations worldwide with training & compliance solutions & services for manufacturing, food processing, distribution & packaging companies of all sizes.
    
*   5
    
    **KeePass**
    
    A lightweight and easy-to-use password manager
    
    KeePass Password Safe is a free, open source, lightweight, and easy-to-use password manager for Windows, Linux and Mac OS X, with ports for Android, iPhone/iPad and other mobile devices. With so many passwords to remember and the need to vary passwords to protect your valuable data, it’s nice to have KeePass to manage your passwords in a secure way. KeePass puts all your passwords in a highly encrypted database and locks them with one master key or a key file. As a result, you only have to remember one single master password or select the key file to unlock the whole database. And the databases are encrypted using the best and most secure encryption algorithms currently known, AES and Twofish. See our features page for details.
    
    **Downloads:** 188,915 This Week
    
    **Last Update:** 2022-07-05
    
    See Project
    
*   6
    
    • Designed for Linux and Windows email system administrators, Scrollout F1 is an easy to use, already adjusted email firewall (gateway) offering free anti-spam and anti-virus protection aiming to secure existing email servers, old or new, such as Microsoft Exchange, Lotus Domino, Postfix, Exim, Sendmail, Qmail and others. • Built-in multilayer security levels make configuration effort equal to a car radio. • It combines simplicity with effective protection using powerful open source with additional set of rules & filters. • Available as 64bit: - ISO image (Internet connection required during installation) - install from scratch (Internet connection required during installation). • Minimum Requirements (for 5,000 messages/day): 1 GB of RAM 30 GB storage drive 1 Processor x86/AMD64 1 Ethernet x 1 IPv4 address UDP ports: 53 123 4500 6277 24441 TCP ports: 25 80 443 2703
    
    **Downloads:** 181,031 This Week
    
    **Last Update:** 2018-04-08
    
    See Project
    
*   7
    
    **TurboVNC**
    
    High-speed, 3D-friendly, TightVNC-compatible remote desktop software
    
    TurboVNC is a high-performance, enterprise-quality version of VNC based on TightVNC, TigerVNC, and X.org. It contains a variant of Tight encoding that is tuned for maximum performance and compression with 3D applications (VirtualGL), video, and other image-intensive workloads. TurboVNC, in combination with VirtualGL, provides a complete solution for remotely displaying 3D applications with interactive performance. TurboVNC's high-speed encoding methods have been adopted by TigerVNC and libvncserver, and TurboVNC is also compatible with any other TightVNC derivative. TurboVNC forked from TightVNC in 2004 and still covers all of the TightVNC 1.3.x features, but TurboVNC contains numerous feature enhancements and bug fixes relative to TightVNC, and it compresses 3D and video workloads much better than TightVNC while using generally only 5-20% of the CPU time of the latter. Using non-default settings, TurboVNC can also be made to compress 2D workloads as "tightly" as TightVNC.
    
    **Downloads:** 168,339 This Week
    
    **Last Update:** 2022-05-03
    
    See Project
    
*   8
    
    An advanced and multi-platform BitTorrent client with a nice Qt user interface as well as a Web UI for remote control and an integrated search engine. qBittorrent aims to meet the needs of most users while using as little CPU and memory as possible.
    
    **Downloads:** 122,719 This Week
    
    **Last Update:** 2022-05-25
    
    See Project
    
*   9
    
    **scrcpy**
    
    Display and control your Android device
    
    scrcpy is an application for displaying and controlling your Android device through USB connection (or over TCP/IP). It is cross-platform (GNU/Linux, macOS and Windows) and does not require any root access. scrcpy displays only the device screen but offers great performance (30~60fps) and quality (1920×1080 or above). It’s got low latency (35~70ms) and a very low startup time (less than a second). It offers plenty of great features and is non-intrusive, with nothing left installed inside the device. scrcpy works with Android devices with at least API 21 (Android 5.0) and adb debugging must be enabled on the device.
    
    **Downloads:** 4,334 This Week
    
    **Last Update:** 2022-06-15
    
    See Project
    
*   The dashboard and mobile app allows users to manage their marketing, sales, accounting, reporting, payment and communication needs all in one place. As premium partners of channels such as VRBO, Booking.com, Airbnb, Homeaway and Expedia, with the ability to manage advanced setups, no other platform gives you the type of control and peace of mind that a Hostaway user has. The software is designed with teams in mind - it's easy to train staff and keep them happy while improving business at the same time! Hostaway also provides a booking engine, wordpress website and both marketing and sales tools for managing your valuable direct bookings.
    
*   10
    
    The Anti-Spam SMTP Proxy (ASSP) Server project aims to create an open source platform-independent SMTP Proxy server which implements auto-whitelists, self learning Hidden-Markov-Model and/or Bayesian, Greylisting, DNSBL, DNSWL, URIBL, SPF, SRS, Backscatter, Virus scanning, attachment blocking, Senderbase and multiple other filter methods. Click 'Files' to download the professional version 2.6.5 build 21218. A linux(ubuntu 18.04 LTS) and a freeBSD 11.2 based ready to run OVA of ASSP V2 are also available for download. NOTICE: V1 development has been stopped at the end of 2014 (1.10.1 build 16060). Possibly there will be done some bugfixing in future. Please upgrade to V2, which is and will be actively maintained.
    
    **Downloads:** 99,486 This Week
    
    **Last Update:** 3 hours ago
    
    See Project
    
*   11
    
    **Sweet Home 3D**
    
    An interior design application to draw house plans & arrange furniture
    
    Sweet Home 3D is an interior design application that helps you to quickly draw the floor plan of your house, arrange furniture on it, and visit the results in 3D.
    
    **Downloads:** 73,130 This Week
    
    **Last Update:** 1 day ago
    
    See Project
    
*   12
    
    **unitedrpms**
    
    Fast and open solution where everyone can help
    
    Join us in Gitter! https://gitter.im/unitedrpms-people/Lobby Enable the URPMS repository in your system - https://github.com/UnitedRPMs/unitedrpms.github.io/blob/master/README.md
    
    **Downloads:** 413,535 This Week
    
    **Last Update:** 1 day ago
    
    See Project
    
*   13
    
    **libjpeg-turbo**
    
    SIMD-accelerated libjpeg-compatible JPEG codec library
    
    libjpeg-turbo is a JPEG image codec that uses SIMD instructions (MMX, SSE2, NEON, AltiVec) to accelerate baseline JPEG compression and decompression on x86, x86-64, ARM, and PowerPC systems. On such systems, libjpeg-turbo is generally 2-6x as fast as libjpeg, all else being equal. On other types of systems, libjpeg-turbo can still outperform libjpeg by a significant amount, by virtue of its highly-optimized Huffman coding routines. In many cases, the performance of libjpeg-turbo rivals that of proprietary high-speed JPEG codecs. libjpeg-turbo implements both the traditional libjpeg API as well as the less powerful but more straightforward TurboJPEG API. libjpeg-turbo also features colorspace extensions that allow it to compress from/decompress to 32-bit and big-endian pixel buffers (RGBX, XBGR, etc.), as well as a full-featured Java interface.
    
    **Downloads:** 62,532 This Week
    
    **Last Update:** 2022-02-25
    
    See Project
    
*   14
    
    VirtualGL redirects 3D commands from a Unix/Linux OpenGL application onto a server-side GPU and converts the rendered 3D images into a video stream with which remote clients can interact to view and control the 3D application in real time.
    
    **Downloads:** 56,958 This Week
    
    **Last Update:** 2022-05-16
    
    See Project
    
*   15
    
    **PINN**
    
    PINN is an enhancement of NOOBS
    
    PINN is an enhancement of NOOBS for the Raspberry Pi. It allows the installation of MULTIPLE OSes on the same SD/HDD/SSD device with an OS chooser when booting. Built-in Admin tools allow you to backup & restore your OSes and fix OS problems by including basic disk checking, password changing, and a command shell.
    
    **Downloads:** 59,827 This Week
    
    **Last Update:** 2022-04-12
    
    See Project
    
*   16
    
    **Webmin**
    
    A web-based interface for system administration of UNIX
    
    A web-based system administration tool for Unix servers and services. https://github.com/webmin/webmin
    
    **Downloads:** 49,768 This Week
    
    **Last Update:** 6 days ago
    
    See Project
    
*   17
    
    Code::Blocks is a free, open-source, cross-platform C, C++ and Fortran IDE built to meet the most demanding needs of its users. It is designed to be very extensible and fully configurable. Finally, an IDE with all the features you need, having a consistent look, feel and operation across platforms. Built around a plugin framework, Code::Blocks can be extended with plugins. Any kind of functionality can be added by installing/coding a plugin. For instance, compiling and debugging functionality is already provided by plugins! We hope you enjoy using Code::Blocks! The Code::Blocks Team
    
    **Downloads:** 48,307 This Week
    
    **Last Update:** 4 days ago
    
    See Project
    
*   18
    
    **Tor Browser**
    
    Browser for using Tor on Windows, Mac OS X or Linux
    
    Tor Browser enables you to use Tor on Windows, Mac OS X, or Linux without needing to install any software. Tor is a software that bounces your communications around a distributed network of relays run by volunteers. This effectively prevents anyone watching your Internet connection from learning what sites you visit; it prevents the sites you visit from learning your physical location; and allows you access to sites which are blocked. Tor Browser can run off a USB flash drive, comes with a pre-configured web browser to protect your anonymity, and is self-contained (portable).
    
    **Downloads:** 2,124 This Week
    
    **Last Update:** 5 days ago
    
    See Project
    
*   19
    
    **Info-ZIP project**
    
    Info-ZIP portable compression/archiver utilities (Zip, UnZip, WiZ, etc.)
    
    **Downloads:** 46,567 This Week
    
    **Last Update:** 2021-04-08
    
    See Project
    
*   20
    
    FreeType is written in C. It is designed to be small, efficient, and highly customizable while capable of producing high-quality output (glyph images) of most vector and bitmap font formats for digital typography. FreeType is a freely available and portable software library to render fonts.
    
    **Downloads:** 44,977 This Week
    
    **Last Update:** 2022-05-01
    
    See Project
    
*   21
    
    **XAMPP**
    
    An easy to install Apache distribution containing MySQL, PHP, and Perl
    
    XAMPP is a very easy to install Apache Distribution for Linux, Solaris, Windows, and Mac OS X. The package includes the Apache web server, MySQL, PHP, Perl, a FTP server and phpMyAdmin.
    
    **Downloads:** 39,029 This Week
    
    **Last Update:** 2022-06-15
    
    See Project
    
*   22
    
    **Etcher**
    
    A safe way to flash OS images to SD cards & USB drives
    
    Etcher is a powerful OS image flasher. It protects a user from accidentally overwriting hard-drives by making drive selection obvious; and with validated flashing there is no more writing images to corrupted drives. It is also called balenaEtcher since it is developed by balena. In addition, Etcher can flash directly Raspberry Pi devices that support usbboot. Use for .iso and .img files, as well as zipped folders to create live SD cards and USB flash drives. Written with Electron for cross platform use (windows, macOS, and Linux).
    
    **Downloads:** 1,495 This Week
    
    **Last Update:** 2022-06-16
    
    See Project
    
*   23
    
    **TGM Gaming Macro**
    
    Lets you have a macro mouse n keyboard functionally with ordinary one.
    
    TGM is a gaming macro that lets you have a macro mouse and keyboard functionally with ordinary one. You can create or record multiple macros and assign them to any key combinations to trigger and loop them when you need how you need. TGM is made for gamers but it's capable of so much more. So you can use it for daily tasks as well. For any question, bug report or feature request feel free to visit forum tab. Note: To simulate arrow keys you might need to turn off NumLock. VirusTotal Result: https://www.virustotal.com/gui/file/29cf266079de80dac853d1d7c5d4c83eadb1d6f9cd8733605414d66413fba31d/detection VirusTotal shows too many false positives. but since this an open source project, you can download the source and build yourself. https://github.com/trksyln/TGMacro
    
    **Downloads:** 51,965 This Week
    
    **Last Update:** 2021-06-15
    
    See Project
    
*   24
    
    **NikGapps**
    
    A Custom Google Apps Package that Suits Everyone Needs!
    
    NikGapps project started with the goal to provide custom gapps packages that suits everyone's needs. A package that a user needs but cannot find and ends up setting up the device installing more apps and removing unwanted apps manually.
    
    **Downloads:** 32,600 This Week
    
    **Last Update:** 6 hours ago
    
    See Project
    
*   25
    
    **GParted**
    
    A partition editor to graphically manage disk partitions
    
    GNOME Partition Editor for creating, reorganizing, and deleting disk partitions. It uses libparted from the parted project to detect and manipulate partition tables. Optional file system tools permit managing file systems not included in libparted.
    
    **Downloads:** 25,454 This Week
    
    **Last Update:** 2 days ago
    
    See Project

CVE-2006-0963: Best Open Source Mac Software 2022

ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.

Index: modules/ssl/ssl\_engine\_kernel.c =================================================================== --- modules/ssl/ssl\_engine\_kernel.c (revision 264993) +++ modules/ssl/ssl\_engine\_kernel.c (working copy) @@ -406,8 +406,8 @@ (!(verify\_old & SSL\_VERIFY\_PEER) && (verify & SSL\_VERIFY\_PEER)) || - (!(verify\_old & SSL\_VERIFY\_PEER\_STRICT) && - (verify & SSL\_VERIFY\_PEER\_STRICT))) + (!(verify\_old & SSL\_VERIFY\_FAIL\_IF\_NO\_PEER\_CERT) && + (verify & SSL\_VERIFY\_FAIL\_IF\_NO\_PEER\_CERT))) { renegotiate = TRUE; /\* optimization \*/

CVE-2005-2700

The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."

**Bugtraq mailing list archives****A new whitepaper by Watchfire - HTTP Request Smuggling**

_From_: Ory Segal <orysegal () netvision net il>  
_Date_: Mon, 06 Jun 2005 19:09:04 +0300  

Ory Segal wrote:

> Hello,
> 
> Today, Watchfire released a new whitepaper, titled "HTTP Request Smuggling". The full paper can be found in the following link: http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf <BLOCKED::http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf\>
> 
> The paper's abstract is copied below:
> 
> "We describe a new web entity attack technique – “HTTP Request Smuggling”. The attack technique and the derived attacks are relevant to most web environments and is the result of a HTTP server or device’s failure to properly handle malformed inbound HTTP requests. HTTP Request Smuggling works by taking advantage of the discrepancies in parsing when one or more HTTP devices/entities (e.g. Cache Server, Proxy Server, Web Application Firewall, etc.) are in the data flow between the user and the web server. HTTP Request Smuggling enables various attacks – web cache poisoning, session hijacking, cross-site scripting and most serious the ability to bypass web application firewall protection. HTTP Request Smuggling sends multiple specially-crafted HTTP requests that cause the two attacked entities to see two different sets of requests, allowing the hacker to smuggle a request to one device without the other device being aware of it. In the Web Cache poisoning attack, this smuggled request will trick the cache server into unintendedly associating a URL to another URL’s page (content), and caching this content for the URL. In the Web Application Firewall attack the smuggled request could be a worm (like Nimda or Code Red) or buffer overflow attack targeting the web server. Finally, because HTTP Request Smuggling enables the attacker to insert or sneak a request into the flow it allows the attacker to manipulate the web server’s request/response sequencing which can allow for credential hijacking and other malicious outcomes."
> 
> Thank you,
> \*Ory Segal
> \*/Director of Security Research/
> Watchfire (Israel) LTD.
> Tel: +972-9-9586077, Ext.236
> Mobile: +972-54-7739359
> e-mail: osegal <BLOCKED::mailto:osegal () watchfire com> at watchfire.com

**Current thread:**

*   **A new whitepaper by Watchfire - HTTP Request Smuggling** _Ory Segal (Jun 06)_

CVE-2005-2088: Bugtraq: A new whitepaper by Watchfire

Cisco IOS 11.1(x) through 11.3(x) and 12.0(x) through 12.2(x), when configured for BGP routing, allows remote attackers to cause a denial of service (device reload) via malformed BGP (1) OPEN or (2) UPDATE messages.

**Overview**

Multiple implementations of the Border Gateway Protocol (BGP) contain vulnerabilities related to the processing of UPDATE and OPEN messages. The impacts of these vulnerabilities appear to be limited to denial of service.

**Description**

BGP (RFC 1771) is designed to exchange network reachability information between peer nodes. Information advertised by a BGP system to its peers includes timers, metrics, and paths to different Autonomous System (AS) networks. Routing between AS networks depends on BGP, and the Internet is a network of AS networks. Therefore, vulnerabilities in BGP have the potential to affect the Internet infrastructure.

Multiple BGP implementations contain vulnerabilities handling exceptional OPEN and UPDATE messages. While the details of the individual vulnerabilities are different, the impacts appear to be limited to denial of service. In addition, most BGP implementations do not accept messages from arbitrary sources. Some BGP implementations only accept TCP connections (179/tcp) from properly configured peers, and some implementations require a valid AS number in the BGP message data. To deliver malicious messages to such systems, an attacker would need to spoof a TCP connection or have access to a trusted BGP peer. The attacker may also need to know a valid AS number.

For information about specific BGP implementations, please see the Systems Affected section below.

**Impact**

A remote attacker can cause a denial of service in a vulnerable system. In most cases, the attacker would need to act as a valid BGP peer. BGP session instability can result in "flapping" and other routing problems that may adversely affect Internet traffic.

**Solution**

**Apply a patch or upgrade**  
Apply a patch or upgrade as specified by your vendor.

**Restrict BGP access**

Using access control lists (ACLs) and BGP configuration settings, restrict access to valid networks and BGP peers.

**Authenticate BGP messages**

TCP MD5 (RFC 2385), IPsec, and S-BGP provide cryptographic authentication of network connections and/or BGP messages. Various performance and key distribution issues are associated with these authentication methods.

**Use out-of-band management channels**

When possible, use an out-of-band channel, such as a separate network, to transmit BGP other management traffic.

**Vendor Information**

Filter by content: Additional information available

 Sort by:

  
**CVSS Metrics**

Group

Score

Vector

Base

Temporal

Environmental

  
**References****Acknowledgements**

These vulnerabilities were reported as a result of research done by Cisco. Thanks to Cisco for sharing this research and helping to coordinate the disclosure of information about these vulnerabilities.

This document was written by Art Manion.

**Other Information**

**CVE IDs:**

CVE-2004-0589

**Severity Metric:**

8.60

**Date Public:**

2004-06-16

**Date First Published:**

2004-06-16

**Date Last Updated:**

2004-06-28 16:09 UTC

**Document Revision:**

39

CVE-2004-0589: CERT/CC Vulnerability Note VU#784540

mod_cgid in Apache before 2.0.48, when using a threaded MPM, does not properly handle CGI redirect paths, which could cause Apache to send the output of a CGI program to the wrong client.

CVE-2003-0789

lpd daemon (in.lpd) in Solaris 8 and earlier allows remote attackers to execute arbitrary commands via a job request with a crafted control file that is not properly handled when lpd invokes a mail program. NOTE: this might be the same vulnerability as CVE-2000-1220.

**\[prev in list\] \[next in list\] \[prev in thread\] \[next in thread\]** 
**List:       bugtraq
Subject:    Solaris LPD Exploit (fwd)
From:       Dave Ahmad <da () securityfocus ! com>
Date:       2001-08-31 22:08:09
\[Download RAW message or body\]**

Hey,

The exploit that was attached to this message cannot be distributed..
so below is the original message sent to BUGTRAQ without the exploit.

From the exploit:

/\*
 \* remorse
 \* Solaris 8 in.lpd remote root exploit
 \* by ron1n <shellcode@hotmail.com>
 \* July 2001
 \*
 \* Written for 7DFB/TESO members and friends. Private, do not distribute
 \* negligently, etc. etc. An unpublished vulnerability is exploited. I think
 \* this is what they call 0day warez.
 \*
 \* This is not the ISS hole -- that one doesn't seem to be exploitable on the
 \* SPARC architecture. I spent a week studying all of the lp binary and library
 \* code trying to find a nice overflow that would be exploitable on SPARC. This
 \* is the best I could come up with though. I'm disappointed because it's very
 \* similar to the old SNI/NAI BSD lpd vuln and the l0pht/@stake Linux lpd vuln.
 \*
 \* There are no printer conditions that have to be met. If the system happens
 \* to be running in.lpd, consider it owned. It can be a noisy attack; other
 \* than possible syslog locations, evidence will exist under /var/spool/lp/tmp,
 \* /var/spool/lp/requests, and the mail spool directory (/tmp).
 \*
 \* The exploit targets four programs: in.lpd, lpsched adaptor, /bin/mail, and
 \* sendmail. Obviously there are going to be differences among Solaris releases
 \* and individual configurations. For instance, the Solaris 7 version of in.lpd
 \* doesn't have IPv6 support like the Solaris 8 version does, so if your IP
 \* address doesn't reverse-resolve, in.lpd will create a different directory
 \* on each release. I've handled this now in case I do a rewrite, but Solaris 7
 \* has other issues that need to be investigated. Solaris 2.6 looks even worse.
 \* If someone hooks me up with source code, I'll try to add 7 and 2.6 support.
 \*
 \* If you're not getting results, try playing around with some command line
 \* switches or some files in the exploit tarball, particularly 'script'. The
 \* system's responses, or lack thereof, can tell you everything you need for
 \* a successful exploitation.
 \*
 \* Now you too can sleep well at night knowing that there are still ways to
 \* compromise a Solaris box remotely without relying on Sun's rpc nightmare.
 \*
 \* "Something about you is very wrong..."
 \*/

Dave Ahmad
Security Focus
www.securityfocus.com

---------- Forwarded message ----------
From: "Ricky Vludmore" <ricky2k@anonymous.to>
To: bugtraq@securityfocus.com
Subject: Solaris LPD Exploit

\[This is allegedly for an unknown vulnerability.\]

I have attached the exploit that was used against me
and then sent to me as a result of my Incidents posts.
The swarm of me-too emails leads me to believe this
is being actively exploited with the public being
none the wiser. The tar content times and the
author's timestamp place it at around two months
old.

I can only guess at the intentions for trying to keep
this below the surface. The overall depressive tone of the
exploit is as unnerving as the author's up-beat attitude
toward system intrusion, but I will admit that the author
seems to hint at deeper motives. Either way, the more
productive and mature thing to do would have been to
inform the public so that end users aren't left in the
cold with these matters.

Two people asked if the system that was compromised is x86
or sparc. It's a sparc.

In reference to:

http://archives.neohapsis.com/archives/incidents/2001-08/0417.html
http://archives.neohapsis.com/archives/incidents/2001-08/0425.html

And a final post sent earlier:

>  About four hours ago I received a post from an
>  individual who claimed to have acquired exploit
>  source for this \_\_unknown\_\_ vulnerability on the
>  "ircnet chat network" about a week ago. He/she
>  then sent me a copy upon request, saying that
>  he/she witnessed it being used by a shady
>  individual in an exchange involving this and
>  another \_\_unknown\_\_ hole in a Solaris routing
>  daemon (luckily I don't run one of those!).
>
>  I now have a copy of the exploit. Haven't tried it
>  against a patched system for that (other) printer
>  bug. I somehow managed to get it working against
>  my (currently) unpatched system.
>
>  I couldn't read a line of C if my life depended on
>  it but the comments say it's an unpublished
>  hole and that it's not the ISS one (apparently
>  they were the guys who found this other printer
>  bug). I tried searching for it in a search engine.
>  No results.
>
>  I feel it's important that the public catch wind
>  of this exploit..
>
>  securityfocus contacts? bugtraq? sun?


------------------------------------------------------------
This email was sent through the free email service at http://www.anonymous.to/
To report abuse, please visit our website and click "Contact Us."

**\[prev in list\] \[next in list\] \[prev in thread\] \[next in thread\]** 

  

Configure | About | News | Add a list | Sponsored by KoreLogic

CVE-2001-1583: 'Solaris LPD Exploit (fwd)' - MARC

Denial of service in WU-FTPD via the SITE NEWER command, which does not free memory properly.

CVE-1999-0880: IBM X-Force Exchange

Cfingerd with ALLOW_EXECUTION enabled does not properly drop privileges when it executes a program on behalf of the user, allowing local users to gain root privileges.

CVE-1999-0813: IBM X-Force Exchange

A network intrusion detection system (IDS) does not properly reassemble fragmented packets.

Tag

#perl