[NT] WebDrive DoS
- From: SecuriTeam <support@xxxxxxxxxxxxxx>
- Date: 22 Mar 2006 17:08:02 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
WebDrive DoS
------------------------------------------------------------------------
SUMMARY
" <http://www.webdrive.com/products/webdrive/index.html> WebDrive is more
than just an FTP Client. By connecting to WebDAV, FTP, or SFTP servers
through a virtual drive, files are transferred by simply saving them to a
drive letter."
Improper length validation allows attackers to crash WebDrive.
DETAILS
Vulnerable Systems:
* WebDrive version 6.08 build 1131
The name entry field in WebDrive is prone to a buffer overflow
vulnerability due to a programming error.
The name field allows for 257 characters to be copied to a 256 character
buffer.
Successful exploitation causes the program to fail, and crash on future
runs of the program.
ADDITIONAL INFORMATION
The information has been provided by <mailto:acastro@xxxxxxxxxxxxxxxxxx>
Adrian Castro.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Prev by Date: [TOOL] Zeppoo - i386 Rootkit Detection Tool for Linux
- Next by Date: [NEWS] Motorola P2K Platform setpath() Overflow and Blueline Attack
- Previous by thread: [TOOL] Zeppoo - i386 Rootkit Detection Tool for Linux
- Next by thread: [NEWS] Motorola P2K Platform setpath() Overflow and Blueline Attack
- Index(es):
Relevant Pages
- [NEWS] Bypassing Script Filters with Variable-Width Encodings
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... Bypassing Script Filters with
Variable-Width Encodings ... excess of 256 characters. ... Cheng doesn't
think there is a typical exploitation of bypassing script ... (Securiteam) - [TOOL] RWKG Random WEP/WPA Keys Generator
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... The RWKG tool can be used to generate
random WEP and WPA keys. ... These randomly generated a strings of allowed ASCII characters
are then ... # Random WEP/WPA Keys Generator ... (Securiteam) - [NT] NetSupport School Pro Password Encryption Weaknesses
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... and is illustrated below (how
to decrypt and encrypt data). ... The characters start at EM. ... Now if
we take the following reference for the letter 'a' and its encrypt ... (Securiteam) - [TOOL] Cisco Password Cracker
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... the passwords are no longer
... # Passwords can be up to eleven mixed-case characters. ... unsigned char
*enc_pw; ... (Securiteam) - [NEWS] Oracle Password Hashing Algorithm Assessment
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... Convert the plaintext string to
uppercase characters; ... Convert the plaintext string to multi-byte storage format;
... attacker with modern hardware to exhaust all possibilities for a limited ...
(Securiteam)
