Peter Winter-Smith

A vulnerability was found in libssh's server-side state machine. It allows a malicious client to create channels without first performing authentication, resulting in unauthorized access. The issue is related to errors in the authentication procedure, which can be exploited by a remote attacker using a specially crafted message to bypass authentication.

The issue arises from the improper handling of objects in memory, allowing remote attackers to execute arbitrary code. This can occur when accessing an object that was not properly initialized or has been deleted, potentially corrupting memory in a way that enables an attacker to execute arbitrary code in the context of the logged-on user.

The issue arises from the improper parsing of malformed headers in Advanced Systems Format (ASF) files, which can lead to the execution of arbitrary code. This can be achieved by a remote attacker through a crafted file with extensions such as .asf, .wmv, or .wma.

Name of the Vulnerable Software and Affected Versions: Microsoft Windows 2000 Server SP4 Description: The issue is related to the LDAP service in Windows Active Directory, where it does not properly check the number of convertible attributes. This allows remote attackers to cause a denial of service via a crafted LDAP request, related to client sent LDAP request logic. Recommendations: For Microsoft Windows 2000 Server SP4, at the moment, there is no information about a newer version that contains a fix for this issue.

The issue concerns the lack of validation for data objects received over specific named pipes, allowing remote authenticated users to gain privileges. This is achieved by sending a data object that represents an absolute pointer, leading to code execution at the corresponding address. The affected named pipes are related to PGPServ.exe and PGPsdkServ.exe.

A buffer overflow issue exists in the Client Service for NetWare (CSNW) component, allowing remote attackers to execute arbitrary code through crafted messages. This issue is also known as the "Client Service for NetWare Memory Corruption" problem.

A buffer overflow issue exists in the Remote Access Connection Manager service (RASMAN) of Microsoft Windows, allowing remote attackers to execute arbitrary code via crafted RPC related requests. This leads to registry corruption and stack corruption.

The issue is related to multiple buffer overflows in the web archive interface of LISTSERV, including LISTSERV Lite and HPO. This allows remote attackers to execute arbitrary code via unknown attack vectors related to the WA CGI.

The issue concerns the URL parser in Microsoft Internet Information Services (IIS) 5.1, allowing remote attackers to execute arbitrary code. This is achieved through multiple requests to ".dll" followed by specific arguments, such as `~0` through `~9`, which causes ntdll.dll to produce a return value that IIS does not handle correctly. An example of such a request is "/ vti bin/.dll/*/~0". Initially, it was believed that the consequence of this issue would only be a denial of service, resulting in an application crash and reboot.

The issue allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed range, potentially leading to memory corruption. This can be exploited by constructing a specially crafted Excel file, allowing remote code execution.

The issue is a stack-based buffer overflow in the help.cgi component of the HTTP administrative interface. This can be exploited by remote attackers to cause a denial of service, resulting in the admin server crashing. Local users can also exploit this issue to gain root privileges.

A buffer overflow issue in the dhost.exe component allows attackers to cause a denial of service, resulting in a crash, and potentially obtain access to files. The exact vectors used for the attack are not specified.

The issue is caused by an integer overflow in Microsoft Windows, allowing remote attackers to execute arbitrary code via a crafted compiled Help (.CHM) file. This can be triggered by a large size field that causes a heap-based buffer overflow. The vulnerability can be exploited using a "ms-its:" URL in Internet Explorer.

The issue involves multiple unknown vulnerabilities that allow remote attackers to execute arbitrary code or cause a denial of service.

A heap-based buffer overflow issue exists, allowing remote attackers to execute arbitrary code via a Fasttracker 2 (.xm) mod media file.

The issue is related to the Repair Archive command in WinRAR, which can be exploited by remote attackers to cause a denial of service, resulting in an application crash. This is achieved by using a corrupt ZIP archive. The problem is triggered when the Repair command is used on a corrupt ZIP archive, leading to a loss of availability for the service.

The issue is related to an integer overflow in the Install Engine, which can be triggered by a malicious website or HTML email containing a long .CAB file name. This leads to a heap-based buffer overflow, allowing remote attackers to execute arbitrary code.

A buffer overflow issue exists in the converter for Microsoft WordPerfect 5.x, allowing remote attackers to execute arbitrary code via a malicious document or website.

A stack-based buffer overflow issue allows local or remote attackers to execute arbitrary code via a .job file containing long parameters. This can be exploited by accessing a .job file on an anonymous share using Internet Explorer.

A stack-based buffer overflow issue allows remote attackers to execute arbitrary code via a link to a "palace:// url" followed by a long server address string.