VARIoT IoT vulnerabilities database

Microsoft IIS 5.0 allows remote attackers to spoof web log entries via an HTTP request that includes hex-encoded newline or form-feed characters. A weakness in the reporting functionality of Microsoft IIS has been discovered. It is possible to cause IIS to log false information. This problem occurs when an attacker makes a HTTP request using hexadecimal encoded requests. A malicious attacker can cause IIS to fill the log with false information. This may result in confusion when other services make use of the false IIS log data. It should be noted that this issue highly depends on the text editor used to analyze the logs. Some hexadecimal sequences may have varying results when interpreted

Directory traversal vulnerability in modules.php in Gallery before 1.2.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the include parameter. Bharat Mediratta Gallery is a free, open source web-based photo album which may be used as an add-on for the PHPNuke web portal. Due to insufficient validation of user-supplied input, it is be possible to view arbitrary web-readable files via a specially crafted web request which contains '../' sequences. This issue may allow a remote attacker to gather sensitive information which may be used in directed and organized attacks against a host running the Gallery software. A remote attacker can use the .

Multiple Cisco networking products allow remote attackers to cause a denial of service on the local network via a series of ARP packets sent to the router's interface that contains a different MAC address for the router, which eventually causes the router to overwrite the MAC address in its ARP table. There is a denial-of-service vulnerability in specific versions of Cisco IOS or CatOS. IOS is the Internetwork Operating System, distributed by Cisco Systems. A problem in the operating system has been discovered that could lead to a user on a system local to the router denying service all network users. The problem is in the handling of multiple ARP requests. It discontinues all other ARP entries afterwards. This makes it possible for a user on a network local to the router to deny service to users on all sides of the router. This vulnerability affects the following Cisco systems: Cisco routers in the AGS/MGS/CGS/AGS+, IGS, RSM, 800, ubr900, 1000, 1400, 1500, 1600, 1700, 2500, 2600, 3000, 3600, 3800, 4000, 4500, 4700, AS5200, AS5300, AS5800, 6400, 7000, 7200, ubr7200, 7500, and 12000 series. Most recent versions of the LS1010 ATM switch. The Catalyst 6000. The Catalyst 2900XL LAN switch. The Catalyst 1900, 2800, 2900, 3000, and 5000 series LAN switches are affected. The Cisco DistributedDirector. Vulnerabilities exist in several Cisco networking products

Cisco 12000 with IOS 12.0 and line cards based on Engine 2 and earlier allows remote attackers to cause a denial of service (CPU consumption) by flooding the router with traffic that generates a large number of ICMP Unreachable replies. Cisco 12000 When using a black hole filter in a series internet router, ICMP Service disruption when a large number of unreachable packets are sent (DoS) There is a vulnerability that becomes a condition.ICMP Service operation disruption by sending a large number of unreachable packets (DoS) There is a possibility of being in a state. Cisco 12000 Series Internet Routers are prone to a denial of service condition. Successful exploitation may cause the router to stop forwarding packets. This condition may occur when the router is "Black Hole" filtering. It should be noted that this vulnerability only affects certain Cisco 12000 Series Internet Routers, and other Cisco router products should not be considered vulnerable. Cisco classifies this issue under Vulnerability CSCdr46528, Vulnerability CSCds36541 and Vulnerability CSCdt66560. Engine 2 based Cisco 12000 with IOS 12.0 and line cards and earlier versions are vulnerable

Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not block non-initial packet fragments, which allows remote attackers to bypass the ACL. Cisco IOS is the router firmware included with numerous devices manufactured by Cisco Systems. Non-initial fragmented packets sent to a protected host will bypass the ACL. This could allow a user to communicate with 'protected' hosts, bypassing security policy. A remote attacker bypasses the ACL

Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not handle the "fragment" keyword in a compiled ACL (Turbo ACL) for packets that are sent to the router, which allows remote attackers to cause a denial of service via a flood of fragments. IOS is the Cisco Internet Operating System, distributed with and used on various Cisco network hardware. A possible vulnerability in IOS on the 12000 series Cisco routers could make it possible for a remote user to send unauthorized traffic to a protected network. IOS for the Cisco 12000 has only recently added the ability to filter fragmented packets in outgoing traffic. If a 'fragment' rule in an outgoing ACL exists in a version without this feature, attackers may be able to evade it and send fragmented packets to a protect network. This vulnerability may result in attackers or users bypassing security policy

Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not properly handle the implicit "deny ip any any" rule in an outgoing ACL when the ACL contains exactly 448 entries, which can allow some outgoing packets to bypass access restrictions. Cisco 12000 Series Internet Routers with line cards based on Engine 2 are prone to an unusual issue where they may fail to drop packets. The result is that some packets will not be dropped, potentially allowing restricted traffic into the network. Cisco has assigned Vulnerability CSCdu03323 to this issue. Some outgoing packets bypass access restrictions

Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not support the "fragment" keyword in an outgoing ACL, which could allow fragmented packets in violation of the intended access. Cisco IOS is the router firmware included with numerous devices manufactured by Cisco Systems. The keyword "fragment" in a compiled (turbo) ACL will be ignored when evaluating packets that are addressed to the router itself. Cisco has assigned Vulnerability CSCdu57417 to this issue. Fragmented packets violate expected access

Cisco 12000 with IOS 12.0 and lines card based on Engine 2 does not properly handle an outbound ACL when an input ACL is not configured on all the interfaces of a multi port line card, which could allow remote attackers to bypass the intended access controls. Cisco IOS is the router firmware included with numerous devices manufactured by Cisco Systems. This may be the case when input ACL is configured on some, but not all, of the interfaces on the card. This vulnerability will occur only when the packets in question are not blocked by an inbound ACL on the ingress port. An ACL applied to incoming packets will still behave as expected. Remote attacker bypasses intended access controls

Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not properly filter does not properly filter packet fragments even when the "fragment" keyword is used in an ACL, which allows remote attackers to bypass the intended access controls. Cisco IOS is the router firmware included with numerous devices manufactured by Cisco Systems. IOS on Cisco 12000 series routers with Engine 2 based cards may fail to block intended traffic using outgoing ACLs. Outgoing ACL lists do not support the keyword 'fragment', and will ignore it. If the keyword is included in the ACL, fragmented packets will not be evaluated against the associated rules, possibly bypassing security policy

IOS is the Cisco Internet Operating System, distributed with and used on various Cisco network hardware. A vulnerability in IOS on the 12000 series Cisco routers could make it possible for a remote user to send unauthorized traffic to a protected network. IOS does not filter packet fragments, even when the 'fragment' keyword is included in an ACL rule. This vulnerability may result in attackers or users bypassing security policy.

PHP-Nuke 5.2 allows remote attackers to copy and delete arbitrary files by calling case.filemanager.php with admin.php as an argument, which sets the $PHP_SELF variable and makes it appear that case.filemanager.php is being called by admin.php instead of the user. PHP Nuke is a web portal creation and management package, implemented in the PHP scripting language. The default installation includes the script 'admin/case/case.filemanager.php', which can be used to copy and delete files on the server file system. While the script contains code used to ensure it is only called by an administrative script responsible for user authentication, the implementation of this is flawed. As a result, any remote user may call the script directly without authenticating, and copy and delete any file on the server, subject to the user permissions under which the script executes. Vulnerabilities exist in PHP-Nuke version 5.2

Linear key exchange process in High-bandwidth Digital Content Protection (HDCP) System allows remote attackers to access data as plaintext, avoid device blacklists, clone devices, and create new device keyvectors by computing and using alternate key combinations for authentication. Intel's High-bandwidth Digital Content Protection (HDCP) is a specification for authentication and encryption of multimedia streams. Content encryption and authentication of a playback device are based on a public/private key pair. Authentication is accomplished by a linear combination of private key values, based on the public key. As a direct result, being able to express an arbitrary public key as a linear combination of known public/private key pairs allows an attacker to authenticate as the arbitrary device. This results in a large number of possible exploits, with varying degrees of computation required. As an example, an attacker able to eavesdrop on an encrypted stream may compute the shared secret, and view the decrypted content. Although a computationally efficient algorithm has not yet been published, it may also be possible to create new, valid keys that are a linear combination of known values. Currently this may be done by enumerating all possible well formed public keys, and testing for validity

BUGTRAQ ID: 3475PC-to-Phone is an application that can use the IP phone service to implement the function of making calls from PC to phone or from PC to PC. It is maintained by iConnectHere and copyrighted by deltathree. The software was found to have a security issue that could lead to the disclosure of PC-to-Phone confidential authentication information. If a user is in a multi-user system and has read permissions to the "temp.html" file, it is possible to obtain the user account and password for the current login to the system from the file. This file is globally readable by default. & lt; * Source: Arthur Hagen (& lt; a href = 'mailto: art@broomstick.com'> art@broomstick.com< / a>) Link: & lt; a href = 'http: //archives.neohapsis.com /archives/bugtraq/2001-10/0239.html '> http://archives.neohapsis.com/archives/bugtraq/2001-10/0239.html</a> *>

Check Point VPN-1 4.1SP4 using SecuRemote returns different error messages for valid and invalid users, with prompts that vary depending on the authentication method being used, which makes it easier for remote attackers to conduct brute force attacks. VPN-1 is a popular secure remote access software package, distributed and maintained by Check Point. A problem with the software package makes it possible for a user to gain potential access. This increases the chances of a remote attacker launching a successful brute force attack against a VPN-1 server. This vulnerability affects Windows NT and 2000 implementations. The prompt changes depending on the authentication method used

Internet Explorer 5.1 for Macintosh on Mac OS X allows remote attackers to execute arbitrary commands by causing a BinHex or MacBinary file type to be downloaded, which causes the files to be executed if automatic decoding is enabled. BinHex and MacBinary are binary file types used by the Macintosh operating systems. Earlier versions of Internet Explorer have not been tested, but may also be vulnerable. Internet Explorer 5.1 for Macintosh under the Mac OS X platform has a vulnerability

Buffer overflow in Claris Emailer 2.0v2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an email attachment with a long filename. Claris Emailer is an email program developed by Claris. A vulnerability exists in Claris emailer which could cause the application to stop responding. A restart of the application may be required in order to regain normal functionality. It may be possible for remote attackers to execute arbitrary code

Cisco switches and routers running CBOS 2.3.8 and earlier use predictable TCP Initial Sequence Numbers (ISN), which allows remote attackers to spoof or hijack TCP connections. CBOS is prone to a remote security vulnerability

Cisco CBOS 2.3.8 and earlier allows remote attackers to cause a denial of service via an ICMP ECHO REQUEST (ping) with the IP Record Route option set. CBOS is prone to a denial-of-service vulnerability. Cisco CBOS 2.3.8 and earlier versions are vulnerable

Cisco CBOS 2.3.8 and earlier stores the passwords for (1) exec and (2) enable in cleartext in the NVRAM and a configuration file, which could allow unauthorized users to obtain the passwords and gain privileges. CBOS is prone to a remote security vulnerability