VARIoT IoT exploits database

Sendmail 8.12.x - Header Processing Buffer Overflow (1). CVE-2002-1337CVE-4502 . remote exploit for Unix platform

Axis Communications Video Server 2.x - 'Command.cgi' File Creation.. remote exploit for CGI platform

The Oulu University Secure Programming Group has reported numerous vulnerabilities in Session Initiation Protocol (SIP) implementations. These issues may be exploited to cause a denial of services in devices which implement the protocol. It has also been reported that unauthorized access to devices may occur under some circumstances. These issues are related to handling of SIP INVITE messages. Exploitation and the specific nature of each vulnerability may depend on the particular implementation.

Cisco IOS 11/12 - OSPF Neighbor Buffer Overflow. CVE-2003-0100CVE-6455 . remote exploit for Hardware platform

Axis Network Cameras, Video Servers, and Network Digital Video Recorders contain an unchecked buffer in the authentication code of their embedded web server. Exploitation may result in a denial of service or potential execution of arbitrary code.

A vulnerability has been discovered in OSM Line Cards when installed in various Cisco devices. Cisco has reported that a denial of service may occur when processing an irregularly constructed network packet. Exploitation of this issue will cause the Cisco device to no longer forward legitimate packets. Precise technical details regarding this vulnerability are not yet known. This BID will be updated as further information becomes available.

The Cisco IP Phone 7960 uses TFTP (Trivial File Transfer Protocol) to download firmware images and configuration files. TFTP does not provide authentication. Firmware images are not signed, so there is no way for a client to determine that firmware is authentic. Firmware images with a higher version number are trusted by the vulnerable devices and will be retrieved and installed automatically when the devices are booted. This process is done transparently, without any user interaction. If the attacker can compromise the TFTP server, then it is possible to cause malicious firmware to be installed in vulnerable devices. It is also possible to exploit this weakness if the attacker has control over a server which appears to the device to be the authentic TFTP server. It is also theoretically possible for an attacker to substitute a malicious configuration file by exploiting this weakness.

While addressing vulnerabilities described in http://www.cisco.com/warp/public/707/SSH-multiple-pub.html, a denial of service condition has been inadvertently introduced into firmware upgrades. Firmware for routers and switches (IOS), Catalyst 6000 switches running CatOS, Cisco PIX Firewall and Cisco 11000 Content Service Switch devices may be vulnerable. Cisco has reported that scanning for SSH vulnerabilities on affected devices will cause excessive CPU consumption. The condition is due to a failure of the Cisco SSH implementation to properly process large SSH packets. Repeated and concurrent attacks may result in a denial of device service. As many of these devices are critical infrastructure components, more serious network outages may occur. Cisco has released upgrades that will eliminate this vulnerability.

Cisco IOS 11/12 - SNMP Message Denial of Service. CVE-2002-0013CVE-3664 . dos exploit for Hardware platform

Solaris 2/7/8/9 cachefsd - Remote Heap Overflow. CVE-2002-0033CVE-779 . remote exploit for Solaris platform

Solaris 2.x/7.0/8 / IRIX 6.5.x / OpenBSD 2.x / NetBSD 1.x / Debian 3 / HP-UX 10 - 'TelnetD' Remote Buffer Overflow. CVE-2001-0554CVE-809 . remote exploit for Unix platform

Rumpus FTP Server 1.3.x/2.0.3 - Stack Overflow Denial of Service. CVE-2001-0706CVE-1865 . dos exploit for OSX platform

Rumpus FTP Server is an implementation for MacOS which allows file-sharing across TCP/IP connections. Passwords are stored in plaintext format in the prefs folder. If access to the prefs folder is not restricted then a remote user may view the plaintext password file and access any user account on the server.

Maxum Rumpus FTP Server 1.3.2/1.3.4/2.0.3 dev - Remote Denial of Service. CVE-2001-0646CVE-1823 . dos exploit for OSX platform

Cisco Catalyst 2900 12.0 - '5.2'XU SNMP Empty UDP Packet Denial of Service. CVE-2001-0566CVE-56278 . dos exploit for Hardware platform

The Catalyst Switch is a high performance, low cost switch distributed by Cisco Systems. It is designed to offer scalability, ease of use, and modular configuration for maximum flexibility. A problem with the 5000 and 2900 series switches could make it possible to deny service to legitimate users of network resources. By sending a 802.1x frame to a switch with spanning tree protocol blocked port, the frame is forwarded on through the VLAN managed by the switch. This causes a storm of 802.1x frames. Therefore, it is possible for a remote user to create a 802.1x frame storm on the segment of VLAN managed by the Catalyst Switch, affecting performance, and potentially creating a Denial of Service.

NTPd - Remote Buffer Overflow. CVE-2001-0414CVE-805 . remote exploit for Linux platform

SSH 1.2.x - CRC-32 Compensation Attack Detector. CVE-2001-0144CVE-795 . remote exploit for Unix platform

The data encryption techniques described in RSA's PKCS #1 standard are used in many protocols which rely on, at least in part, the security provided by public-key cryptography systems. Several protocols which implement the digital enveloping method described in version 1.5 of the PKCS #1 standard are susceptible to an adaptive ciphertext attack which may allow the recovery of session keys, thus compromising the integrity of the data transmitting during that session. By capturing and logging the packets transmitted between a client and a server, an opponent could make use of a captured encrypted session key to launch a Bleichenbacher attack together with a simple timing attack. If the session key is successfully decrypted, the saved packets can easily be decrypted in a uniform manner. Interactive key establishment protocols, such as SSH or SSL, are generally significantly more susceptible to successful attacks.

Cisco Catalyst 4000/5000/6000 6.1 - SSH Protocol Mismatch Denial of Service. CVE-2001-0080CVE-7183 . dos exploit for Hardware platform