The Kerberos KBIND authentication code in the OpenLDAP slapd server contains a remotely exploitable stack buffer overflow. The vulnerable code is enabled only when OpenLDAP is compiled with the --enable-kbind option, which has been disabled by default since version 2.0.2 and was removed from the configure script in the 2.1 release. However, the vulnerable code is still present even in the latest 2.4.3 version of OpenLDAP and can be enabled manually.

This vulnerability was found using grep and its presence indicates that the OpenLDAP code has not been audited thoroughtly enough in the past.

This is a tutorial on creating really small PE executables. It describes the techniques used to create a 97 byte PE file that is successfully loaded by Windows and a 133 byte file that downloads and runs another program from the Internet. This work was was inspired by the Tiny PE challenge.

All updates to this site are now available in an Atom feed. Subscribing to it is not going to overwhelm your RSS reader, because the website is updated only a few times per year.

The Operator Shell is a setuid root, security enhanced, restricted shell for providing fine-grain discribution of system privileges for a wide range of usages and requirements. Contrary to its stated design goals however, this programs seems to be designed to subvert security and provide unrestricted root access to any unprivileged user. During the course of a few hours, I discovered eleven vulnerabilities, ranging from vanilla strcpy overflows to format string bugs and more esoteric environment variable issues.

This is an exploit for a previously undisclosed vulnerability in the bit string decoding routine in the Microsoft ASN.1 library (CVE-2005-1935). This vulnerability is different from the bit string vulnerability described in the eEye advisory AD20040210-2. It was silently fixed in the MS04-007 patch along with the publicly disclosed ASN.1 vulnerabilities.

onesixtyone is an efficient SNMP scanner which utilizes a sweep technique to achieve extreme performance. It is possible to scan a class B network (65536 ip addresses) in under 13 minutes with a very high degree of accuracy. onesixtyone can be used to scan a network for devices responding to well-known community names or to mount a dictionary attack against one or more SNMP devices.