The remote RPC service 100249 (snmpXdmid) is vulnerable to a heap overflow which allows any user to obtain a root shell on this host.

ELVISCICADA is one of multiple Equation Group vulnerabilities and exploits disclosed on 2017/04/08 by a group known as the Shadow Brokers.

The remote NTP server is affected by a buffer overflow condition due to improper bounds checking on the 'readvar' argument. An unauthenticated, remote attacker can exploit this, via a specially crafted request that uses an overly long argument, to execute arbitrary code with root privileges.

The remote host appears to be running UoW IMAP Server. The installed version is affected by a buffer overflow vulnerability because the software fails to verify input length of arguments to the 'LIST', 'COPY', 'RENAME', 'FIND', 'LSUB' commands. An attacker, exploiting this flaw could execute arbitrary commands subject to the privileges of the connected user.

There is a buffer overflow in the remote imap server which allows an authenticated user to obtain a remote shell. A way to reproduce the overflow is to issue the command :

  list AAAAA...AAAA /

The remote host is running XMail, a POP3 server.  The installed version is subject to a buffer overflow when it receives two arguments that are too long for the APOP command.

An attacker could exploit this issue to disable the POP server or to execute arbitrary code as root on the remote host.

The Solsoft NSM application running on the remote host is affected by multiple flaws in ulm logging related to format string processing. An unauthenticated, remote attacker can exploit these to execute arbitrary code.

LPRng seems to be running on this port.

Versions of LPRng prior to 3.6.24 are missing format string arguments in at least two calls to 'syslog()' that handle user-supplied input.

Using specially crafted input with format strings, an unauthenticated, remote attacker may be able to leverage these issues to execute arbitrary code subject to the privileges under which the service operates, typically 'root'.

Note that Nessus has not determined that the remote installation of LPRng is vulnerable, only that it is listening on this port.

The remote telnet server shuts the connection abruptly when given a long username followed by a password.

Although Nessus could not be 100% positive, it may mean that the remote host is using an older pam_smb or pam_ntdom pluggable authentication module to validate user credentials against a NT domain.

Older versions of these modules have a well known buffer overflow that could allow an intruder to execute arbitrary commands as root on this host.

It may also mean that this telnet server is weak and crashes when issued a too long username, in this case this host is vulnerable to a similar flow.

This may also be a false positive.

The remote vpopmail server is vulnerable to an input validation bug that could allow any user to crash the server by providing a specially crafted username.

The remote version of INN is between 2.0 and 2.2.2

There is a known security flaw in this version of INN which may allow an attacker to execute arbitrary code on this server is the option 'verifycancels' is enabled in inn.conf

The remote NAI WebShield SMTP Management tool is vulnerable to a buffer overflow which allows an attacker to gain execute arbitrary code on this host when it is issued a too long argument as a configuration parameter.

In addition to this, it allows an attacker to disable the service at will.

To re-enable the service :

  - execute regedit

  - edit the registry key 'Quarantine_Path' under     HKLM\SOFTWARE\Network Associates\TVD\WebShield SMTP\MailScan

  - change its value from 'XXX...XXX' to the valid path to     the quarantine folder.

  - restart the service

The version of Rockliffe MailSite installed on the remote host is prone to a buffer overflow attack that can be triggered by a request like :

	GET /cgi-bin/wconsole.dll?AAAA....AAAA 	This may be of some use to an attacker to run arbitrary code on this system and/or crash it.

The remote host is running Network Associated Gauntlet firewall. The installed version of the software is vulnerable to a buffer overflow.
An attacker could exploit this flaw in order to remotely execute arbitrary commands on the affected host.

The remote klogind seems to be affected by a buffer overflow vulnerability involving its 'krb_rd_req()' library function that may also affect other Kerberos-related programs. 

An attacker may use this to gain a root shell on this host.

Using common usernames as well as the usernames reported by 'finger', Nessus was able to log in through rsh.  Either the accounts are not protected by passwords or the ~/.rhosts files are not configured properly. 

This vulnerability is confirmed to exist in Cisco Prime LAN Management Solution, but could be present on any host that is not securely configured.

The remote LCDproc service is vulnerable to a buffer overflow attack when processing commands received from the network due to a lack of bound checks. 

An attacker may exploit this flaw to execute arbitrary code on the remote host, with the privileges of the LCDproc process (usually, nobody).

There is a buffer overflow in the remote imap server which allows an authenticated user to obtain a remote shell.

The remote pop3 server seems vulnerable to a buffer overflow when issued a very long user name (10,000 chars)

This *may* allow an attacker to execute arbitrary commands as root on the remote POP3 server.

If a user sends a too long login/password combination to this i2odialogd server, then he will overflow the server's buffers.

An attacker can use this flaw to execute arbitrary code on the remote system.

The remote pop3 server seems vulnerable to a buffer overflow when issued a very long command.

This *may* allow an attacker to execute arbitrary commands as root on the remote POP3 server.

The remote POP3 server is vulnerable to the following buffer overflow :

 USER test PASS <buffer>

This may allow an attacker to execute arbitrary commands as root on the remote POP3 server.

If a user sends an oversized login / password combination to the administrative server of a RealServer G2, it will overflow the server's buffer.

An attacker can use this flaw to execute arbitrary code on the remote system.

It is possible to crash the remote web server by sending overly long GET requests. An attacker may exploit this issue to crash the remote web server or execute arbitrary code on the remote system.

remwatch is installed and allows anyone to execute arbitrary commands.

An attacker may issue shell commands as root by connecting to the remwatch daemon, and issue the command : ' 11T ; /bin/ksh'.

According to its banner, the remote version of INN is older than version 1.6.  A number of security holes have been found older versions of INN, some of which may allow arbitrary command execution.

It was possible to crash the remote IMAP server by sending a too long AUTHENTICATE command.
An attacker may be able to exploit this vulnerability to execute code on the remote host.

The remote POP3 server might be vulnerable to a buffer overflow bug when it is issued at least one of these commands, with a too long argument :

 AUTH USER PASS

If confirmed, this problem might allow an attacker to execute arbitrary code on the remote system.

There is a buffer overflow in the imap suite provided with Debian GNU/Linux 2.1, which has a vulnerability in its POP-2 daemon, found in the ipopd package. This vulnerability allows an attacker to gain a shell as user 'nobody', but requires the attacker to have a valid pop2 account.

A remote buffer overflow in this IMAP server may allow a remote user to gain root privileges.

University of Washington IMAP server is known to be affected.

The remote host appears to be running IMail IMAP server.The installed version is reportedly affected by a buffer overflow vulnerability in the IMonitor. An attacker could exploit this flaw in order to cause a denial of service or potentially execute arbitrary code subject to the privileges of the affected service.

The remote host is running IMail IMAP server. The installed version is affected by a buffer overflow when handling a long user name, or a long password. An attacker, exploiting this flaw, could cause a denial of service, or possibly execute arbitrary code subject to the permissions of the IMAP server.

The remote host appears to be running FakeBO, a service that mimics backdoors such as Back Orifice and NetBus, monitoring any login attempts.

The version of FakeBO running on the remote host has a remote stack- based buffer overflow vulnerability.  A remote attacker could exploit this to crash the service, or execute arbitrary code.

ID	Name	Severity
10659	Solaris snmpXdmid Long Indication Event Overflow (ELVISCICADA)	critical
10647	Network Time Protocol Daemon (ntpd) readvar Variable Overflow RCE	critical
10625	UoW imapd (UW-IMAP) Multiple Command Remote Overflows	high
10580	Netscape Messaging Server IMAP LIST Command Remote Overflow	critical
10559	XMail APOP / USER Command Remote Overflow	critical
10540	Solsoft NSM Format Strings RCE	high
10522	LPRng use_syslog() Remote Format String Arbitrary Command Execution	critical
10517	pam_smb / pam_ntdom User Name Remote Overflow	high
10463	vpopmail vchkpw USER/PASS Command Format String	medium
10436	INN < 2.2.3 verifycancels Option Cancel Request Message Overflow	low
10425	NAI WebShield SMTP Management Agent SET_CONFIG Overflow	high
10421	Rockliffe MailSite Management Agent wconsole.dll GET Request Overflow	high
10420	Gauntlet CyberPatrol Content Monitoring System Overflow	critical
10411	Kerberos klogind Remote Overflow	high
10380	rsh Unauthenticated Access (via finger Information)	critical
10378	LCDproc < 0.4.1 screen_add Command Remote Overflow	high
10374	UoW imapd (UW-IMAP) Multiple Command Remote Overflows (2)	critical
10206	Rover POP3 Server Username Remote Overflow	critical
10109	SCO UnixWare i2odialogd daemon Username Authorization String Overflow	critical
10257	NetCPlus SmartServer3 POP3 (NCPOPSERV.EXE) USER Command Remote Overflow	critical
10325	XtraMail POP3 PASS Command Remote Overflow	critical
10200	RealServer G2 Malformed Telnet Data Remote Overflow	critical
10169	OpenLink Web Configurator GET Request Remote Overflow	critical
10202	HP Remote Watch showdisk Remote Privilege Escalation	high
10129	INN < 1.6 Multiple Vulnerabilities	critical
10292	UoW imapd AUTHENTICATE Command Remote Overflow	critical
10184	Multiple Vendor POP3 Remote Overflows	critical
10130	IMAP pop-2d POP Daemon FOLD Command Remote Overflow	critical
10125	UoW IMAP/POP server_login() Function Remote Overflow	critical
10124	IMail IMonitor Service Remote Overflow	high
10123	IMail IMAP Server Login Functions Remote Overflow	high
10066	FakeBO NetBus Handling Code Remote Overflow	high

Detections

Analytics

Gain a shell remotely Family for Nessus

critical

critical

high

critical

critical

high

critical

high

medium

low

high

high

critical

high

critical

high

critical

critical

critical

critical

critical

critical

critical

high

critical

critical

critical

critical

critical

high

high

high