Wed, 04 Dec 2002 08:05:04 GMT
Yahoo Messenger 5.5 and below suffers from a buffer overflow that was originally discovered and fixed in May of 2002, but has since resurfaced. Systems Affected: Windows NT/2000/SP1/SP2/SP3, Windows ME, Windows 95/98, Windows XP.
Fri, 04 Oct 2002 07:00:07 GMT
Secure Data 2002 is the start of a new line of security tools by Security Storm. Secure Data 2002 brings an easy to use interface to the best encryption technologies. From XOR to Blowfish to RC4 and many more Secure Data 2002 is the easy way to encrypt and decrypt sensitive data using common encryption technologies and a passphrase of your choice. Secure Data 2002 is compatible with Windows 9x, Windows Me, Windows NT, Windows 2002, and Windows XP.
Tue, 30 Jul 2002 21:24:37 GMT
Microsoft Security Advisory MS02-054 - On Windows 98 with Plus! Pack, Windows Me and Windows XP, the Compressed Folders feature has an unchecked buffer in the program that handles the decompressing of files from a zipped file, allowing code of the attackers choice to run.
Fri, 21 Dec 2001 07:50:09 GMT
Server Scan is a simple tool for detecting web servers on a network. Created originally to detect unauthorized web servers on a network, server scan can serve many purposes from detecting unauthorized web servers to checking what types of web servers are running on your network. Server Scan is compatible with Windows 95, Windows 98, Windows Me, Windows NT 4, Windows 2000, and Windows XP.
Fri, 02 Nov 2001 05:28:21 GMT
Microsoft Security Advisory MS01-059 - Two unrelated buffer overflows have been found in the Microsoft UPnP service. A overflow in the NOTIFY directive allows remote attackers to execute arbitrary code. The second vulnerability crashes the machine. Windows ME and XP include native UPnP services; Windows 98 and 98SE do not include a native UPnP service, but one can be installed. Microsoft FAQ on this issue available here.
Wed, 11 Jul 2001 08:09:19 GMT
Microsoft Security Advisory MS01-054 - A vulnerability in the UPnP service which is enabled by default on Windows ME and XP allows for a remote denial of service attack causing slow performance to system failure. This vulnerability is exploited over TCP ports 1900 and 5000. Microsoft FAQ on this issue available here.
Thu, 12 Apr 2001 20:47:26 GMT
Advanced NT Security Explorer (ANTExp) is an application for Microsoft Windows NT, Windows 2000 and Windows XP system administrators for finding holes in system security. It analyses user password hashes, and tries to recover plain-text passwords. If it's possible to recover the password in a reasonable time, the password should be considered to be insecure. ANTExp is very fast - tries about 900,000 passwords per second on a Pentium-III/450 CPU. Tested on Windows 95, Windows 98, Windows ME, Windows NT 4.0, Windows 2000, Windows XP.
Wed, 28 Mar 2001 20:14:13 GMT
L0phtCrack 3 15 day trial - L0phtCrack is an NT password auditing tool. It will compute NT user passwords from the cryptographic hashes that are stored by the NT operation system. L0phtCrack computes the password from a variety of sources using a variety of methods. Uses include recovering a forgotten password, ensuring that users use strong passwords, retrieving the password of a user in order to impersonate them, or migrating NT users to another platform such as Unix. Tested on Windows 98SE, Windows ME, Windows NT, and Windows 2000.
Sat, 13 Jan 2001 18:29:30 GMT
Microsoft Security Advisory MS01-019 - Compressed folders, included with Windows ME and Plus 98, has an implementation flaw which records the plain text password used to encrypt the folder in c:\windows\dynazip.log. Microsoft FAQ on this issue available here.
Sun, 03 Dec 2000 02:35:06 GMT
Microsoft Security Bulletin (MS01-001) - The Web Extender Client (WEC), a component that ships as part of Office 2000, Windows 2000, and Windows Me, does not respect the IE Security settings regarding when NTLM authentication will be performed - instead, WEC will perform NTLM authentication with any server that requests it. If a user established a session with a malicious user's web site - either by browsing to the site or by opening an HTML mail that initiated a session with it - an application on the site could capture the user's NTLM credentials. The malicious user could then use an offline brute force attack, or with specialized tools, could submit a variant of these credentials in an attempt to protected resources. Microsoft FAQ on this issue available here.
Tue, 31 Oct 2000 18:47:41 GMT
Microsoft Security Bulletin (MS00-091) - Microsoft has released a patch that eliminates a security vulnerability in Microsoft Windows NT 4.0 and a recommended workaround for Windows 95, 98, 98 Second Edition, and Windows Me. The vulnerability allows malicious users to pause networking or sometimes crash the entire system by sending a flood of specially malformed TCP packets to port 139. Microsoft FAQ on this issue available here.
Tue, 31 Oct 2000 00:10:44 GMT
Sun, 15 Oct 2000 17:56:32 GMT
Devicelock gives network administrators control over which users can access what removable devices (floppies, Magneto-Optical disks, CD-ROMs, ZIPs, etc.) on a local computer. It can protect network and local computers against viruses, trojans and other malicious programs often injected from removable disks. This version is for Windows 2000/NT. Windows ME version available here.
Microsoft Security Bulletin (MS00-075) - Microsoft has released a patch that eliminates the "Microsoft VM ActiveX Component" vulnerability in Microsoft virtual machine (Microsoft VM) for Windows 95, 98, Windows Me, Windows NT 4.0, and Windows 2000. If a malicious web site operator coaxes a user into visiting his site, the vulnerability allows him to take any desired action on a visiting user's machine by using ActiveX controls which are marked unsafe for scripting. Microsoft FAQ on this issue available here.
view page: 167