ZDI-12-125: Apple Quicktime QTPlugin SetLanguage Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-125: Apple Quicktime QTPlugin SetLanguage Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-125 July 12, 2012 - -- CVE ID: CVE-2012-0666 - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - -- Affected Vendors: Appl...

QuickTime < 7.7.2 Multiple Vulnerabilities

Binary data 6489.prm...

Apple QuickTime 7.7.2之前版本多个远程任意代码执行漏洞

BUGTRAQ ID: 53547 CVE ID: CVE-2012-0663,CVE-2012-0664,CVE-2012-0665,CVE-2012-0666,CVE-2012-0667,CVE-2012-0668,CVE-2012-0669,CVE-2012-0670,CVE-2012-0671,CVE-2012-0265 OS X Lion Server 内含一组应用软件，可将任意一台Mac 变成功能强大的服务器。Mac OS是一套运行于苹果的Macintosh系列电脑上的操作系统。 Windows 7、Vista、XP上的Apple QuickTime...

CVE-2012-0666

The CVE-2012-0666 entry is confirmed to have concrete technical details in connected documents: Apple QuickTime on Windows contains a stack-based buffer overflow in the QuickTime plugin (QTPluginControl::SetLanguage) triggered via crafted QTMovie objects, enabling remote code execution or a crash...

Code injection

ipmievd aka the IPMI event daemon in OpenIPMI, as used in the ipmitool package 1.8.11 in Red Hat Enterprise Linux RHEL 6, Debian GNU/Linux, Fedora 16, and other products uses 0666 permissions for its ipmievd.pid PID file, which allows local users to kill arbitrary processes by writing to this fil...

CVE-2011-1784

The pidfilewrite function in core/pidfile.c in keepalived 1.2.2 and earlier uses 0666 permissions for the 1 keepalived.pid, 2 checkers.pid, and 3 vrrp.pid files in /var/run/, which allows local users to kill arbitrary processes by writing a PID to one of these files...

CVE-2011-1784

The pidfilewrite function in core/pidfile.c in keepalived 1.2.2 and earlier uses 0666 permissions for the 1 keepalived.pid, 2 checkers.pid, and 3 vrrp.pid files in /var/run/, which allows local users to kill arbitrary processes by writing a PID to one of these files...

Code injection

The pidfilewrite function in core/pidfile.c in keepalived 1.2.2 and earlier uses 0666 permissions for the 1 keepalived.pid, 2 checkers.pid, and 3 vrrp.pid files in /var/run/, which allows local users to kill arbitrary processes by writing a PID to one of these files...

CVE-2011-0666

CVE-2011-0666 is a use-after-free vulnerability in the Windows kernel-mode driver win32k.sys affecting Windows XP SP2/SP3, Windows Server 2003 SP2, Windows Vista SP1/SP2, Windows Server 2008 (Gold, SP2, R2, R2 SP1), and Windows 7 (Gold, SP1). The issue arises from incorrect driver object manageme...

Windows Kernel-Mode Drivers Privilege Elevation Vulnerabilities (2506223)

This host is missing a critical security update according to Microsoft Bulletin MS11-034. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Microsoft Windows Kernel 'Win32k.sys' (CVE-2011-0666) Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability that occurs in the Windows kernel due to a use-after-free condition. A local attacker can exploit this issue to execute arbitrary code with kernel-level privileges. Successful exploits will result in the complete...

linux/x86 chmod("/etc/shadow", 0666) ASCII shellcode 443 bytes

Exploit for linux/x86 platform in category shellcode ============================================================== linux/x86 chmod"/etc/shadow", 0666 ASCII shellcode 443 bytes ============================================================== / | Title: Linux/x86 chmod"/etc/shadow", 0666 ASCII...

CVE-2010-0666

CVE-2010-0666 describes a DoS in Novell eDirectory’s eMBox service (8.8 SP5 Patch 2 and earlier) triggered by a crafted SOAP request, allowing remote attackers to crash the service. The vulnerability is distinct from CVE-2008-0926. Connected documents confirm DoS wording and affected versions; no...

Novell eDirectory < 8.8 SP5 Patch 3 DoS Vulnerability

Novell eDirectory is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

IBM DB2 Self Tuning Memory Manager (STMM) DOS Vulnerability (Linux)

The host is installed with IBM DB2 and is prone to Denial of Service vulnerability. OpenVAS Vulnerability Test $Id: secpodibmdb2stmmdosvulnlin.nasl 5055 2017-01-20 14:08:39Z teissa $ IBM DB2 Self Tuning Memory Manager STMM DOS Vulnerability Linux Authors: Antu Sanadi Updated By: Antu Sanadi on...

Linux - chmod/etc/shadow, 0666 & exit 33 bytes

Linux - chmod/etc/shadow, 0666 & exit - 33 bytes. Shellcode exploit for linx86 platform include / linux/x86 ; chmod/etc/shadow, 0666 & exit 33 bytes written by ka0x - lun sep 21 17:13:25 CEST 2009 greets: an0de, Piker, xarnuz, NullWave07, Pepelux, JosS, sch3m4, Trancek and others! / int main char...

linux/x86 chmod(/etc/shadow, 0666) & exit() 33 bytes

Exploit for linux/x86 platform in category shellcode ==================================================== linux/x86 chmod/etc/shadow, 0666 & exit 33 bytes ==================================================== include / linux/x86 ; chmod/etc/shadow, 0666 & exit 33 bytes written by ka0x lun sep 21...

AtHocGov IWSAlerts ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in AtHocGov IWSAlerts. When sending an overly long string to the CompleteInstallation method of AtHocGovTBr.dll 6.1.4.36 an attacker may be able to execute arbitrary code. This vulnerability was silently patched by the vendor. This module requires...

Mandriva Update for wml MDVSA-2008:076 (wml)

Check for the Version of wml OpenVAS Vulnerability Test Mandriva Update for wml MDVSA-2008:076 wml Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms ...

Linux/x86 - setuid(0) + chmod(/etc/shadow, 0666) Shellcode (37 bytes)

Linux/x86 - setuid0 + chmod/etc/shadow, 0666 Shellcode 37 bytes. Shellcode exploit for Linuxx86 platform / Title: linux/x86 setuid0 + chmod"/etc/shadow", 0666 Shellcode 37 Bytes Type: Shellcode Author: antrhacks Platform: Linux X86 / / ASSembly 31 db xor %ebx,%ebx b0 17 mov $0x17,%al cd 80 int...