Linux Kernel '/proc/[pid]/stat'本地信息泄露漏洞

Bugtraq ID: 47791 CVE ID：CVE-2011-0726 Linux是一款开放源代码的操作系统。 虽然mm-startstack受cross-uid查看保护，但是没有对startcode和endcode进行相应的保护，这个允许泄露PIE两进制程序的text.Location，攻击者可以利用这个信息绕过ASLR保护。 Linux kernel 2.6.x 厂商解决方案 用户可参考如下供应商提供的安全公告获得补丁信息： https://lkml.org/lkml/2011/3/11/380...

RHEL 6 : kernel (RHSA-2011:0498)

Updated kernel packages that fix several security issues, various bugs, and add an enhancement are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, whic...

kernel: proc: protect mm start_code/end_code in /proc/pid/stat

The dotaskstat function in fs/proc/array.c in the Linux kernel before 2.6.39-rc1 does not perform an expected uid check, which makes it easier for local users to defeat the ASLR protection mechanism by reading the startcode and endcode fields in the /proc//stat file for a process executing a PIE...

French security firm VUPEN Say New Bugs Can Bypass Google Chrome Sandbox !

French security firm VUPEN Say New Bugs Can Bypass Google Chrome Sandbox ! Researchers at the French security firm VUPEN say that they have discovered several new vulnerabilities in Google Chrome that enable them to bypass the browser's sandbox, as well as ASLR and DEP and run arbitrary code on a...

Researchers Say New Bugs Can Bypass Google Chrome Sandbox

Researchers at the French security firm VUPEN say that they have discovered several new vulnerabilities in Google Chrome that enable them to bypass the browser’s sandbox, as well as ASLR and DEP and run arbitrary code on a vulnerable machine. The company said that they are not going to disclose t...

VideoLAN VLC ModPlug ReadS3M Stack Buffer Overflow

This module exploits an input validation error in libmodplugin as included with VideoLAN VLC 1.1.8. All versions prior to version 1.1.9 are affected. By creating a malicious S3M file, a remote attacker could execute arbitrary code. Although other products that bundle libmodplug may be vulnerable,...

MS11-003 Microsoft Internet Explorer CSS Recursive Import Use After Free

This module exploits a memory corruption vulnerability within Microsoft's HTML engine mshtml. When parsing an HTML page containing a recursive CSS import, a C++ object is deleted and later reused. This leads to arbitrary code execution. This exploit utilizes a combination of heap spraying and the...

MJM Core Player 2011 .s3m Stack Buffer Overflow

Exploit for windows platform in category local exploits $Id: mjmcoreplayer2011s3m.rb 12473 2011-04-30 02:36:14Z sinn3r $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more informatio...

Mozilla Foundation Security Advisory 2011-17

Mozilla Foundation Security Advisory 2011-17 Title: WebGLES vulnerabilities Impact: Critical Announced: April 28, 2011 Products: Firefox Fixed in: Firefox 4.0.1 Description Two crashes that could potentially be exploited to run malicious code were found in the WebGL feature and fixed in Firefox...

MJM QuickPlayer 1.00 beta 60a / QuickPlayer 2010 .s3m Stack BOF

Exploit for windows platform in category local exploits $Id: mjmquickplayers3m.rb 12474 2011-04-30 02:37:14Z sinn3r $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information o...

MJM QuickPlayer 1.00 Beta 60a / QuickPlayer 2010 .s3m Stack Buffer Overflow

This module exploits a stack buffer overflow in MJM QuickPlayer 1.00 beta 60a and QuickPlayer 2010 Multi-target exploit. When opening a malicious s3m file in one of these 2 applications, a stack buffer overflow can be triggered, resulting in arbitrary code execution. This exploit bypasses DEP &...

MJM Core Player 2011 .s3m Stack Buffer Overflow

This module exploits a stack buffer overflow in MJM Core Player 2011 When opening a malicious s3m file in this application, a stack buffer overflow can be triggered, resulting in arbitrary code execution. This exploit bypasses DEP & ASLR, and works on XP, Vista & Windows 7. This module requires...

MJM Core Player 2011 .s3m Stack Buffer Overflow

$Id: mjmcoreplayer2011s3m.rb 12473 2011-04-30 02:36:14Z sinn3r $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

MJM Core Player 2011 - '.s3m' Local Stack Buffer Overflow (Metasploit)

$Id: mjmcoreplayer2011s3m.rb 12473 2011-04-30 02:36:14Z sinn3r $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

MJM QuickPlayer 1.00 beta 60a / QuickPlayer 2010 .s3m Stack Buffer Overflow

$Id: mjmquickplayers3m.rb 12474 2011-04-30 02:37:14Z sinn3r $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

MJM QuickPlayer 1.00 Beta 60a / QuickPlayer 2010 - '.s3m' Local Stack Buffer Overflow (Metasploit)

$Id: mjmquickplayers3m.rb 12474 2011-04-30 02:37:14Z sinn3r $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Wireshark <= 1.4.4 packet-dect.c Stack Buffer Overflow

Exploit for windows platform in category remote exploits $Id: wiresharkpacketdect.rb 12364 2011-04-19 07:53:58Z sinn3r $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more informatio...

Adobe Flash Player 10.1.53.64 - Action Script Type Confusion (ASLR + DEP Bypass)

Adobe Flash Player 10.1.53.64 - Action Script Type Confusion ASLR + DEP Bypass Source: http://www.abysssec.com/blog/2011/04/exploiting-adobe-flash-player-on-windows-7/ Adobe Flash player Action script type confusion exploit DEP+ASLR bypass advisory text : Here is another reliable windows 7 exploi...

Wireshark 1.4.4 - 'packet-dect.c' Local Stack Buffer Overflow (Metasploit) (1)

$Id: wiresharkpacketdect.rb 12364 2011-04-19 07:53:58Z sinn3r $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Adobe Flash Player < 10.1.53.64 - Action Script Type Confusion (ASLR + DEP Bypass)

Source: http://www.abysssec.com/blog/2011/04/exploiting-adobe-flash-player-on-windows-7/ Adobe Flash player Action script type confusion exploit DEP+ASLR bypass advisory text : Here is another reliable windows 7 exploit . the main method used for exploitation is based on Haifei-li presentation at...