kernel security, bug fix, and enhancement update

2.6.32-573 - security selinux: dont waste ebitmap space when importing NetLabel categories Paul Moore 1130197 - x86 Revert Add driver auto probing for x86 features v4 Prarit Bhargava 1231280 - net bridge: netfilter: dont call iptables on vlan packets if sysctl is off Florian Westphal 1236551 - ne...

[SECURITY] [DLA 280-1] ghostscript security update

Package : ghostscript Version : 8.71dfsg2-9+squeeze2 CVE ID : CVE-2015-3228 Debian Bug : 793489 In gsheapallocbytes, add a sanity check to ensure we dont overflow the variable holding the actual number of bytes we allocate...

DLA-280-1 ghostscript - security update

Bulletin has no description...

SSL/TLS: "Invariance Weakness" vulnerability in RC4 stream cipher

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic...

SSL/TLS: "Invariance Weakness" vulnerability in RC4 stream cipher

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic...

SSL/TLS: "Invariance Weakness" vulnerability in RC4 stream cipher

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic...

SSL/TLS: "Invariance Weakness" vulnerability in RC4 stream cipher

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic...

Ubuntu 14.04 LTS : PHP vulnerabilities (USN-2658-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2658-1 advisory. Neal Poole and Tomas Hoger discovered that PHP incorrectly handled NULL bytes in file paths. A remote attacker could possibly use this issue to bypass...

USN-2658-1: PHP vulnerabilities

Neal Poole and Tomas Hoger discovered that PHP incorrectly handled NULL bytes in file paths. A remote attacker could possibly use this issue to bypass intended restrictions and create or obtain access to sensitive files. CVE-2015-3411, CVE-2015-3412, CVE-2015-4025, CVE-2015-4026, CVE-2015-4598...

linux/x86 execve /bin/sh - shellcode 23 bytes

/ Compile with: gcc -fno-stack-protector -z execstack 23 byte execve shellcode 2 ; int execveconst char filename, char const argv, char const envp; 3 BITS 64 4 5 section .text 6 global start 7 8 start: 9 xor rdx, rdx ;zero out rdx 10 push rdx ;push rdx to stack to null terminate /bin//sh 11 mov a...

linux/x86 chmod('/etc/passwd',0777) - shellcode 42 bytes

/ Title: Linux/x86 chmod'/etc/passwd',0777 - shellcode 42 bytes Platform: linux/x8664 Author: Mohammad Reza Espargham Linkedin : https://ir.linkedin.com/in/rezasp E-Mail : meatrezadotes , reza.esparghamatgmaildotcom Website : www.reza.es Twitter : https://twitter.com/rezesp FaceBook :...

linux/x86 exec('/bin/dash') - shellcode 45 bytes

/ Title: Linux/x86 exec'/bin/dash' - shellcode 45 bytes Platform: linux/x8664 Date: 2015-06-15 Author: Mohammad Reza Espargham Linkedin : https://ir.linkedin.com/in/rezasp E-Mail : meatrezadotes , reza.esparghamatgmaildotcom Website : www.reza.es Twitter : https://twitter.com/rezesp FaceBook :...

linux/x86 chmod('/etc/gshadow') - shellcode 37 bytes

/ Title: Linux/x86 chmod'/etc/gshadow' - shellcode 37 bytes Platform: linux/x8664 Author: Mohammad Reza Espargham Linkedin : https://ir.linkedin.com/in/rezasp E-Mail : meatrezadotes , reza.esparghamatgmaildotcom Website : www.reza.es Twitter : https://twitter.com/rezesp FaceBook :...

Linux x86 - execve /bin/sh 23 Bytes

Linux x86 - execve /bin/sh 23 Bytes. Shellcode exploit for linx86-64 platform / Compile with: gcc -fno-stack-protector -z execstack 23 byte execve shellcode 2 ; int execveconst char filename, char const argv, char const envp; 3 BITS 64 4 5 section .text 6 global start 7 8 start: 9 xor rdx, rdx...

Linux/x86 - exec'/bin/dash' shellcode 45 bytes

Linux/x86 - exec'/bin/dash' shellcode 45 bytes. Shellcode exploit for linx86 platform / Title: Linux/x86 exec'/bin/dash' - shellcode 45 bytes Platform: linux/x8664 Date: 2015-06-15 Author: Mohammad Reza Espargham Linkedin : https://ir.linkedin.com/in/rezasp E-Mail : meatrezadotes ,...

Linux/x86 - chmod'/etc/passwd',0777 shellcode 42 bytes

Linux/x86 - chmod'/etc/passwd',0777 shellcode 42 bytes. Shellcode exploit for linx86 platform / Title: Linux/x86 chmod'/etc/passwd',0777 - shellcode 42 bytes Platform: linux/x8664 Author: Mohammad Reza Espargham Linkedin : https://ir.linkedin.com/in/rezasp E-Mail : meatrezadotes ,...

php: missing null byte checks for paths in various PHP extensions

It was found that certain PHP functions did not properly handle file names containing a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions...

linux/x86 Reboot shellcode - 28 Bytes

Linux/x86 Reboot - 28Bytes Greetz : BombermanLeader Author : B3mB4m Tested ON : Ubuntu 14.04 08048060 : 8048060: 31 c0 xor %eax,%eax 8048062: 50 push %eax 8048063: 68 62 6f 6f 74 push $0x746f6f62 8048068: 68 6e 2f 72 65 push $0x65722f6e 804806d: 68 2f 73 62 69 push $0x6962732f 8048072: 89 e3 mov...

PHP 5.4.x < 5.4.41 / 5.5.x < 5.5.25 Multiple Vulnerabilities

Binary data 8785.prm...

Libmimedir Special File Arbitrary Code Execution Vulnerability

libmimedir is a library of graphical objects based on the RFC implementation of 2425 and 2426. A security vulnerability exists in libmimedir. A remote attacker can construct a specially crafted VCF file with two null bytes added to the end of the file and trick the user into parsing it, which can...