Linux Kernel 3.11 < 4.8 0 - 'SO_SNDBUFFORCE' / 'SO_RCVBUFFORCE' Local Privilege Escalation

// CAPNETADMIN - root LPE exploit for CVE-2016-9793 // No KASLR, SMEP or SMAP bypass included // Affected kernels: 3.11 - 4.8 // Tested in QEMU only // https://github.com/xairy/kernel-exploits/tree/master/CVE-2016-9793 // // Usage: // gcc -pthread exploit.c -o exploit // chown guest:guest exploit...

Linux/x86 - File Reader Shellcode (54 Bytes)

Linux/x86 - File Reader Shellcode 54 Bytes. Shellcode exploit for Linx86 platform ;================================================================================ ; The MIT License ; ; Copyright c ; ; Permission is hereby granted, free of charge, to any person obtaining a copy ; of this software...

Open Source SIP Sniffer: pcapsipdump

Open Source SIP Sniffer pcapsipdump is libpcap-based SIP sniffer with per-call sorting capabilities. It writes SIP/RTP sessions to disk in a same format, as “tcpdump -w”, but one file per SIP session even if there is thousands of concurrent SIP sessions. Each session goes in a separate, fancy-nam...

shopify-scripts: Null pointer dereference in mark_context_stack

The following code causes a segfault in mruby and mruby-engine: class A rescue "" end end mruby crashes due to a null pointer dereference in markcontextstack gc.c:554: 553│ if !mrbimmediatepv 554├ if mrbbasicptrv-tt == MRBTTFREE 555│ c-stbasei = mrbnilvalue; gdb print v $1 = value = f = 0, p = 0x...

CVE-2016-4492

Buffer overflow in the dotype function in cplus-dem.c in libiberty allows remote attackers to cause a denial of service segmentation fault and crash via a crafted binary...

SUSE-SU-2017:0379-1 Security update for gcc48

This update for gcc48 to version 4.8.5 fixes several issues. This security issue was fixed: - CVE-2015-5276: The std::randomdevice class in libstdc++ did not properly handle short reads from blocking sources, which made it easier for context-dependent attackers to predict the random values via...

shopify-scripts: Denial of service (segfault) due to null pointer dereference in mrb_obj_instance_eval

Introduction ============ Provided PoC segfaults at mrbobjinstanceeval due to null pointer dereference. Proof of concept ================ Attached the poc. Crash report ============ ./sandbox eval.rb ./sandbox:20: BUG Segmentation fault at 0x00000000000003 ruby 2.3.1p112 2016-04-26 x8664-linux-gn...

Linux/x86-64 - mkdir Shellcode (25 bytes)

/ --------------------------------------------------------------------------------------------------- Linux/x86x64 - mkdir"ajit", 755 - 25 bytes Ajith Kp http://fb.com/ajithkp560 http://www.terminalcoders.blogspot.com Vishnu Nath Kp http://www.terminalcoders.blogspot.com Sayooj S Nambiar...

Debian DLA-784-1 : gcc-mozilla new package

GCC 4.8 has been packaged as gcc-mozilla for Debian 7. This package will be needed for future updates to firefox-esr and icedove, and possibly other packages that require new versions of GCC. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA securi...

[SECURITY] [DLA 784-1] gcc-mozilla new package

Package : gcc-mozilla Version : 4.8.4-0deb7u1 GCC 4.8 has been packaged as gcc-mozilla for Debian 7. This package will be needed for future updates to firefox-esr and icedove, and possibly other packages that require new versions of GCC. Further information about Debian LTS security advisories, h...

shopify-scripts: Segmentation fault on program counter

Mruby running on linux x64 gcc version 4.8.4 Ubuntu 4.8.4-2ubuntu114.04.3 poc for i in methods Kernel.initialize.publicmethods print print %i0 0 0 0end output ----------------------------------registers----------------------------------- RAX: 0x6b0e00 -- 0x80101 RBX: 0x6bef20 -- 0x6b73d0 -- 0x210...

Oracle Linux 7 : systemd (ELSA-2016-2610)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-2610 advisory. 219-30.0.1.3 - set 'RemoveIPC=no' in logind.conf as default for OL7.2 22224874 - allow dm remove ioctl to co-operate with UEK3 Vaughan Cao Orabug: 18467469 - ad...

CVE-2016-7042

The prockeysshow function in security/keys/proc.c in the Linux kernel through 4.8.2, when the GNU Compiler Collection gcc stack protector is enabled, uses an incorrect buffer size for certain timeout data, which allows local users to cause a denial of service stack memory corruption and panic by...

CVE-2016-7042

The prockeysshow function in security/keys/proc.c in the Linux kernel through 4.8.2, when the GNU Compiler Collection gcc stack protector is enabled, uses an incorrect buffer size for certain timeout data, which allows local users to cause a denial of service stack memory corruption and panic by...

CVE-2016-7042

It was found that when the gcc stack protector was enabled, reading the /proc/keys file could cause a panic in the Linux kernel due to stack corruption. This happened because an incorrect buffer size was used to hold a 64-bit timeout value rendered as weeks...

CERT Basic Fuzzing Framework: BFF

CERT Basic Fuzzing Framework The CERT Basic Fuzzing Framework BFF is a software testing tool that finds defects in applications that run on the Linux and Mac OS X platforms. BFF performs mutational fuzzing on software that consumes file input. Mutational fuzzing is the act of taking well-formed...

Linux Kernel 4.6.3 Netfilter Privilege Escalation

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require "msf/core" class MetasploitModule 'Linux Kernel 4.6.3 Netfilter Privilege Escalation', 'Description' = %q This module attempts to exploit a netfilter bug on Linux...

CVE-2016-4973

It was found that targets using gcc's libssp library for Stack Smashing Protection among others: Cygwin, MinGW, newlib, RTEMS; but not Glibc, Bionic, NetBSD which provide SSP in libc, are missing the Object Size Checking feature, even when explicitly requested with FORTIFYSOURCE. Vulnerable...

openSUSE Security Update : java-1_7_0-openjdk (openSUSE-2016-977)

This update for java-170-openjdk fixes the following issues : - Update to 2.6.7 - OpenJDK 7u111 - Security fixes - S8079718, CVE-2016-3458: IIOP Input Stream Hooking bsc989732 - S8145446, CVE-2016-3485: Perfect pipe placement Windows only bsc989734 - S8147771: Construction of static protection...

openSUSE Security Update : java-1_7_0-openjdk (openSUSE-2016-976)

This update for java-170-openjdk fixes the following issues : - Update to 2.6.7 - OpenJDK 7u111 - Security fixes - S8079718, CVE-2016-3458: IIOP Input Stream Hooking bsc989732 - S8145446, CVE-2016-3485: Perfect pipe placement Windows only bsc989734 - S8147771: Construction of static protection...