iDefense Security Advisory 04.08.08: Microsoft Windows Graphics Rendering Engine Integer Overflow Vulnerability

iDefense Security Advisory 04.08.08 http://labs.idefense.com/intelligence/vulnerabilities/ Apr 08, 2008 I. BACKGROUND Microsoft Windows graphics device interface GDI is the core library used to display graphics and text on the Windows operating system. It is the standard interface through which...

[Full-disclosure] iDefense Security Advisory 03.11.08: Microsoft Outlook mailto Command Line Switch Injection

iDefense Security Advisory 03.11.08 http://labs.idefense.com/intelligence/vulnerabilities/ Mar 11, 2008 I. BACKGROUND Microsoft Outlook provides an integrated solution for managing and organizing e-mail messages, schedules, tasks, notes, contacts, and other information. More information is...

DESlock+ <= 3.2.6 (list) Local Kernel Memory Leak PoC

Exploit for unknown platform in category local exploits ===================================================== DESlock+ DESlock+ include include define DLMFENCIOCTL 0x0FA4204C define DLMFENCFLAG 0xC001D00D define ARGSIZEa a-sizeof int2/sizeof void struct ioctlreq int flag; int reqnum; void...

DESlock+ 3.2.6 - DLMFENC.sys Local Kernel Ring0 link list zero (PoC)

DESlock+ 3.2.6 - DLMFENC.sys Local Kernel Ring0 link list zero PoC / deslock-list-zero.c Copyright c 2008 by DESlock+ include include define DLMFENCIOCTL 0x0FA4204C define DLMFENCFLAG 0xDEADBEEF define ZEROMEM 0xDEADBEEF define ARGSIZEa a-sizeof int2/sizeof void struct ioctlreq int flag; int...

DESlock+ < 3.2.6 - 'LIST' Local Kernel Memory Leak

/ deslock-list-leak.c Copyright c 2008 by DESlock+ include include define DLMFENCIOCTL 0x0FA4204C define DLMFENCFLAG 0xC001D00D define ARGSIZEa a-sizeof int2/sizeof void struct ioctlreq int flag; int reqnum; void argARGSIZE0x20; ; static void xormaskreq struct ioctlreq req DWORD i, pid; PCHAR ptr...

DESlock+ < 3.2.6 - 'DLMFENC.sys' Local Kernel Ring0 link list zero (PoC)

/ deslock-list-zero.c Copyright c 2008 by DESlock+ include include define DLMFENCIOCTL 0x0FA4204C define DLMFENCFLAG 0xDEADBEEF define ZEROMEM 0xDEADBEEF define ARGSIZEa a-sizeof int2/sizeof void struct ioctlreq int flag; int reqnum; void argARGSIZE0x20; ; int main int argc, char argv struct...

DESlock+ 3.2.6 - LIST Local Kernel Memory Leak

DESlock+ 3.2.6 - LIST Local Kernel Memory Leak / deslock-list-leak.c Copyright c 2008 by DESlock+ include include define DLMFENCIOCTL 0x0FA4204C define DLMFENCFLAG 0xC001D00D define ARGSIZEa a-sizeof int2/sizeof void struct ioctlreq int flag; int reqnum; void argARGSIZE0x20; ; static void...

DESlock+ < 3.2.6 - 'DLMFDISK.sy's Local kernel Ring0 SYSTEM

/ deslock-pown-v2.c Copyright c 2008 by DESlock+ include include include define DLKFDISKIOCTL 0x80002024 define DLKFDISKRIOCTL 0x80002010 define DLKFDISKSLOT 0x00000C5A define DLKFDISKOFFSET 0x0D define DLKFDISKDISKMAX 0x1A static unsigned char win32fixup = "\x53" "\xeb\x0e" / fixupcopy / "\x5e"...

Two vulnerabilities for PatchLink Update Client for Unix.

PatchLink Update Unix Client File clobbering vulnerability Larry W. Cashdollar Vapid Labs 1/17/2008 Overview From the vendor: “PatchLink Update™ provides rapid, accurate and secure patch management, allowing you to proactively manage threats by automating the collection, analysis and delivery of...

iDefense Security Advisory 01.15.08: TIBCO SmartSockets RTServer Multiple Untrusted Pointer Vulnerabilities

iDefense Security Advisory 01.15.08 http://labs.idefense.com/intelligence/vulnerabilities/ Jan 15, 2008 I. BACKGROUND TIBCO SmartSockets is a message passing framework used to transport messages over disparate channels. The RTserver is the server component of the framework. More information can b...

[Full-disclosure] iDefense Security Advisory 01.15.08: Apple QuickTime Macintosh Resource Processing Heap Corruption Vulnerability

iDefense Security Advisory 01.15.08 http://labs.idefense.com/intelligence/vulnerabilities/ Jan 15, 2008 I. BACKGROUND Quicktime is Apple's media player product, and is used to render video and other media. For more information visit the vendor's web site at the following URL...

Cisco VPN Client - IPSec Driver Local kernel system pool Corruption (PoC)

Cisco VPN Client - IPSec Driver Local kernel system pool Corruption PoC / cpndrv-dos.c Copyright c 2008 by Cisco Systems VPN Client IPSec Driver local kernel system pool corruption POC by mu-b - Sat 11 Jan 2008 - Tested on: CVPNDRVA.sys 5.0.02.0090 specifying an input buffer size less-than...

urlevasion.txt

I dont know if its new but i code it during a PentTest and i would like to share it with you. It is based on code developed By sinhack research labs: http://sinhack.net/URLFilteringEvasion/sakeru.tx Description: "Fortinet's URL blocking functionality can be bypassed by specially-crafted HTTP...

Tikiwiki 1.9.8.3 tiki-special_chars.php XSS Vulnerability

H - Security Labs Tikiwiki v1.9.8.3 Security Advisory ID : HSEC20072212 General Information -------------------------- Name : Tikiwiki 1.9.8.3 Vendor HomePage :http://tikiwiki.org Platforms : PHP && MySQL Vulnerability Type : Input Validation Error Timeline ------------------------- 17 December...

Microsoft DirectX SAMI parsing buffer overflow

Overview Microsoft DirectX is vulnerable to a stack-based buffer overflow. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Microsoft DirectX is a feature of the Microsoft Windows operating system used for streaming...

Apple Mac OSX xnu 1228.0 - super_blob Local kernel Denial of Service (PoC)

Apple Mac OSX xnu 1228.0 - superblob Local kernel Denial of Service PoC / xnu-superblob-dos.c Copyright c 2007 by Apple MACOS X xnu include include include include include include include define MAXPATHLEN 128 / change this value if no panic / define CSLOTSDIFF 0x69696969 define CSSLOTCODEDIRECTO...

Falt4 CMS RC4 10.9.2007 Multiple Remote Vulnerabilities

No description provided by source. H - Security Labs Falt4 CMS RC4 10.9.2007 Security Report /Advisory ID : HSEC20071012 General Information -------------------------- Name : Falt4Extreme CMS RC4 10.9.2007 Vendor HomePage :http://sourceforge.net/projects/falt4/ Platforms : PHP && MySQL...

Falt4 CMS rc4 10.9.2007 - Multiple Vulnerabilities

H - Security Labs Falt4 CMS RC4 10.9.2007 Security Report /Advisory ID : HSEC20071012 General Information -------------------------- Name : Falt4Extreme CMS RC4 10.9.2007 Vendor HomePage :http://sourceforge.net/projects/falt4/ Platforms : PHP && MySQL Vulnerability Type : Input Validation Errors...

falt4cms-multi.txt

H - Security Labs Falt4 CMS RC4 10.9.2007 Security Report /Advisory ID : HSEC20071012 General Information -------------------------- Name : Falt4Extreme CMS RC4 10.9.2007 Vendor HomePage :http://sourceforge.net/projects/falt4/ Platforms : PHP && MySQL Vulnerability Type : Input Validation Errors...

[Full-disclosure] Avast! AntiVirus TAR Processing Remote Heap Corruption

Avast! AntiVirus TAR Processing Remote Heap Corruption Sowhat of Nevis Labs http://www.nevisnetworks.com http://secway.org/advisory/AD20071206.txt BID: 26702 Vendor: ALWIL Software Affected: Avast! Home/Professional 4.7.1098 This vulnerability has been confirmed on Avast! Professional 4.7.1043...