Comodo - Integer Overlow Leading to Heap Overflow Parsing Composite Documents

Comodo - Integer Overlow Leading to Heap Overflow Parsing Composite Documents Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=762 In COleMemFile::LoadDiFatList, values from the header are used to parse the document FAT. If header.csectDif is very high, the calculation overflows...

Comodo - LZMA Decoder Heap Overflow via Insufficient Parameter Checks

Comodo - LZMA Decoder Heap Overflow via Insufficient Parameter Checks Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=763 The LZMA specification says the following about the memory usage of decompression: "The size of the probability model counter arrays is calculated with the...

Comodo Antivirus - Integer Overflow Leading to Heap Overflow in Win32 Emulation

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=738 A major component of Comodo Antivirus is the x86 emulator, which includes a number of shims for win32 API routines so that common API calls work in emulated programs CreateFile...

Comodo - Integer Overlow Leading to Heap Overflow Parsing Composite Documents

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=762 In COleMemFile::LoadDiFatList, values from the header are used to parse the document FAT. If header.csectDif is very high, the calculation overflows and a very small buffer is...

Comodo - Integer Overflow Leading to Heap Overflow in Win32 Emulation

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=738 A major component of Comodo Antivirus is the x86 emulator, which includes a number of shims for win32 API routines so that common API calls work in emulated programs CreateFile, LoadLibrary, etc. The emulator itself is located ...

Comodo - Integer Overflow Leading to Heap Overflow in Win32 Emulation

Comodo - Integer Overflow Leading to Heap Overflow in Win32 Emulation Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=738 A major component of Comodo Antivirus is the x86 emulator, which includes a number of shims for win32 API routines so that common API calls work in emulated...

Comodo - LZMA Decoder Heap Overflow via Insufficient Parameter Checks

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=763 The LZMA specification says the following about the memory usage of decompression: "The size of the probability model counter arrays is calculated with the following formula: sizeofprobarrays = 1846 + 768 1 r rax=00000000000004...

Comodo - PackMan Unpacker Insufficient Parameter Validation

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=764 Packman is an obscure opensource executable packer that Comodo Antivirus attempts to unpack during scanning. The code is available online here: http://packmanpacker.sourceforge.net/ If the compression method is set to algorithm...

Comodo - Integer Overlow Leading to Heap Overflow Parsing Composite Documents

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=762 In COleMemFile::LoadDiFatList, values from the header are used to parse the document FAT. If header.csectDif is very high, the calculation overflows and a very small buffer is allocated. The document FAT is then memcpy'd onto t...

The Definitive Guide on Win32 to NT Path Conversion

Posted by James Forshaw, path’ological reverse engineer. How the Win32 APIs process file paths on Windows NT is a tale filled with backwards compatibility hacks, weird behaviour, and beauty†. Incorrect handling of Win32 paths can lead to security vulnerabilities. This blog post is to try and give...

UBUNTU-CVE-2016-0755

The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authenticate as other users via a request, a similar issue to CVE-2014-0015...

Avast! - Heap Overflow Unpacking MoleBox Archives

Avast! - Heap Overflow Unpacking MoleBox Archives Source: https://code.google.com/p/google-security-research/issues/detail?id=552 Trivial fuzzing of molebox archives revealed a heap overflow decrypting the packed image in moleboxMaybeUnpack. This vulnerability is obviously exploitable for remote...

Kaspersky AntiVirus - '.DEX' File Format Memory Corruption

Source: https://code.google.com/p/google-security-research/issues/detail?id=529 The attached testcase was found by fuzzing DEX files, and results in a heap overflow with a wild memcpy. Note that Kaspersky catch exceptions and continue execution, so running into unmapped pages doesn't terminate th...

ManageEngine Desktop Central Tools Execution Status Update RCE (intrusive check)

The version of ManageEngine Desktop Central running on the remote host is affected by an unspecified remote code execution vulnerability in the system tools execution status updates due to a failure to properly sanitize user-supplied input. A remote, unauthenticated attacker can exploit this to...

Windows Drivers are True’ly Tricky

Posted by James Forshaw, Driving for Bugs Auditing a product for security vulnerabilities can be a difficult challenge, and there’s no guarantee you’ll catch all vulnerabilities even when you do. This post describes an issue I identified in the Windows Driver code for Truecrypt, which has already...

Microsoft Trusted Boot Security Feature Bypass

Vulnerability title Microsoft: Trusted Boot Security Feature Bypass Vulnerability CVE: CVE-2015-2552 Vendor: Microsoft Product: Windows NT series 8.0+ Affected versions: See "systems affected". Reported by: "Myria" Vulnerability Summary: ===================== An attacker with administrative acces...

(0Day) SolarWinds Server and Application Monitor Alert Manager Elevation of Privilege Vulnerability

This vulnerability allows attackers to execute arbitrary code on vulnerable installations of SolarWinds Server and Application Monitor. This vulnerability requires the attacker to have an unprivileged account on the system. The specific flaw exists within the Alert Manager component. Alerts withi...

Kaspersky AntiVirus - .DEX File Format Parsing Memory Corruption

Kaspersky AntiVirus - .DEX File Format Parsing Memory Corruption Source: https://code.google.com/p/google-security-research/issues/detail?id=519 Fuzzing the DEX file format found a crash that loads a function pointer from an attacker controlled pointer, on Windows this results in a call to an...

Kaspersky AntiVirus - UPX Parsing Memory Corruption

Kaspersky AntiVirus - UPX Parsing Memory Corruption Source: https://code.google.com/p/google-security-research/issues/detail?id=527 While fuzzing UPX packed files, this crash was discovered resulting in an arbitrary stack-relative write. This vulnerability is obviously remotely exploitable for...

Kaspersky AntiVirus - '.DEX' File Format Parsing Memory Corruption

Source: https://code.google.com/p/google-security-research/issues/detail?id=519 Fuzzing the DEX file format found a crash that loads a function pointer from an attacker controlled pointer, on Windows this results in a call to an unmapped address. This is obviously exploitable for remote,...