958 matches found
Apple Intel HD 3000 Graphics driver 10.0.0 - Privilege Escalation
Exploit for macOS platform in category local exploits / āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā T A L O S V U L N D E V Proof-of-Concept Exploit Advisory:...
Apple Intel HD 3000 Graphics Driver 10.0.0 - Local Privilege Escalation
/ āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā T A L O S V U L N D E V Proof-of-Concept Exploit Advisory: http://www.talosintel.com/reports/TALOS-2016-0088/ Snort rules: 37517, 37518...
Apple Intel HD 3000 Graphics Driver 10.0.0 - Local Privilege Escalation
Apple Intel HD 3000 Graphics Driver 10.0.0 - Local Privilege Escalation / āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā T A L O S V U L N D E V Proof-of-Concept Exploit Advisory:...
Apple QuickTime < 7.7.79.80.95 - '.PSD' Parsing Memory Corruption
Application: Apple Quicktime Platforms: Windows, OSX Versions: before version 7.7.79.80.95 Author: Francis Provencher of COSIG Website: http://www.protekresearchlab.com/ Twitter: @COSIG @protekresearch CVE-2016-1769 1 Introduction 2 Report Timeline 3 Technical details 4 POC =============== 1...
Apple QuickTime < 7.7.79.80.95 - FPX File Parsing Memory Corruption 1
Exploit for multiple platform in category dos / poc Application: Apple Quicktime Platforms: Windows, OSX Versions: before version 7.7.79.80.95 Author: Francis Provencher of COSIG Website: http://www.protekresearchlab.com/ Twitter: @COSIG @protekresearch CVE-2016-1767 1 Introduction 2 Report...
Apple QuickTime 7.7.79.80.95 - .PSD Parsing Memory Corruption
Apple QuickTime 7.7.79.80.95 - .PSD Parsing Memory Corruption Application: Apple Quicktime Platforms: Windows, OSX Versions: before version 7.7.79.80.95 Author: Francis Provencher of COSIG Website: http://www.protekresearchlab.com/ Twitter: @COSIG @protekresearch CVE-2016-1769 1 Introduction 2...
Apple QuickTime 7.7.79.80.95 - .FPX Parsing Memory Corruption (2)
Apple QuickTime 7.7.79.80.95 - .FPX Parsing Memory Corruption 2 Application: Apple Quicktime Platforms: Windows, OSX Versions: before version 7.7.79.80.95 Author: Francis Provencher of COSIG Website: http://www.protekresearchlab.com/ Twitter: @COSIG @protekresearch CVE-2016-1768 1 Introduction 2...
Kautilya - Tool for easy use of Human Interface Devices for offensive security and penetration testing
Kautilya is a toolkit which provides various payloads for a Human Interface Device which may help in breaking in a computer during penetration tests. List of Payloads Windows Gather Gather Information Hashdump and Exfiltrate Keylog and Exfiltrate Sniffer WLAN keys dump Get Target Credentials Dump...
CVE-2016-1734
AppleUSBNetworking in Apple iOS before 9.3 and OS X before 10.11.4 allows physically proximate attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a crafted USB device...
CVE-2016-1734
CVE-2016-1734 affects AppleUSBNetworking in iOS before 9.3 and OS X before 10.11.4. The issue arises from an error handling/packet validation weakness in the AppleUSBNetworking stack, enabling physically proximate attackers to execute arbitrary code in a privileged context or cause a denial of se...
Apple Mac OSX Kernel - Code Execution Due to Lack of Bounds Checking in AppleUSBPipe::Abort
Apple Mac OSX Kernel - Code Execution Due to Lack of Bounds Checking in AppleUSBPipe::Abort / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=728 External Method 36 of IOUSBInterfaceUserClient is AbortStreamPipe. It takes two scalar inputs and uses the second one as an array ind...
Apple Mac OSX Kernel - AppleKeyStore Use-After-Free
/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=710 The AppleKeyStore userclient uses an IOCommandGate to serialize access to its userclient methods, however by racing two threads, one of which closes the userclient which frees the IOCommandGate and one of which tries to make ...
Apple Mac OSX Kernel - Code Execution Due to Lack of Bounds Checking in AppleUSBPipe::Abort
/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=728 External Method 36 of IOUSBInterfaceUserClient is AbortStreamPipe. It takes two scalar inputs and uses the second one as an array index to read a pointer to a C++ object without checking the bounds then calls a virtual method...
Apple Mac OSX / iOS - SUID Binary Logic Error Kernel Code Execution
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=676 tl;dr The code responsible for loading a suid-binary following a call to the execve syscall invalidates the task port after first swapping the new vmmap into the old task object leaving a short race window where we can manipula...
Apple Mac OSX Kernel - Unchecked Array Index Used to Read Object Pointer Then Call Virtual Method in Nvidia Geforce Driver
/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=709 nvDevice::ReleaseDeviceTexture is external method 0x10a of userclient 5 of the geforce IOAccelerator. It takes a single uint argument text:000000000001BCD2 mov r14d, esi ... text:000000000001BD08 and r14d, 7FFFFFFFh -- clear...
Apple Mac OSX iOS - SUID Binary Logic Error Kernel Code Execution
Apple Mac OSX iOS - SUID Binary Logic Error Kernel Code Execution Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=676 tl;dr The code responsible for loading a suid-binary following a call to the execve syscall invalidates the task port after first swapping the new vmmap into the...
Apple Mac OSX - Kernel AppleKeyStore Use-After-Free
Exploit for macOS platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=710 The AppleKeyStore userclient uses an IOCommandGate to serialize access to its userclient methods, however by racing two threads, one of which closes the userclient which frees...
Apple OSX File With Non-Executable File Extension Arbitrary File Execution
Certain malicious OSX files can be hidden using arbitrary filename extensions. A remote attacker could exploit this vulnerability to entice unsuspecting users to execute arbitrary files...
Security Issue with multimedia playback on Mac OSX
Currently your multimedia playback method uses an older and insecure method. I had to reinstate old plugins to make it work, and I would like to be able to disable these plugins as soon as possible. Can you please update your code for this as outlined here: https://support.apple.com/en-au/HT20508...
Security Issue with multimedia playback on Mac OSX
panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Server. Using Confluence Cloud? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFCLOUD-41124. panel Currently your multimedia playback method uses an older and insecure method. I had to reinstate old plugins to make...