Hashicorp vagrant-vmware-fusion 5.0.3 - Local Privilege Escalation

Another day, another root privesc bug in this plugin. Not quite so serious this time - this one is only exploitable if the user has the plugin installed but VMware Fusion not installed. This is a fairly unlikely scenario but it's a straight to root privesc with no user interaction so isn't the ki...

Hashicorp vagrant-vmware-fusion 5.0.0 - Local Privilege Escalation

After three CVEs and multiple exploits disclosed to Hashicorp they have finally upped their game with this plugin. Now the previously vulnerable non-root-owned ruby code that get executed as root by the sudo helper is no more and the sudo helper itself is one static Go binary with...

Hashicorp vagrant-vmware-fusion 5.0.1 - Local Privilege Escalation

Hashicorp vagrant-vmware-fusion 5.0.1 - Local Privilege Escalation I recently blogged about how the installation process of version 5.0.0 of this plugin could be hihacked by a local attacker or malware in order to escalate privileges to root. Hashicorp pushed some mitigations for this issue fairl...

Hashicorp vagrant-vmware-fusion <= 4.0.20 - Local root Privilege Esclation Exploit

Exploit for macOS platform in category local exploits I'm a big fan of Hashicorp but this is an awful bug to have in software of their calibre. Their vagrant plugin for vmware fusion uses a product called Ruby Encoder to protect their proprietary ruby code. It does this by turning the ruby code...

Hashicorp vagrant-vmware-fusion 4.0.20 Privilege Escalation

CVE-2017-7642 Local root privesc in Hashicorp vagrant-vmware-fusion " - i.e. it doesn't verify the path to the ruby script and it doesn't scrub the PATH variable either. We can easily exploit this to get root. Hashicorp were quick to respond and kindly paid me a small bounty f...

VMWare Workstation On Linux Privilege Escalation

VMWare Workstation on Linux: unprivileged host user - host root privesc via ALSA config CVE-2017-4915 This vulnerability permits an unprivileged user on a Linux machine on which VMWare Workstation is installed to gain root privileges. The issue is that, for VMs with audio, the privileged VM host...

Proxifier for Mac 2.172.18 - Privesc Escalation

Proxifier for Mac 2.172.18 - Privesc Escalation Source: https://m4.rkw.io/blog/cve20177643-local-root-privesc-in-proxifier-for-mac--218.html Proxifier 2.18 also 2.17 and possibly some earlier version ships with a KLoader binary which it installs suid root the first time Proxifier is run. This...

Proxifier for Mac 2.17/2.18 - Privesc Escalation

Source: https://m4.rkw.io/blog/cve20177643-local-root-privesc-in-proxifier-for-mac--218.html Proxifier 2.18 also 2.17 and possibly some earlier version ships with a KLoader binary which it installs suid root the first time Proxifier is run. This binary serves a single purpose which is to load and...

macOS / iOS Kernel 10.12.3 (16D32) - Double-Free Due to Bad Locking in fsevents Device Exploit

Exploit for multiple platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1129 fseventsfioctl handles ioctls on fsevent fds acquired via FSEVENTSCLONE64 on /dev/fsevents Heres the code for the FSEVENTSDEVICEFILTER64 ioctl: case FSEVENTSDEVICEFILTER64:...

macOS Kernel 10.12.3 (16D32) - audit_pipe_open Off-by-One Memory Corruption Exploit

Exploit for macOS platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1126 MacOS kernel memory corruption due to off-by-one in auditpipeopen auditpipeopen is the special file open handler for the auditpipe device major number 10. Here's the code:...

MacOS/iOS kernel double free due to bad locking in fsevents device（CVE-2017-2490）

fseventsfioctl handles ioctls on fsevent fds acquired via FSEVENTSCLONE64 on /dev/fsevents Heres the code for the FSEVENTSDEVICEFILTER64 ioctl: case FSEVENTSDEVICEFILTER64: if ! procis64bitvfscontextprocctx ret = EINVAL; break; devfiltargs = fseventdevfilterargs64 data; handledevfilter: int...

Apple macOS Kernel 10.12.3 (16D32) - audit_pipe_open Off-by-One Memory Corruption

Apple macOS Kernel 10.12.3 16D32 - auditpipeopen Off-by-One Memory Corruption / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1126 MacOS kernel memory corruption due to off-by-one in auditpipeopen auditpipeopen is the special file open handler for the auditpipe device major...

QEMU: user-to-root privesc inside VM via bad translation caching

This is a security issue in the QEMU's system emulation for X86. The issue permits an attacker who can execute code in the guest ring 3 with normal user privileges to inject code into other processes that are running in guest ring 3, in particular root-owned processes. == reproduction steps ==...

Nagios 4.2.2 - Privilege Escalation Exploit

Exploit for linux platform in category local exploits Affected Product: Nagios 4 Vulnerability Type: root privilege escalation Fixed in Version: N/A Vendor Website: https://www.nagios.com/ Software Link: : https://sourceforge.net/projects/nagios/files/latest/download?source=directory-featured...

Password Manager Pro / Pro MSP - Blind SQL Injection Vulnerability

Exploit for php platform in category web applications Authenticated blind SQL injection in Password Manager Pro / Pro MSP Discovered by Pedro Ribeiro email protected, Agile Information Security ========================================================================== Disclosure: 08/11/2014 / Las...

Scientific Linux Security Update : kernel on SL3.x i386/x86_64

CVE-2009-2692 kernel: uninit op in SOCKOPSWRAP leads to privesc CVE-2009-2698 kernel: udp socket NULL ptr dereference These updated packages fix the following security issues : - a flaw was found in the SOCKOPSWRAP macro in the Linux kernel. This macro did not initialize the sendpage operation in...

Security fix for the ALT Linux 5 package kernel-image-ovz-smp version 2.6.27-alt9

Aug. 17, 2009 Anton Protopopov 2.6.27-alt9 - CVE-2009-2692 kernel: uninit op in SOCKOPSWRAP leads to privesc - ALT 20616 - Debug messages from EDAC pollute syslog...