Windows win32k.sys驱动用户池溢出本地权限提升漏洞（MS10-048）

BUGTRAQ ID: 42245 CVE ID: CVE-2010-1895 Microsoft Windows是微软发布的非常流行的操作系统。 Windows中的win32k.sys内核驱动在从用户态进行拷贝时没有正确地分配内存，导致权限提升。成功利用这个漏洞的攻击者可以执行任意内核态代码。攻击者可随后安装程序；查看、更改或删除数据；或者创建拥有完全用户权限的新帐户。 Microsoft Windows XP SP3 Microsoft Windows XP Pro x64版SP2 Microsoft Windows Server 2003 SP2 厂商补丁： Microsoft...

CVE-2010-1888

Race condition in the kernel in Microsoft Windows XP SP3 allows local users to gain privileges via vectors involving thread creation, aka "Windows Kernel Data Initialization Vulnerability."...

Race condition

Race condition in the kernel in Microsoft Windows XP SP3 allows local users to gain privileges via vectors involving thread creation, aka "Windows Kernel Data Initialization Vulnerability."...

CVE-2010-1896

The Windows kernel-mode drivers in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, and Windows Server 2008 Gold and SP2 do not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted...

CVE-2010-1894

Win32k Exception Handling Vulnerability (CVE-2010-1894) affects Windows XP SP2/SP3 and Windows Server 2003 SP2 via win32k.sys. Description: the kernel-mode driver does not properly handle certain exceptions, enabling local privilege escalation by a crafted application. Impact: attacker could exec...

CVE-2010-1888

Race condition in the kernel in Microsoft Windows XP SP3 allows local users to gain privileges via vectors involving thread creation, aka "Windows Kernel Data Initialization Vulnerability."...

CVE-2010-2566: Improper Input Validation

The Secure Channel aka SChannel security package in Microsoft Windows XP SP2 and SP3, and Windows Server 2003 SP2, does not properly validate certificate request messages from TLS and SSL servers, which allows remote servers to execute arbitrary code via a crafted SSL response, aka "SChannel...

CVE-2010-1903: Improper Control of Generation of Code

Microsoft Office Word 2002 SP3 and 2003 SP3, and Office Word Viewer, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a malformed record in a Word file, aka "Word HTML Linked Objects Memory Corruption Vulnerability."...

CVE-2010-1894: Undefined Security Weakness

The Windows kernel-mode drivers in win32k.sys in Microsoft Windows XP SP2 and SP3, and Windows Server 2003 SP2, do not properly handle unspecified exceptions, which allows local users to gain privileges via a crafted application, aka "Win32k Exception Handling Vulnerability."...

CVE-2010-1888: Concurrent Execution using Shared Resource with Improper Synchronization

Race condition in the kernel in Microsoft Windows XP SP3 allows local users to gain privileges via vectors involving thread creation, aka "Windows Kernel Data Initialization Vulnerability."...

CVE-2010-2562: Improper Control of Generation of Code

Microsoft Office Excel 2002 SP3 and 2003 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac do not properly parse the Excel file format, which allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted Excel file, aka...

EasyFTP Server 1.7.0.11 - (Authenticated) Multiple Commands Remote Buffer Overflows

Exploit Title: Easy FTP Server v1.7.0.11 Multiple Command Buffer Overflow Date: August 12, 2010 Author: Glafkos Charalambous Software Link: http://easyftpsvr.googlecode.com/files/easyftp-server-1.7.0.11-en.zip Version: 1.7.0.11 Tested on: Windows XP SP3 En Vulnerable Commands: DELE, STOR, RNFR,...

Easy FTP 1.7.0.11 - NLST NLST -al APPE RETR SIZE XCWD Remote Buffer Overflow

Easy FTP 1.7.0.11 - NLST NLST -al APPE RETR SIZE XCWD Remote Buffer Overflow Exploit Title: Easy FTP Server v1.7.0.11 NLST , NLST -al, APPE, RETR , SIZE and XCWD Commands Remote Buffer Overflow Exploit Date: 10/8/2010 Author: Rabih Mohsen Software...

RSP MP3 Player - OCX ActiveX Buffer Overflow HeapSpray

. . . \ / |/| . | | | ||/ \ .| RSP MP3 Player OCX ActiveX Buffer Overflow heap spray By : MadjiX , Dz8aHotmail.com Discovered by Blake: http://www.exploit-db.com/exploits/14309/ Greetings: His0k4 , Bibi-info , The g0bl!n y , sec4ever.com Tested on Windows Xp Sp3 Fr,with IE6 sh =...

Easy FTP 1.7.0.11 - 'NLST' / 'NLST -al' / 'APPE' / 'RETR' / 'SIZE' / 'XCWD' Remote Buffer Overflow

Exploit Title: Easy FTP Server v1.7.0.11 NLST , NLST -al, APPE, RETR , SIZE and XCWD Commands Remote Buffer Overflow Exploit Date: 10/8/2010 Author: Rabih Mohsen Software Link:http://code.google.com/p/easyftpsvr/downloads/detail?name=easyftp-server-1.7.0.11-cn.zip Version: 1.7.0.11 Tested on:...

SopCast 3.2.9 - Remote Command Execution

Sopcast POC by Sud0 Tested on XP SP3 EN on VBox with IE 7 Spraying a lot to get a nice unicode usable address 0x20260078 I sprayed with a set of P/P/R instructions to come back to the stack Need internet connection on the box to trigger the vuln Wait for the Spray to finish IE will seem freezed f...

Fat Player 0.6b - .WAV File Processing Buffer Overflow (SEH)

Fat Player 0.6b - .WAV File Processing Buffer Overflow SEH Stack-based buffer overflow in Fat Player 0.6b allows remote attackers to execute arbitrary code via a long string in a .wav file. NOTE: some of these details are obtained from third party information. Reference:...

Fat Player 0.6b - '.WAV' File Processing Buffer Overflow (SEH)

Stack-based buffer overflow in Fat Player 0.6b allows remote attackers to execute arbitrary code via a long string in a .wav file. NOTE: some of these details are obtained from third party information. Reference: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-4962...

CoolPlayer219_Bin (.m3u) File Buffer Overflow Stack Exploit

Exploit for windows platform in category local exploits =========================================================== CoolPlayer219Bin .m3u File Buffer Overflow Stack Exploit =========================================================== !/usr/bin/perl CoolPlayer219Bin .m3u File WinXP Sp3fr Buffer...

ffdshow Video Codec - Denial of Service

ffdshow Video Codec - Denial of Service !/usr/bin/perl Exploit Title: Malformed MP4 Local DoS for ffdshow Video Codec tryouts rev. 3467 20100713 x86 Date: 08/08/2010 Author: Nishant Das Patnaik Web: http://nishantdaspatnaik.yolasite.com Software Link:...