[DSECRG-11-018] Kaspersky administration Kit - Remote code execution via SMBRelay

Digital Security Research Group DSecRG Advisory DSECRG-11-018 Application: Kaspersky Administration Kit Versions Affected: from 6.0 Vendor URL: http://www.kaspersky.com Bug: Design flaw Exploits: YES Reported: 22.01.2011 Vendor response: 22.01.2011 Solution: disable IP scan Date of Public Advisor...

MS10-075: Vulnerability in Media Player Network Sharing Service Could Allow Remote Code Execution (2281679)

A use-after-free vulnerability exists in the Microsoft Windows Media Player Network Sharing Service installed on the remote host. By sending a specially crafted Real Time Streaming Protocol RTSP packet to the affected service, a remote attacker may be able to leverage this vulnerability to execut...

Microsoft Windows Media Player RTSP Use after Free Code Execution (MS10-075; CVE-2010-3225)

A remote code execution vulnerability has been reported in Microsoft Windows Media Player network sharing service. The Network Service account is a built-in account that has more access to resources and objects than members of the Users group. Services that run as the Network Service account acce...

PT-2010-3509 · Microsoft · Iis +7

Name of the Vulnerable Software and Affected Versions: Microsoft Windows XP versions SP2 and SP3 Microsoft Windows Server 2003 version SP2 Microsoft Windows Vista versions SP1 and SP2 Microsoft Windows Server 2008 versions SP2 and R2 Microsoft Windows 7 affected versions not specified Description...

PT-2009-2778 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions prior to the fixed version Description: The issue arises from the Windows Management Instrumentation WMI provider not properly isolating processes running under the NetworkService or LocalService accounts. This coul...

CVE-2009-0632

The IP Phone Personal Address Book PAB Synchronizer feature in Cisco Unified Communications Manager aka CUCM, formerly CallManager 4.1, 4.2 before 4.23SR4b, 4.3 before 4.32SR1b, 5.x before 5.13e, 6.x before 6.13, and 7.0 before 7.02 sends privileged directory-service account credentials to the...

CVE-2008-4874

The web component in Philips Electronics VOIP841 DECT Phone with firmware 1.0.4.50 and 1.0.4.80 has a back door "service" account with "service" as its password, which makes it easier for remote attackers to obtain access...

Design/Logic Flaw

The web component in Philips Electronics VOIP841 DECT Phone with firmware 1.0.4.50 and 1.0.4.80 has a back door "service" account with "service" as its password, which makes it easier for remote attackers to obtain access...

Microsoft Security Bulletin MS08-006 – Important Vulnerability in Internet Information Services Could Allow Remote Code Execution (942830)

Microsoft Security Bulletin MS08-006 – Important Vulnerability in Internet Information Services Could Allow Remote Code Execution 942830 Published: February 12, 2008 Version: 1.0 General Information Executive Summary This important update resolves a privately reported vulnerability in Internet...

CA eSCC r81.0 eTrust Audit r81.5 - Arbitrary File Manipulation

CA eSCC r81.0 eTrust Audit r81.5 - Arbitrary File Manipulation source: https://www.securityfocus.com/bid/20139/info CA eTrust Security Command Center eSCC and eTrust Audit are prone to multiple vulnerabilities, including: - an information-disclosure issue - an arbitrary-file-deletion issue - a...

Windows limited service account privilege escalation

By using security tokens located in process memory it's possible to escalate privileges from limited service account, such as Network Service or Microsoft SQL Service account...

Re: The Weakness of Windows Impersonation Model

Hi Brian, I wrote a paper on this subject last year, "Snagging Security Tokens to Elevate Privileges" http://www.databasesecurity.com/dbsec-briefs.htm after Tim Mullen and thrashed out a few details at Blackhat last year over a few White Russians. The paper discusses the problem in the context of...

IMC SMTP EHLO Buffer Overrun

A security vulnerability results because of an unchecked buffer in the IMC code that generates the response to the EHLO protocol command. If the buffer were overrun with data it would result in either the failure of the IMC or could allow the attacker to run code in the security context of the IM...

Trend Officescan local privilege escalation

Product: Trend OfficeScan Product Description: Trend OfficeScan is a Corporate Antivirus product from Trend Microsystems Versions affected: Tested on 5.5 others may be vulnerable Vulnerability type: Local privilege escalation Vendor URL: http://www.trendmicro.com OS tested Windows XP + SP1 others...

CVE-2002-0642

The registry key containing the SQL Server service account information in Microsoft SQL Server 2000, including Microsoft SQL Server Desktop Engine MSDE 2000, has insecure permissions, which allows local users to gain privileges, aka "Incorrect Permission on SQL Server Service Account Registry Key...

Microsoft SQL Server 2000 contains stack buffer overflow in SQL Server Resolution Service

Overview Microsoft SQL Server 2000 contains a remotely exploitable stack buffer overflow that allows attackers to execute arbitrary code with the same privileges as the SQL server. Description The SQL Server Resolution Service SSRS was introduced in Microsoft SQL Server 2000 to provide referral...

Microsoft SQL Server service account registry key has weak permissions that permit privilege escalation

Overview The Microsoft SQL Server contains a vulnerability that allows remote attackers to execute arbitrary commands with system privileges. Description The Microsoft SQL Server typically runs under a dedicated "service account" that is defined by system administrators at installation time. This...

Microsoft SQL Server 2000 - Database Consistency Checkers Buffer Overflow

Microsoft SQL Server 2000 - Database Consistency Checkers Buffer Overflow source: https://www.securityfocus.com/bid/5307/info Microsoft SQL Server 2000 includes utilities called Database Consistency Checkers DBCC. Several of these programs contain identical buffer overflows that, when exploited,...

Microsoft SQL Server contains buffer overflow in pwdencrypt() function

Overview The Microsoft SQL Server contains a buffer overflow vulnerability that may allow remote attackers to execute arbitrary code with system privileges. Description The Microsoft SQL Server provides multiple methods for users to authenticate to SQL databases. When SQL Server Authentication is...

BindView HackerShield 1.01.1 - HackerShield AgentAdmin Password

BindView HackerShield 1.01.1 - HackerShield AgentAdmin Password source: https://www.securityfocus.com/bid/628/info The BindView HackerShield product originally Netect's HackerShield creates an NT service account called NetectAgentAdmin$. This account is a member of the local administrators group ...