CVE-2018-12034

In YARA 3.7.1 and prior, parsing a specially crafted compiled rule file can cause an out of bounds read vulnerability in yrexecutecode in libyara/exec.c...

CVE-2018-12035

In YARA 3.7.1 and prior, parsing a specially crafted compiled rule file can cause an out of bounds write vulnerability in yrexecutecode in libyara/exec.c...

CVE-2018-12035

CVE-2018-12035 affects YARA up to version 3.7.1, where parsing a specially crafted compiled rule file can trigger an out-of-bounds write in yr_execute_code (libyara/exec.c). Reported metrics indicate CVSS v3 base score 7.8 (HIGH) with LOCAL exploitability and user interaction required; CVSS v2 ba...

CVE-2018-12034

In YARA 3.7.1 and prior, parsing a specially crafted compiled rule file can cause an out of bounds read vulnerability in yrexecutecode in libyara/exec.c...

yara/dex_fuzzer: Use-of-uninitialized-value in read_uleb128

Project: https://github.com/VirusTotal/yara.git Detailed report: https://oss-fuzz.com/testcase?key=5072572086484992 Project: yara Fuzzer: libFuzzeryaradexfuzzer Fuzz target binary: dexfuzzer Job Type: libfuzzermsanyara Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

yara/dex_fuzzer: Heap-buffer-overflow in dex_parse

Detailed report: https://oss-fuzz.com/testcase?key=4621856041598976 Project: yara Fuzzer: libFuzzeryaradexfuzzer Fuzz target binary: dexfuzzer Job Type: libfuzzerasanyara Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x6120000008c5 Crash State: dexparse dexload...

PT-2018-10955

Name of the Vulnerable Software and Affected Versions YARA versions prior to 3.7.1 Description The issue arises when parsing a specially crafted compiled rule file, leading to an out of bounds read in the yr execute code function located in libyara/exec.c. Recommendations For versions prior to...

MalScan - A Simple PE File Heuristics Scanners

MalScan is a simple PE File Heuristics Scanners written in python that you can use to quickly analyze a PE file and find out whether anything suspicious exists. It is a simple tool so doesn't offers much fancy features. You are free to extend it or do whatever you want with it. Things Supported...

Your new friend, KLara

While doing threat research, teams need a lot of tools and systems to aid their hunting efforts – from systems storing Passive DNS data and automated malware classification to systems allowing researchers to pattern-match a large volume of data in a relatively short period of time. These tools ar...

Simple IOC and Incident Response Scanner: Loki

LOKI is a free and simple IOC scanner, a complete rewrite of main analysis modules of our full featured APT Scanner THOR. IOC stands for „Indicators of Compromise“. These indicators can be derived from published incident reports, forensic analyses or malware sample collections in your Lab. LOKI...

Distributed YARA Malware Scanning System: KLara project

Klara project is aimed at helping Threat Intelligence researchers hunt for new malware using Yara . In order to hunt efficiently for malware, one needs a large collection of samples to search over. Researchers usually need to fire a Yara rule over a collection / set of malicious files and then ge...

Microsoft Office - Composite Moniker Remote Code Execution Exploit

Exploit for windows platform in category local exploits What? This repo contains a Proof of Concept exploit for CVE-2017-8570, a.k.a the "Composite Moniker" vulnerability. This demonstrates using the Packager.dll trick to drop an sct file into the %TEMP% directory, and then execute it using the...

sigma - Generic Signature Format for SIEM Systems

Generic Signature Format for SIEM Systems. What is Sigma? Sigma is a generic and open signature format that allows you to describe relevant log events in a straight forward manner. The rule format is very flexible, easy to write and applicable to any type of log file. The main purpose of this...

yara/dex_fuzzer: Heap-buffer-overflow in yr_object_set_string

Detailed report: https://oss-fuzz.com/testcase?key=5648916683948032 Project: yara Fuzzer: libFuzzeryaradexfuzzer Fuzz target binary: dexfuzzer Job Type: libfuzzerasanyara Platform Id: linux Crash Type: Heap-buffer-overflow READ 12 Crash Address: 0x61b000000d8e Crash State: yrobjectsetstring...

yara/dex_fuzzer: Heap-buffer-overflow in read_uleb128

Project: https://github.com/VirusTotal/yara.git Detailed report: https://oss-fuzz.com/testcase?key=5150212461953024 Project: yara Fuzzer: aflyaradexfuzzer Fuzz target binary: dexfuzzer Job Type: aflasanyara Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x612000000900...

yara/dex_fuzzer: Crash in __msan_memcpy.part.49

Project: https://github.com/VirusTotal/yara.git Detailed report: https://oss-fuzz.com/testcase?key=5919363380019200 Project: yara Fuzzer: libFuzzeryaradexfuzzer Fuzz target binary: dexfuzzer Job Type: libfuzzermsanyara Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x72e000020000 Cras...

yara/dex_fuzzer: Heap-buffer-overflow in dex_parse

Project: https://github.com/VirusTotal/yara.git Detailed report: https://oss-fuzz.com/testcase?key=5104899873308672 Project: yara Fuzzer: aflyaradexfuzzer Fuzz target binary: dexfuzzer Job Type: aflasanyara Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x62e0000178f8...

yara/dex_fuzzer: Crash in yr_object_set_string

Project: https://github.com/VirusTotal/yara.git Detailed report: https://oss-fuzz.com/testcase?key=4773665418772480 Project: yara Fuzzer: libFuzzeryaradexfuzzer Fuzz target binary: dexfuzzer Job Type: libfuzzerubsanyara Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x0000ef8d0fc2 Cra...

yara/dex_fuzzer: Heap-buffer-overflow in yr_object_set_string

Project: https://github.com/VirusTotal/yara.git Detailed report: https://oss-fuzz.com/testcase?key=5055193814138880 Project: yara Fuzzer: libFuzzeryaradexfuzzer Fuzz target binary: dexfuzzer Job Type: libfuzzerasanyara Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address:...

BSides NYC, a volunteer organized event put on by and for the community

Another edition of BSides NYC has passed, and as first time attendee and presenter, I was genuinely impressed with the impeccable organization, the content shared, and the interesting conversations that took place among enthusiasts and professionals from all over the world. I've been a long time...