VideoLAN VLC Media Player 1.1.8 - ModPlug ReadS3M Stack Buffer Overflow (Metasploit)

$Id: vlcmodplugs3m.rb 12282 2011-04-08 15:48:53Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework...

Microsoft Cites Progress in SDL Report, Advocates More Adoption of ASLR, DEP

In the more than nine years since Bill Gates’s Trustworthy Computing email kicked off Microsoft’s comprehensive, company-wide security initiative, the company has not only committed a tremendous amount of money and resources to the project but also has been quite open and public about the process...

HT Editor 2.0.18 Stack Overflow

Exploit Title: HT Editor File openning Stack Overflow 0day Date: March 30th 2011 Author: ZadYree Software Link: http://hte.sourceforge.net/downloads.html Version: Thanks =cut use strict; use warnings; use constant SHELLCODE = "\xeb\x11\x5e\x31\xc9\xb1\x21\x80\x6c\x0e"...

Microsoft IE多个远程代码执行漏洞

BUGTRAQ ID: 46821 CVE ID: CVE-2011-1345,CVE-2011-1346,CVE-2011-1347 Internet Explorer，简称IE，是微软公司推出的一款网页浏览器。Internet Explorer，简称IE或MSIE，是微软公司推出的一款网页浏览器。 IE在实现上存在多个远程代码执行漏洞，远程攻击者可利用此漏洞在应用程序中执行任意代码，造成拒绝服务。 在Pwn2Own...

BlackBerry Hacked via Drive-By Download at Pwn2Own !

BlackBerry OS fell during the second day of the Pwn2Own hacking competition as a result of a drive-by download attack that chained together several exploits. The trio that managed to hack RIM's mobile operating system, Vincenzo Iozzo, Willem Pinckaers and Ralf Philipp Weinmann, exploited two...

CVE-2011-0726

The dotaskstat function in fs/proc/array.c in the Linux kernel before 2.6.39-rc1 does not perform an expected uid check, which makes it easier for local users to defeat the ASLR protection mechanism by reading the startcode and endcode fields in the /proc//stat file for a process executing a PIE...

Internet Explorer and Safari first to fall at Pwn2Own 2011, Chrome and Firefox still standing !

Pwn2Own, the annual three-day browser hackathon, has already claimed its first two victims: IE8 on Windows 7 64-bit, and Safari 5 on Mac OS X. Google Chrome looks set to survive for its third year in a row. Internet Explorer 8 was thoroughly destroyed by independent researcher Stephen Fewer. "He...

Apple Safari and Internet Explorer 8 Go Down at Pwn2Own, iPhone Up Next

VANCOUVER–On the first day of the Pwn2Own contest here, contestants were able to take down both Safari on Mac OS X and Internet Explorer 8 on Windows 7. None of the researchers decided to try their hand against Google Chrome, however, so that browser was the only one still standing after day one...

Internet Explorer CSS Recursive Import Use After Free

$Id: ms11003iecssimport.rb 11730 2011-02-08 23:31:44Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Microsoft Internet Explorer - CSS Recursive Import Use-After-Free (MS11-003) (Metasploit)

$Id: ms11003iecssimport.rb 11730 2011-02-08 23:31:44Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Linux Kernel "execve()"内存扩展"OOM-killer"本地拒绝服务漏洞

BUGTRAQ ID: 45004 CVE ID: CVE-2010-4243 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的"OOM-killer"功能在实现上存在安全漏洞，本地攻击者可利用此漏洞终止不相关的进程，造成拒绝服务。 漏洞源于oomkill函数看不到没有附加到任何线程的已分配内存。 Linux kernel 2.6.24.3 - 2.6.37 RedHat Enterprise Linux Desktop v.5 client 厂商补丁： Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载...

Microsoft WMI Administration Tools - ActiveX Buffer Overflow (Metasploit)

$Id: wmiadmintools.rb 11579 2011-01-14 16:25:37Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework...

Apple QuickTime 7.6.7 - _Marshaled_pUnk Code Execution (Metasploit)

$Id: applequicktimemarshaledpunk.rb 11513 2011-01-08 00:25:44Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Microsoft Warns On New Browser Vulnerability

Microsoft on Wednesday issued a security advisory to users of its Internet Explorer Web browser about a newly disclosed vulnerability that could be exploited and used to run malicious code on vulnerable Windows systems. The Redmond, Washington company said it is investigating new, public reports ...

Microsoft WMI Administration Tools ActiveX Buffer Overflow

This module exploits a memory trust issue in the Microsoft WMI Administration tools ActiveX control. When processing a specially crafted HTML page, the WEBSingleView.ocx ActiveX Control 1.50.1131.0 will treat the 'lCtxHandle' parameter to the 'AddContextRef' and 'ReleaseContext' methods as a...

Microsoft WMI Administration Tools ActiveX Buffer Overflow

$Id: wmiadmintools.rb 11405 2010-12-23 01:36:54Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework...

New Remotely Exploitable Bug Found in Internet Explorer

Another serious remotely exploitable bug in Internet Explorer has cropped up, this one related to the way that IE handles a specific DLL library on pages that reference CSS files. There also is publicly available exploit code for the new bug. The vulnerability was disclosed initially on the Full...

VUPEN Security Research - Apple Safari Scrollbar Handling Use-after-free Vulnerability (VUPEN-SR-2010-245)

VUPEN Security Research - Apple Safari Scrollbar Handling Use-after-free Vulnerability VUPEN-SR-2010-245 http://www.vupen.com/english/research.php I. BACKGROUND --------------------- "Apple Safari is a web browser developed by Apple. As of February 2010, Safari was the fourth most widely used...

Microsoft Internet Explorer 6/7/8 - Memory Corruption

Internet Explorer Memory Corruption 0day Vulnerability CVE-2010-3962 Tested on Windows XP SP3 IE6 IE7 IE8 Coded by Matteo Memelli ryujin at offsec.com http://www.offensive-security.com/0day/ie-0day.txt Thx to dookie at offsec.com notes : This is a quick and dirty exploit! No DEP/ASLR bypass here...

Mozilla Confirms Critical Firefox Bug, Readies Fix

Mozilla is working on a patch for the recently disclosed critical bug in Firefox that has been exploited on at least one prominent Web site this week. The vulnerability in Firefox is being used by attackers in drive-by download attacks to install malware on victims’ machines. Mozilla’s security...