kernel: proc: protect mm start_code/end_code in /proc/pid/stat

The dotaskstat function in fs/proc/array.c in the Linux kernel before 2.6.39-rc1 does not perform an expected uid check, which makes it easier for local users to defeat the ASLR protection mechanism by reading the startcode and endcode fields in the /proc//stat file for a process executing a PIE...

Important: Red Hat Security Advisory: kernel security and bug fix update

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed...

Magix Musik Maker 16 - .mmm Local Stack Buffer Overflow (Without EggHunter) (Metasploit)

Magix Musik Maker 16 - .mmm Local Stack Buffer Overflow Without EggHunter Metasploit --- My version of exploit... Looks like bug the same as in: http://www.exploit-db.com/exploits/17313/ My exploit does not use egg-hunter, so it must be faster, but i have limited size for payload - 750 bytes 8...

Gadu-Gadu Code Execution / Cross Site Scripting

Vendor: Gadu-Gadu http://gadu-gadu.pl Vulnerable Version: All Vulnerability Type: XSS, Remote Code Execution Risk level: Very High Credit: Kacper Szczesniak Vulnerability Details: Gadu-Gadu improperly handles file transfer requests. It's possible to place 255 chars of HTML code no slash inside th...

PHP Socket connect() Stack Buffer Overflow

Hi there, This is a quick writeup about some fun with apache based on CVE-2011-1938 that was disclosed yesterday. While the first POC was literally just a trivial POC - the second one was written for self-educational purposes we leared quite a lot which is the most important thing and we hope it...

Google Chrome 'Sandbox' Remote Code Execution Vulnerability (Windows)

The host is installed Google Chrome and is prone to remote code execution vulnerability. OpenVAS Vulnerability Test $Id: gbgooglechromesandboxcodeexecvulnwin.nasl 7019 2017-08-29 11:51:27Z teissa $ Google Chrome 'Sandbox' Remote Code Execution Vulnerability Windows Authors: Madhuri D Copyright:...

Magix Musik Maker 16 .mmm Stack Buffer Overflow

$Id: magixmusikmaker16mmm.rb 12688 2011-05-22 23:41:15Z swtornio $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Magix Musik Maker 16 .mmm Stack Buffer Overflow

Exploit for windows platform in category local exploits $Id: magixmusikmaker16mmm.rb 12688 2011-05-22 23:41:15Z swtornio $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more...

VisiWave VWR File Parsing Trusted Pointer Vulnerability

Exploit for windows platform in category local exploits $Id: visiwavevwrtype.rb 12716 2011-05-25 13:57:12Z swtornio $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information o...

Google Chrome 'Sandbox' Remote Code Execution Vulnerability - Windows

Google Chrome is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Magix Musik Maker 16 - '.mmm' Local Stack Buffer Overflow (Metasploit)

$Id: magixmusikmaker16mmm.rb 12688 2011-05-22 23:41:15Z swtornio $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

VisiWave VWR File Parsing Vulnerability

This module exploits a vulnerability found in VisiWave's Site Survey Report application. When processing .VWR files, VisiWaveReport.exe attempts to match a valid pointer based on the 'Type' property valid ones include 'Properties', 'TitlePage', 'Details', 'Graph', 'Table', 'Text', 'Image', but if...

Microsoft Releases Version 2.1 of EMET Mitigation Toolkit

Microsoft has released a new version of its Enhanced Mitigation Experience Toolkit, a free download that gives IT staffs the ability to better defend against exploit attempts. The EMET now includes support, as well. EMET is a toolkit that essentially is designed to add exploit mitigation...

Linux Kernel '/proc/[pid]/stat'本地信息泄露漏洞

Bugtraq ID: 47791 CVE ID：CVE-2011-0726 Linux是一款开放源代码的操作系统。 虽然mm-startstack受cross-uid查看保护，但是没有对startcode和endcode进行相应的保护，这个允许泄露PIE两进制程序的text.Location，攻击者可以利用这个信息绕过ASLR保护。 Linux kernel 2.6.x 厂商解决方案 用户可参考如下供应商提供的安全公告获得补丁信息： https://lkml.org/lkml/2011/3/11/380...

RHEL 6 : kernel (RHSA-2011:0498)

Updated kernel packages that fix several security issues, various bugs, and add an enhancement are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, whic...

kernel: proc: protect mm start_code/end_code in /proc/pid/stat

The dotaskstat function in fs/proc/array.c in the Linux kernel before 2.6.39-rc1 does not perform an expected uid check, which makes it easier for local users to defeat the ASLR protection mechanism by reading the startcode and endcode fields in the /proc//stat file for a process executing a PIE...

French security firm VUPEN Say New Bugs Can Bypass Google Chrome Sandbox !

French security firm VUPEN Say New Bugs Can Bypass Google Chrome Sandbox ! Researchers at the French security firm VUPEN say that they have discovered several new vulnerabilities in Google Chrome that enable them to bypass the browser's sandbox, as well as ASLR and DEP and run arbitrary code on a...

Mozilla Firefox 3.6.16 mChannel Use-After-Free Vulnerability

This module exploits a use after free vulnerability in Mozilla Firefox 3.6.16. An OBJECT Element mChannel can be freed via the OnChannelRedirect method of the nsIChannelEventSink Interface. mChannel becomes a dangling pointer and can be reused when setting the OBJECTs data attribute. Discovered b...

Researchers Say New Bugs Can Bypass Google Chrome Sandbox

Researchers at the French security firm VUPEN say that they have discovered several new vulnerabilities in Google Chrome that enable them to bypass the browser’s sandbox, as well as ASLR and DEP and run arbitrary code on a vulnerable machine. The company said that they are not going to disclose t...

Tom Sawyer Software GET Extension Factory Remote Code Execution

This module exploits a remote code execution vulnerability in the tsgetx71ex553.dll ActiveX control installed with Tom Sawyer GET Extension Factory due to an incorrect initialization under Internet Explorer. While the Tom Sawyer GET Extension Factory is installed with some versions of VMware...