CVE-2009-1255

The processstat function in 1 Memcached before 1.2.8 and 2 MemcacheDB 1.2.0 discloses a the contents of /proc/self/maps in response to a stats maps command and b memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain sensitive information such ...

CVE-2009-1255: Exposure of Sensitive Information to an Unauthorized Actor

The processstat function in 1 Memcached before 1.2.8 and 2 MemcacheDB 1.2.0 discloses a the contents of /proc/self/maps in response to a stats maps command and b memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain sensitive information such ...

Memcached / MemcacheDB ASLR Bypass Weakness

The version of memcached / MemcacheDB running on the remote host reveals information about the stack, heap, and shared library memory locations it uses. An unauthenticated remote attacker may be able to leverage this weakness to defeat any address space layout randomization ASLR protection on the...

Enhanced CTorrent / dtorrent "btFiles::BuildFromMI()"缓冲区溢出漏洞

CNCAN ID：CNCAN-2009042102 Enhanced CTorrent是一款UNIX环境下的Bittorrent客户端。 Enhanced CTorrent存在缓冲区溢出，远程攻击者可以利用漏洞以应用程序权限执行任意指令。 btfiles.cpp包含的"btFiles::BuildFromMI"函数存在边界错误，诱使用户打开特殊构建的torrent文件，可导致触发基于栈的缓冲区溢出，可能以应用程序权限执行任意指令。 Enhanced CTorrent 3.x 目前没有解决方案提供： http://sourceforge.net/projects/dtorrent/...

cTorrent/DTorrent Buffer Overflow

!/usr/bin/python Written By Michael Brooks 04/17/2009 Stack Based Buffer Overflow The vulnerability is in the btFiles::BuildFromMI function inside the btfiles.cpp file Exploit tested on cTorrent 1.3.4 using Debian Sarge using Linux kernel 2.4.27-3-386 Can't get the exploit working on a modern lin...

cTorrentDTorrent - .torrent Local Buffer Overflow

cTorrentDTorrent - .torrent Local Buffer Overflow !/usr/bin/python Written By Michael Brooks 04/17/2009 Stack Based Buffer Overflow The vulnerability is in the btFiles::BuildFromMI function inside the btfiles.cpp file Exploit tested on cTorrent 1.3.4 using Debian Sarge using Linux kernel...

Opera plugs code-execution vulnerabilities

Opera Software has shipped a high-priority security patch for its flagship Web browser to plug at least three vulnerabilities that expose Windows users to code execution and cross-domain scripting attacks. The Opera 9.64 upgrade also adds support for DEP Data Execution Prevention and ASLR Address...

Paper: Adventures with a certain Xen vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Invisible Things Lab is proud to present: "Adventures with a certain Xen vulnerability in the PVFB backend" by Rafal Wojtczuk Starring Xen 3.2.0, DomU an ordinary virtual machine, paravirtualized, Dom0 privileged administrative domain running on FC8...

linux/x86 setuid(0) . setgid(0) . aslr_off 79 bytes

No description provided by source. / Linux/x86 Fedora 8 setuid0 + setgid0 + execve"echo 0 /proc/sys/kernel/randomizevaspace" by LiquidWorm 2008 c www.zeroscience.org liquidworm at gmail.com 79 bytes. / char sc = "\x6a\x17" // push $0x17 "\x58" // pop %eax "\x31\xdb" // xor %ebx, %ebx "\xcd\x80" /...

Linux Kernel "do_mremap" Local Proof of Concept

No description provided by source. / Proof-of-concept exploit code for domremap Copyright C 2004 Christophe Devine and Julien Tinnes This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software...

iDefense Security Advisory 02.12.08: ClamAV libclamav PE File Integer Overflow Vulnerability

iDefense Security Advisory 02.12.08 http://labs.idefense.com/intelligence/vulnerabilities/ Feb 12, 2008 I. BACKGROUND Clam AntiVirus is a multi-platform GPL anti-virus toolkit. ClamAV is often integrated into e-mail gateways and used to scan e-mail traffic for viruses. It supports virus scanning...

Apple QuickTime 7.2/7.3 RSTP Response Code Exec Exploit (Vista/XP)

No description provided by source. / ============================================================= Apple Quicktime Vista/XP RSTP Response Remote Code Exec ============================================================= Discovered by: h07 Author: InTeL Tested on:...

aquick-rstp.txt

/ ============================================================= Apple Quicktime Vista/XP RSTP Response Remote Code Exec ============================================================= Discovered by: h07 Author: InTeL Tested on: - Quicktime 7.3 on Windows Vista, Result: SEH Overwrite, Code Exec -...

Apple QuickTime 7.2/7.3 RSTP Response Code Exec Exploit (Vista/XP)

Exploit for unknown platform in category remote exploits ================================================================== Apple QuickTime 7.2/7.3 RSTP Response Code Exec Exploit Vista/XP ================================================================== /...

Apple QuickTime 7.2/7.3 (Windows Vista/XP) - RSTP Response Code Execution

/ ============================================================= Apple Quicktime Vista/XP RSTP Response Remote Code Exec ============================================================= Discovered by: h07 Author: InTeL Tested on: - Quicktime 7.3 on Windows Vista, Result: SEH Overwrite, Code Exec -...

CheckPoint Secure Platform Multiple Buffer Overflows

Hi all, we have published a paper about CheckPoint Firewall-1 vulnerabilities. The platform tested is the Secure Platform R60. We have found many buffer overflows. Most of them are located in command line utilities that can be exploited locally. A very few of them maybe can be exploited remotely,...

Design/Logic Flaw

The administrative interface aka DkService.exe in Diskeeper 9 Professional, 2007 Pro Premier, and probably other versions exposes a memory comparison function via RPC over TCP, which allows remote attackers to 1 obtain sensitive information process memory contents, as demonstrated by an attack th...

CVE-2007-4375

The administrative interface aka DkService.exe in Diskeeper 9 Professional, 2007 Pro Premier, and probably other versions exposes a memory comparison function via RPC over TCP, which allows remote attackers to 1 obtain sensitive information process memory contents, as demonstrated by an attack th...

CVE-2007-4375

The CVE-2007-4375 entry concerns the administrative interface (DkService.exe) in Diskeeper 9 Professional, 2007 Pro Premier, and likely other versions. A memory comparison function is exposed via RPC over TCP, enabling remote attackers to (1) read process memory contents (e.g., obtain module base...

diskeeper-disclose.txt

Diskeeper Remote Memory Disclosure Credit: Pravus pravus -a-t- hush -d-o-t- com Greetz: Scientology for making a remotely accessible disk defragmenter. Felix, Jenna, and Isaac. Vulnerability Description: This vulnerability involves a memory comparison function that is remotely, anonymously...