Photodex ProShow Producer 5.0.3310 - Local Buffer Overflow (SEH)

!/usr/bin/perl Exploit Title: Photodex ProShow Producer v5.0.3310 - Local Buffer Overflow SEH Date: 10-26-2013 Exploit Author: Mike Czumak Tv3rn1x -- @SecuritySift Vulnerable Software: Photodex ProShow Producer v5.0.3310 Software Link: http://files.photodex.com/release/pspro503310.exe Version:...

ASLR bypass techniques are popular with APT attacks

Address space layout randomization ASLR is a security technique involved in protection from buffer overflow attacks. Many recent APT Advanced Persistent Threat attacks have utilized many different ASLR bypass techniques during the past year, according to Researchers at FireEye. Many exploits and...

ASLR bypass techniques are popular with APT attacks

Address space layout randomization ASLR is a security technique involved in protection from buffer overflow attacks. Many recent APT Advanced Persistent Threat attacks have utilized many different ASLR bypass techniques during the past year, according to Researchers at FireEye. Many exploits and...

Oracle Outside In Microsoft Access 1.x parser stack buffer overflow

Overview Oracle Outside In contains a stack buffer overflow vulnerability in the Microsoft Access 1.x database file parser, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Oracle Outside In is a set of libraries that can decode over...

Internet Explorer zero-day exploit used watering hole attacks to target Japanese users

Attackers exploiting a zero-day vulnerability CVE-2013-3893 in Microsoft's Internet Explorer browser and served them on compromised popular Japanese news websites. According to FireEye, at least three major Japanese media websites were compromised in watering hole attacks, dubbed Operation...

IE Zero Day Used in Targeted Attacks Against Japanese Firms

Attackers exploiting a zero-day vulnerability in Microsoft’s Internet Explorer browser have compromised several popular local Japanese media outlets and have infected systems belonging to government, high tech and manufacturing organizations in Japan. Researchers at FireEye said the attacks appea...

Microsoft Warns of New IE Zero Day

UPDATE–Microsoft is looking into reports of targeted attacks against a new vulnerability that exists in all supported versions of Internet Explorer. The attacks are targeting IE 8 and 9 and there’s no patch for the vulnerability right now, though Microsoft has developed a FixIt tool for it. “The...

Apple Fixes 30 Bugs With Mountain Lion Update

Apple pushed a handful of patches late last week and updated its OS X Mountain Lion to 10.8.5, improving “stability, compatibility and security” issues and fixing 30 different vulnerabilities in the operating system. The update fixes multiple vulnerabilities in Apache that could have led to a...

Dropbox installations hinder effectiveness of ASLR.

UPDATE: The popular cloud storage service Dropbox was reportedly undercutting the efficacy of access space layout randomization ASLR by failing to enable that feature within the dynamic link libraries DLLs it injects into other applications. The company now claims it has resolved the issue. Graha...

VUPEN Security Research - Microsoft Windows "LdrHotPatchRoutine" Remote ASLR Bypass (Pwn2Own 2013 / MS13-063)

Microsoft Windows "LdrHotPatchRoutine" Remote ASLR Bypass Pwn2Own 2013 / MS13-063 Website : http://www.vupen.com Twitter : http://twitter.com/vupen I. BACKGROUND --------------------- "Microsoft Windows is a series of software operating systems and graphical user interfaces produced by Microsoft...

Amazon Linux AMI : kernel (ALAS-2012-58)

The ExecShield feature does not properly handle use of many shared libraries by a 32-bit executable file, which makes it easier for context-dependent attackers to bypass the ASLR protection mechanism by leveraging a predictable base address for one of these libraries. C Tenable Network Security,...

Amazon Linux AMI : kernel (ALAS-2013-200)

Heap-based buffer overflow in the tg3readvpd function in drivers/net/ethernet/broadcom/tg3.c in the Linux kernel before 3.8.6 allows physically proximate attackers to cause a denial of service system crash or possibly execute arbitrary code via crafted firmware that specifies a long string in the...

Amazon Linux AMI : kernel (ALAS-2012-142)

A use-after-free flaw was found in the Linux kernel's memory management subsystem in the way quota handling for huge pages was performed. A local, unprivileged user could use this flaw to cause a denial of service or, potentially, escalate their privileges. CVE-2012-2133 , Moderate A use-after-fr...

HP LoadRunner lrFileIOService ActiveX Remote Code Execution

This Metasploit module exploits a vulnerability on the lrFileIOService ActiveX, as installed with HP LoadRunner 11.50. The vulnerability exists in the WriteFileBinary method where user provided data is used as a memory pointer. This Metasploit module has been tested successfully on IE6-IE9 on...

HP LoadRunner lrFileIOService ActiveX Remote Code Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 HttpClients::IE,...

WinAmp 5.63 (winamp.ini) - Local Exploit

Exploit for windows platform in category local exploits Exploit Title: winampevilskin.py Date: 25 August 2013 Exploit Author: Ayman Sagy Vendor Homepage: http://www.winamp.com/ Version: 5.63 Tested on: Windows XP Professional SP3 Version 2002 CVE : 2013-4694 Ayman Sagy August 2013 This is an...

Winamp 5.63 - 'winamp.ini' Local Overflow

Exploit Title: winampevilskin.py Date: 25 August 2013 Exploit Author: Ayman Sagy Vendor Homepage: http://www.winamp.com/ Version: 5.63 Tested on: Windows XP Professional SP3 Version 2002 CVE : 2013-4694 Ayman Sagy August 2013 This is an exploit for Bug 1 described in...

Winamp 5.63 - winamp.ini Local Overflow

Winamp 5.63 - winamp.ini Local Overflow Exploit Title: winampevilskin.py Date: 25 August 2013 Exploit Author: Ayman Sagy Vendor Homepage: http://www.winamp.com/ Version: 5.63 Tested on: Windows XP Professional SP3 Version 2002 CVE : 2013-4694 Ayman Sagy August 2013 This is an exploit for Bug 1...

MS13-063: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (2859537)

The Windows version installed on the remote host is affected by multiple vulnerabilities : - The Windows kernel is affected by multiple privilege escalation vulnerabilities due to a memory corruption condition in the NT Virtual DOS Machine NTVDM. An attacker who successfully exploited these issue...

Microsoft Windows Kernel Privilege Elevation Vulnerabilities (2859537)

This host is missing an important security update according to Microsoft Bulletin MS13-063. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...