Dropbox installations hinder effectiveness of ASLR.

UPDATE: The popular cloud storage service Dropbox was reportedly undercutting the efficacy of access space layout randomization ASLR by failing to enable that feature within the dynamic link libraries DLLs it injects into other applications. The company now claims it has resolved the issue. Graha...

VUPEN Security Research - Microsoft Windows "LdrHotPatchRoutine" Remote ASLR Bypass (Pwn2Own 2013 / MS13-063)

Microsoft Windows "LdrHotPatchRoutine" Remote ASLR Bypass Pwn2Own 2013 / MS13-063 Website : http://www.vupen.com Twitter : http://twitter.com/vupen I. BACKGROUND --------------------- "Microsoft Windows is a series of software operating systems and graphical user interfaces produced by Microsoft...

Amazon Linux AMI : kernel (ALAS-2013-200)

Heap-based buffer overflow in the tg3readvpd function in drivers/net/ethernet/broadcom/tg3.c in the Linux kernel before 3.8.6 allows physically proximate attackers to cause a denial of service system crash or possibly execute arbitrary code via crafted firmware that specifies a long string in the...

Amazon Linux AMI : kernel (ALAS-2012-58)

The ExecShield feature does not properly handle use of many shared libraries by a 32-bit executable file, which makes it easier for context-dependent attackers to bypass the ASLR protection mechanism by leveraging a predictable base address for one of these libraries. C Tenable Network Security,...

Amazon Linux AMI : kernel (ALAS-2012-142)

A use-after-free flaw was found in the Linux kernel's memory management subsystem in the way quota handling for huge pages was performed. A local, unprivileged user could use this flaw to cause a denial of service or, potentially, escalate their privileges. CVE-2012-2133 , Moderate A use-after-fr...

HP LoadRunner lrFileIOService ActiveX Remote Code Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 HttpClients::IE,...

HP LoadRunner lrFileIOService ActiveX Remote Code Execution

This Metasploit module exploits a vulnerability on the lrFileIOService ActiveX, as installed with HP LoadRunner 11.50. The vulnerability exists in the WriteFileBinary method where user provided data is used as a memory pointer. This Metasploit module has been tested successfully on IE6-IE9 on...

WinAmp 5.63 (winamp.ini) - Local Exploit

Exploit for windows platform in category local exploits Exploit Title: winampevilskin.py Date: 25 August 2013 Exploit Author: Ayman Sagy Vendor Homepage: http://www.winamp.com/ Version: 5.63 Tested on: Windows XP Professional SP3 Version 2002 CVE : 2013-4694 Ayman Sagy August 2013 This is an...

Winamp 5.63 - 'winamp.ini' Local Overflow

Exploit Title: winampevilskin.py Date: 25 August 2013 Exploit Author: Ayman Sagy Vendor Homepage: http://www.winamp.com/ Version: 5.63 Tested on: Windows XP Professional SP3 Version 2002 CVE : 2013-4694 Ayman Sagy August 2013 This is an exploit for Bug 1 described in...

Winamp 5.63 - winamp.ini Local Overflow

Winamp 5.63 - winamp.ini Local Overflow Exploit Title: winampevilskin.py Date: 25 August 2013 Exploit Author: Ayman Sagy Vendor Homepage: http://www.winamp.com/ Version: 5.63 Tested on: Windows XP Professional SP3 Version 2002 CVE : 2013-4694 Ayman Sagy August 2013 This is an exploit for Bug 1...

Microsoft Windows Kernel Privilege Elevation Vulnerabilities (2859537)

This host is missing an important security update according to Microsoft Bulletin MS13-063. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

MS13-063: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (2859537)

The Windows version installed on the remote host is affected by multiple vulnerabilities : - The Windows kernel is affected by multiple privilege escalation vulnerabilities due to a memory corruption condition in the NT Virtual DOS Machine NTVDM. An attacker who successfully exploited these issue...

Microsoft Fixes ASLR/DEP Bypass Bug

Buried in the details of the Microsoft Patch Tuesday release for August is the explanation of an important change that the company made to Windows that defeats a group of exploit mitigation bypasses. The change is a small one, but it prevents dangerous attacks that previously worked on most...

(Pwn2Own) Microsoft Windows Shared Data ASLR Security Feature Bypass Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the existence ...

Mitigating the LdrHotPatchRoutine DEP/ASLR bypass with MS13-063

Today we released MS13-063 which includes a defense in depth change to address an exploitation technique that could be used to bypass two important platform mitigations: Address Space Layout Randomization ASLR and Data Execution Prevention DEP. As we’ve described in the past, these mitigations pl...

Sami FTP Server 2.0.1 - MKD Buffer Overflow ASLR Bypass (SEH)

Sami FTP Server 2.0.1 - MKD Buffer Overflow ASLR Bypass SEH !/usr/bin/python Exploit Title: Sami FTP MKD buffer overflow SEH + Bypass ASL Date: 11 Agosto 2013 Exploit Author: Christian Polunchis Ramirez https://intrusionlabs.org Vendor Homepage: http://www.karjasoft.com/old.php Version: Sami FTP...

Sami FTP Server 2.0.1 - MKD Buffer Overflow ASLR Bypass (SEH)

!/usr/bin/python Exploit Title: Sami FTP MKD buffer overflow SEH + Bypass ASL Date: 11 Agosto 2013 Exploit Author: Christian Polunchis Ramirez https://intrusionlabs.org Vendor Homepage: http://www.karjasoft.com/old.php Version: Sami FTP Server 2.0.1 Tested on: Windows 7 Home Basic x86, Spanish...

Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20130716)

This update fixes the following security issues : - A flaw was found in the tcpreadsock function in the Linux kernel's IPv4 TCP/IP protocol suite implementation in the way socket buffers skb were handled. A local, unprivileged user could trigger this issue via a call to splice, leading to a denia...

kernel, perf, python security update

CentOS Errata and Security Advisory CESA-2013:1051 Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring...

Moderate: Red Hat Security Advisory: kernel security and bug fix update

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed...