Triaging a DLL planting vulnerability

DLL planting aka binary planting/hijacking/preloading resurface every now and then, it is not always clear on how Microsoft will respond to the report. This blog post will try to clarify the parameters considered while triaging DLL planting issues. It is well known that when an application loads ...

Triaging a DLL planting vulnerability

DLL planting aka binary planting/hijacking/preloading resurface every now and then, it is not always clear on how Microsoft will respond to the report. This blog post will try to clarify the parameters considered while triaging DLL planting issues. It is well known that when an application loads ...

Symantec Endpoint Protection Manager Remote Privilege Escalation (CVE-2015-1487; CVE-2015-1489)

A vulnerability exist in Symantec Endpoint protection. These vulnerability include privilege escalation, path traversal and binary planting. Attackers can exploit this issue to gain elevated privileges on the affected computer...

Symantec Embedded Security: Critical System Protection and Symantec Data Center Security: Server Adv

SUMMARY Symantec Embedded Security: Critical System Protection SES:CSP and Data Center Security: Server Advanced SDCS:SA were susceptible to security issues in the management server and deployed agents which could enable unauthorized elevated access, bypassing security protection on agents,...

Windows DLL hijacking

libcurl would load Windows system DLLs in a manner that may make it vulnerable to a DLL hijacking aka binary planting attack in certain configurations. libcurl has a unified code base that builds and runs on a multitude of different versions of Windows. To make that possible, when libcurl is buil...

Microsoft Internet Explorer 11 DLL Hijacking

Abstract -------- Microsoft Internet Explorer 11 MSHTML.DLL Remote Binary Planting Vulnerability Affected Version: MSHTML.DLL 11.0.9600.18231 and probably below on Windows 7 SP1 Vendor Homepage: http://www.microsoft.com Severity: high Status: fixed CVE-ID: CVE-2016-0160 Description -----------...

Art Systems FluidDraw P5/S5 5.3n Binary Planting Arbitrary Code Execution

/ Art Systems FluidDraw P5/S5 5.3n Binary Planting Arbitrary Code Execution Vendor: Art Systems Software GmbH | Festo AG & Co. KG Product web page: http://www.art-systems.com | https://www.festo.com Affected version: FluidDraw S5 Starter 5.3n 5.3.385.0 FluidDraw P5 Professional 5.3n 5.3.385.0...

Symantec Endpoint Protection Elevation of Privilege Issues

SUMMARY The management console for Symantec Endpoint Protection Manager SEPM is susceptible to OS command execution, Java code execution elevation of privilege. SEP clients are susceptible to a binary planting vulnerability that could result in arbitrary code running with system privileges on a...

Dell SonicWall NetExtender privilege escalation

Binary planting vulnerability...

Symantec Endpoint Protection Multiple Vulnerabilities

Exploit for multiple platform in category remote exploits Code White found several vulnerabilities in Symantec Endpoint Protection SEP, affecting versions 12.1 prior to 12.1 RU6 MP1. SEP Manager SEPM: CVE-2015-1486: Authentication Bypass CVE-2015-1487: Arbitrary File Write CVE-2015-1488: Arbitrar...

Symantec Endpoint Protection Multiple Issues

SUMMARY The management console for Symantec Endpoint Protection Manager SEPM is susceptible to multiple vulnerabilities including SQL Injection, authentication bypass, possible path traversal and the potential for arbitrary file read/write. SEP clients are susceptible to a binary planting...

AOL Instant Messenger 8.0.1.5 Binary Planting

!/bin/bash AOL Instant Messenger 8.0.1.5 Jul 2013 Exploit Windows XP/7 tested and working. Leverages binary file planting to My Documents via AIMs advertisement code. Little social engineering built in using javascript to try to get them to run the AIMInstall.exe. Starts a reverse shell back to...

SuSE 11.1 Security Update : flash-player (SAT Patch Number 6404)

Flash Player has been updated to 11.2.202.236 which fixes various bugs and critical security issues. The advisory published by Adobe can be found here: https://www.adobe.com/support/security/bulletins/apsb12-14.html These updates resolve - a memory corruption vulnerability that could lead to code...

VMSA-2012-0014 VMware vCenter Operations, CapacityIQ, and Movie Decoder security updates

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ----------------------------------------------------------------------- VMware Security Advisory Advisory ID: VMSA-2012-0014 Synopsis: VMware vCenter Operations, CapacityIQ, and Movie Decoder security updates Issue date: 2012-10-04 Updated on:...

VMSA-2012-0014:VMware vCenter Operations, CapacityIQ, and Movie Decoder security updates

VMSA-2012-0014 VMware vCenter Operations, CapacityIQ, and Movie Decoder security updates VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2012-0014 VMware Security Advisory Synopsis: VMware vCenter Operations, CapacityIQ, and Movie Decoder security updates VMware Security...

VMWare Tools susceptible to binary planting by hijack

Security Advisory - VMWare Tools susceptible to binary planting by hijack ========================================================================= Summary : VMWare Tools susceptible to binary planting Date : 4 September 2012 Affected versions : Product versions prior to - Workstation 8.0.4 Playe...

VMWare Tools Binary Planting

Security Advisory - VMWare Tools susceptible to binary planting by hijack ========================================================================= Summary : VMWare Tools susceptible to binary planting Date : 4 September 2012 Affected versions : Product versions prior to - Workstation 8.0.4 Playe...

Flash Player <= 10.3.183.19 / 11.3.300.256 Multiple Vulnerabilities (APSB12-14)

According to its version, the instance of Flash Player installed on the remote Windows host is 10.x equal to or earlier than 10.3.183.19 or 11.x equal to or earlier than 11.3.300.256. It is, therefore, potentially affected by multiple vulnerabilities : - Multiple memory corruption vulnerabilities...

Flash Player for Mac <= 10.3.183.19 / 11.3.300.256 Multiple Vulnerabilities (APSB12-14)

According to its version, the instance of Flash Player installed on the remote Mac OS X host is 10.x equal to or earlier than 10.3.183.19 or 11.x equal to or earlier than 11.3.300.256. It is, therefore, potentially affected by multiple vulnerabilities : - Multiple memory corruption vulnerabilitie...

SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 7713)

Mozilla Firefox was updated to version 3.6.20. It fixes bugs and security issues. Following security issues were fixed: Mozilla Foundation Security Advisory 2011-30 - MFSA 2011-30 - Miscellaneous memory safety hazards Mozilla developers and community members identified and fixed several memory...