Oracle Document Capture BlackIce Command Execution

var BlackIce = new ActiveXObject"BLACKICEDEVMODE.BlackIceDEVMODECtrl.1"; pBlackIceDEVMODE = BlackIce.LoadBlackIceDEVMODE "Oracle Document Capture"; BlackIce.EnableKeepExistingFiles pBlackIceDEVMODE; BlackIce.EnableStartApplication pBlackIceDEVMODE; BlackIce.EnableStartBeforePrintpBlackIceDEVMODE;...

Oracle Document Capture BlackIce DEVMODE exploit

No description provided by source. !-- Oracle Document Capture BlackIce DEVMODE ActiveX Control remote stack based buffer overflow IE8 /xp sp3 by Nine:Situations:Group::pyrokinesis CLSID: 1503569A-0AE2-4333-B6E6-466AB0BC73E5 Progid: BLACKICEDEVMODE.BlackIceDEVMODECtrl.1 Binary Path:...

RealSecure / Blackice iss_pam1.dll Remote Overflow Exploit

No description provided by source. / 557isspamexp - RealSecure / Blackice ICQ isspam1.dll remote overflow exploit Copyright c SST 2004 All rights reserved. Public version code by Sam Sam@efnet and 2004/03/26 [email protected] [email protected] ...

CVE-2003-1527

BlackICE Defender 2.9.cap and Server Protection 3.5.cdf, when configured to automatically block attacks, allows remote attackers to block IP addresses and cause a denial of service via spoofed packets...

CVE-2003-1527

Affected software : BlackICE Defender 2.9.cap and Server Protection 3.5.cdf. Vulnerability : When configured to automatically block attacks, remote attackers can cause a denial of service by spoofed packets, blocking IP addresses. Root cause/impact : The described behavior enables DoS through spo...

Unmasked virus how to turn off antivirus and security products-vulnerability warning-the black bar safety net

1, the kill rising software: at the command line please use ntsd –c-q-p PID 或者 使用 c:/pskill.exe ravmon command to kill rising software. 2, on Norton Enterprise Edition“automatic File Protection“of the close method: Close the service: net stop "Symantec AntiVirus" closed successful. Closing proces...

CVE-2006-7129

ISS BlackICE PC Protection 3.6 cpj and cpu, and possibly earlier versions, allows local users to bypass the protection scheme by using the ZwDeleteFile API function to delete the critical filelock.txt file, which stores information about protected files...

CVE-2006-7129

CVE-2006-7129 concerns ISS BlackICE PC Protection 3.6 cpj and possibly earlier versions. The issue allows local users to bypass the protection scheme by calling ZwDeleteFile to delete the critical filelock.txt, which stores information about protected files. The root cause is tampering with the f...

ISS PAM.dll ICQ Parser Buffer Overflow

This module exploits a stack buffer overflow in the ISS products that use the iss-pam1.dll ICQ parser Blackice/RealSecure. Successful exploitation will result in arbitrary code execution as LocalSystem. This exploit only requires 1 UDP packet, which can be both spoofed and sent to a broadcast...

BlackICE DLL伪造运行时链接库漏洞

BlackICE PC Protection是一款强大的数据信息过滤防火墙系统。 BlackICE对自身组件的保护上存在漏洞，本地攻击者可能利用此漏洞通过BlackICE完全控制系统。 BlackICE没有保护一些自己的进程，也没有防范其他进程对其安装目录中pamversion.dll文件可能执行的操作，允许用伪造的函数库替换这个DLL。在启动系统后初始化BlackICE期间主BlackICE服务blackd.exe会动态的将这个库加载到自己的进程，因此就可能将伪造的库注入到BlackICE服务，获得对受保护系统的完全控制。 ISS BlackICE PC Protection...

ISS BlackICE NtOpenSection()本地拒绝服务漏洞

BlackICE是一款Internet Security Systems公司发布的桌面防火墙系统。 BlackICE的rapdrv.sys驱动在处理NtOpenSection API钩子的对象属性参数时存在漏洞，攻击者可以利用将第三方参数设置为NULL的NtOpenSection API导致防火墙崩溃。 ISS BlackICE PC Protection 3.6 我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://xforce.iss.net / Testing program for Insufficient validation of arguments of...

IIS BlackIce PC Protection file lock protection bypass

It's possible to delete file and spoof deleted with new copy by direct call to ZwDeleteFile API...

Internet Security Systems 3.6 - ZWDeleteFile() Arbitrary File Deletion

Internet Security Systems 3.6 - ZWDeleteFile Arbitrary File Deletion source: https://www.securityfocus.com/bid/20546/info Internet Security Systems ISS BlackICE PC Protection is prone to a file-deletion vulnerability. An attacker can exploit this issue to delete arbitrary files within the context...

Internet Security Systems 3.6 - 'ZWDeleteFile()' Arbitrary File Deletion

source: https://www.securityfocus.com/bid/20546/info Internet Security Systems ISS BlackICE PC Protection is prone to a file-deletion vulnerability. An attacker can exploit this issue to delete arbitrary files within the context of the affected application. This could lead to other attacks...

[Full-disclosure] ISS BlackICE PC Protection Filelock protection bypass Vulnerability

Hello, We would like to inform you about a vulnerability in ISS BlackICE PC Protection. Description: BlackICE PC Protection protects its files against manipulation by malicious software. Its critical files like its database of trusted applications or firewall configuration are protected. The list...

CVE-2006-4541

RapDrv.sys in BlackICE PC Protection 3.6.cpn, cpj, cpiE, and possibly 3.6 and earlier, allows local users to cause a denial of service crash via a NULL third argument to the NtOpenSection API function. NOTE: it was later reported that 3.6.cqn is also affected...

CVE-2006-4541

CVE-2006-4541 affects RapDrv.sys in BlackICE PC Protection 3.6.x and earlier variants, where a NULL third argument passed to NtOpenSection can crash the system, enabling local denial of service. The vulnerability is tied to the driver’s handling of NtOpenSection arguments. No exploitation details...

ISS BlackICE PC Protection Insufficient validation of arguments of NtOpenSection Vulnerability

Hello, I would like to inform you about a vulnerability in BlackICE PC Protection driver found by Matousec - Transparent security. Description: Hooking SSDT functions requires extra caution. SSDT function handlers are executed in the kernel mode but their callers are executed in the user mode...

ISS BlackICE PC Protection DoS

Invalid NtOpenSection hook causes sytem to crash if 3rd paramter is NULL...

Internet Security Systems 3.6 BlackICE - Local Denial of Service

source: https://www.securityfocus.com/bid/19800/info Internet Security Systems ISS BlackICE PC Protection is prone to a local denial-of-service vulnerability because the application fails to properly sanitize user-supplied input. This vulnerability allows local attackers to crash affected systems...