7008 matches found
Inside the PowerPoint mega-patch
Microsoft patched all Windows versions of PowerPoint today — addressing both a zero-day flaw microsoft.com and 13 other privately reported security vulnerabilities. The zero-day vulnerability enabled attackers to take over client machines if a user opened a malformed powerpoint document or visite...
Patch coming for MS PowerPoint zero-day flaw
Exactly one month after malicious hackers started using rigged PowerPoint files to launch targeted attacks, Microsoft announced plans to ship a “critical” bulletin affecting its flagship presentation program. The PowerPoint update is the only bulletin scheduled for this month’s Patch Tuesday on M...
Businesses struggle with Adobe PDF security advice
Adobe has set a May 12 date for the delivery of patches to cover a critical zero-day vulnerability in its Adobe Reader 9.1 and Acrobat 9.1 software products. An official security advisory from Adobe confirms the severity of the vulnerability and reiterates the advice for users to turn off...
ZDI-09-018: Symantec Client Security Alert Originator Service Stack Overflow Vulnerability
ZDI-09-018: Symantec Client Security Alert Originator Service Stack Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-018 April 28, 2009 -- CVE ID: CVE-2009-1430 -- Affected Vendors: Symantec -- Affected Products: Symantec Client Security -- TippingPointTM IPS Customer...
Adobe PDF zero-day update: Turn off JavaScript
Adobe’s security response team is scrambling to investigate new public reports of a new zero-day vulnerability affecting uses of its widely deployed PDF Reader software. In a brief note posted to its PSIRT blog, Adobe confirmed it was investigating a code execution flaw, which affects Adobe Reade...
Flatnuke 2.7.1 Privilege Escalation
!/usr/bin/env perl Flatnuke timeout5; $lwp-agent'Links 2.1pre26; Linux 2.6.19-gentoo-r5 x8664; x'; $lwp-defaultheader'Cookie' = "myforum=$user; path=$path; secid=$secid; path=$path;"; $ret = $lwp-post"http://$host/$path/index.php?mod=noneLogin",...
Flatnuke 2.7.1 - level Privilege Escalation
Flatnuke 2.7.1 - level Privilege Escalation !/usr/bin/env perl Flatnuke timeout5; $lwp-agent'Links 2.1pre26; Linux 2.6.19-gentoo-r5 x8664; x'; $lwp-defaultheader'Cookie' = "myforum=$user; path=$path; secid=$secid; path=$path;"; $ret = $lwp-post"http://$h...
Flatnuke <= 2.7.1 (level) Remote Privilege Escalation Exploit
Exploit for unknown platform in category web applications ============================================================= Flatnuke timeout5; $lwp-agent'Links 2.1pre26; Linux 2.6.19-gentoo-r5 x8664; x'; $lwp-defaultheader'Cookie' = "myforum=$user; path=$path; secid=$secid; path=$path;"; $ret =...
FGA-2009-003:EMC RepliStor Buffer Overflow Vulnerability
FGA-2009-003:EMC RepliStor Buffer Overflow Vulnerability 2009.April.08 Summary: ======== Fortinet's FortiGuard Global Security Research Team has discovered a buffer overflow vulnerability in EMC RepliStor. Impact: ======= Remote code execution. Risk: ===== Critical Affected Software: ...
ZDI-09-016: Novell Client/NetIdentity Agent Remote Arbitrary Pointer Dereference Code Execution Vulnerability
ZDI-09-016: Novell Client/NetIdentity Agent Remote Arbitrary Pointer Dereference Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-016 April 6, 2009 -- Affected Vendors: Novell -- Affected Products: Novell Netware -- Vulnerability Details: This vulnerability allows...
Microsoft issues PowerPoint zero-day warning
Microsoft has issued an advisory to warn about an under-attack zero-day vulnerability affecting its PowerPoint software. According to the pre-patch advisory, the flaw allows remote code execution if a user opens a booby-trapped PowerPoint file. The company described the attacks as “limited and...
ZDI-09-015: Mozilla Firefox XUL _moveToEdgeShift() Memory Corruption Vulnerability
ZDI-09-015: Mozilla Firefox XUL moveToEdgeShift Memory Corruption Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-015 March 30, 2009 -- CVE ID: CVE-2009-1044 -- Affected Vendors: Mozilla Firefox -- Affected Products: Mozilla Firefox 3.0.x -- Vulnerability Details: This...
Firefox 3.0.8 fixes two code execution holes
Mozilla has released Firefox 3.0.8 to fix a pair of code execution holes that put users of the browser at risk of drive-by download attacks. It includes a fix for one of the flaws exploited during this year’s CanSecWest Pwn2Own hacker contest. The update also fixes a separate zero-day flaw...
Arbitrary code execution via XUL tree element — Mozilla
Security researcher Nils reported via TippingPoint's Zero Day Initiative that the XUL tree method moveToEdgeShift was in some cases triggering garbage collection routines on objects which were still in use. In such cases, the browser would crash when attempting to access a previously destroyed...
Firefox scrambles to patch zero-day flaw
Mozilla’s security response team is scrambling to ready a patch zdnet.com for what appears to be a serious security vulnerability affecting users of its flagship Firefox browser. The vulnerability mozilla.org, released alongside proof-of-concept code securityfocus.com on several security sites,...
DirectAdmin <= 1.33.1 Symlink Permission Bypass Vuln (untested)
No description provided by source. /H\ /T\ |T-HHHHHHH-T| HHHHHHHHHH| HHHHHHHHHH| H-T H-T \T-HHHHH-T/ HHHHHHHHH/ HHHHHHHHH/ H-T H-T H-T H-T H-T H-THHHHHH-T /HHHHH\ H-T H-T H-T H-THHHHHH-T THHHHHT H-T H-T H-T H-T H-T \HHHHH/ H-T H-T H-T H-T H-T H-T H-T H-T H-T H-T H-T /H\ HHHHHHHHH\...
Countdown to Conficker's April 1st climax
By Byron Acohido, LastWatchdog.com Two schools of thought exist about what the Conficker worm will do come the wee hours of April 1, 2009, GMT. Some experts, like WinPatrol creator Bill Pytlovany, are sensing that the worm’s controllers will run circles lastwatchdog.com around the Microsoft-led...
DirectAdmin <= 1.33.1 Symlink Permission Bypass Vuln (untested)
Exploit for unknown platform in category remote exploits =============================================================== DirectAdmin /home/attackeruser/domains/attackersite.com/publichtml/ Execute : ln /etc/shadow After that Go to The Control Panel...
ZDI-09-014: Adobe Acrobat getIcon() Stack Overflow Vulnerability
ZDI-09-014: Adobe Acrobat getIcon Stack Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-014 March 24, 2009 -- CVE ID: CVE-2009-0927 -- Affected Vendors: Adobe -- Affected Products: Adobe Acrobat -- TippingPointTM IPS Customer Protection: TippingPoint IPS customers have...
DirectAdmin 1.33.1 Bypass
/H\ /T\ |T-HHHHHHH-T| HHHHHHHHHH| HHHHHHHHHH| H-T H-T \T-HHHHH-T/ HHHHHHHHH/ HHHHHHHHH/ H-T H-T H-T H-T H-T H-THHHHHH-T /HHHHH\ H-T H-T H-T H-THHHHHH-T THHHHHT H-T H-T H-T H-T H-T \HHHHH/ H-T H-T H-T H-T H-T H-T H-T H-T H-T H-T H-T /H\ HHHHHHHHH\ HHHHHHHHH\ \H/ \T/ H-T \T/ HHHHHHHHHH| HHHHHHHHHH|...