Design/Logic Flaw

A vulnerability was discovered in Siemens SIMATIC WinCC V7.3 before Upd 11 and V7.4 before SP1, SIMATIC WinCC Runtime Professional V13 before SP2 and V14 before SP1, SIMATIC WinCC TIA Portal Professional V13 before SP2 and V14 before SP1 that could allow an authenticated, remote attacker who is...

CVE-2017-6867

A vulnerability was discovered in Siemens SIMATIC WinCC V7.3 before Upd 11 and V7.4 before SP1, SIMATIC WinCC Runtime Professional V13 before SP2 and V14 before SP1, SIMATIC WinCC TIA Portal Professional V13 before SP2 and V14 before SP1 that could allow an authenticated, remote attacker who is...

CVE-2017-6867

A vulnerability was discovered in Siemens SIMATIC WinCC V7.3 before Upd 11 and V7.4 before SP1, SIMATIC WinCC Runtime Professional V13 before SP2 and V14 before SP1, SIMATIC WinCC TIA Portal Professional V13 before SP2 and V14 before SP1 that could allow an authenticated, remote attacker who is...

CVE-2017-6867

A vulnerability was discovered in Siemens SIMATIC WinCC V7.3 before Upd 11 and V7.4 before SP1, SIMATIC WinCC Runtime Professional V13 before SP2 and V14 before SP1, SIMATIC WinCC TIA Portal Professional V13 before SP2 and V14 before SP1 that could allow an authenticated, remote attacker who is...

CVE-2017-6867

CVE-2017-6867 affects Siemens SIMATIC WinCC family (WinCC v7.3 before Update 11, WinCC v7.4 before SP1; WinCC Runtime Professional v13 before SP2, v14 before SP1; WinCC (TIA Portal) Professional v13 before SP2, v14 before SP1). The issue is improper input validation allowing an authenticated remo...

Exploiting .NET Managed DCOM

Posted by James Forshaw, Project Zero One of the more interesting classes of security vulnerabilities are those affecting interoperability technology. This is because these vulnerabilities typically affect any application using the technology, regardless of what the application actually does. Als...

Windows: Dolby Audio X2 Service EoP (CVE-2017-7293)

Windows: Dolby Audio X2 Service Elevation of Privilege Platform: Windows 10 + Realtek Audio Driver version 6.0.1.7898 on a Lenovo P50. Version of the service binary 0.7.2.61 built on 7/18/2016. Class: Elevation of Privilege Summary: The DAX2API service installed as part of the Realtek Audio Drive...

CVE-2017-7293

The Dolby DAX2 and DAX3 API services are vulnerable to a privilege escalation vulnerability that allows a normal user to get arbitrary system privileges, because these services have .NET code for DCOM. This affects Dolby Audio X2 DAX2 1.0, 1.0.1, 1.1, 1.1.1, 1.2, 1.3, 1.3.1, 1.3.2, 1.4, 1.4.1,...

Privilege escalation

The Dolby DAX2 and DAX3 API services are vulnerable to a privilege escalation vulnerability that allows a normal user to get arbitrary system privileges, because these services have .NET code for DCOM. This affects Dolby Audio X2 DAX2 1.0, 1.0.1, 1.1, 1.1.1, 1.2, 1.3, 1.3.1, 1.3.2, 1.4, 1.4.1,...

CVE-2017-7293

The CVE-2017-7293 entry concerns a privilege-escalation in the Dolby DAX2/DAX3 API services. The issue stems from using .NET code for DCOM, enabling a normal user to gain system privileges. Affected products include Dolby Audio X2 (versions 1.0–1.4.4) and DAX3 (1.0–1.1), with Realtek/Lenovo-refer...

CVE-2017-7293

The Dolby DAX2 and DAX3 API services are vulnerable to a privilege escalation vulnerability that allows a normal user to get arbitrary system privileges, because these services have .NET code for DCOM. This affects Dolby Audio X2 DAX2 1.0, 1.0.1, 1.1, 1.1.1, 1.2, 1.3, 1.3.1, 1.3.2, 1.4, 1.4.1,...

MS16-075 Windows SMB Server Elevation of Privilege Vulnerability (CVE-2016-3225)

Overview As we mentioned a number of times throughout our talk, this work is derived directly from James Forshaw’s BlackHat talk and Google Project Zero research. I highly recommend reviewing both of these resources to anyone interested in pursuing this topic. The idea behind this vulnerability i...

MS15-076 Windows: DCOM DCE/RPC Local NTLM Reflection Elevation of Privilege (CVE-2015-2370)

Windows: DCOM DCE/RPC-Local NTLM Reflection Elevation of Privilege Platform: Windows 8.1 Update not tested on Windows 7, 10 Class: Elevation of Privilege Summary: Local DCOM DCE/RPC connections can be reflected back to a listening TCP socket allowing access to an NTLM authentication challenge for...

Windows 10 Realtek Audio Driver 6.0.1.7898 - Dolby Audio X2 Service Privilege Escalation Vulnerabili

The DAX2API service installed as part of the Realtek Audio Driver on Windows 10 is vulnerable to a privilege escalation vulnerability which allows a normal user to get arbitrary system privileges. Windows: Dolby Audio X2 Service EoP CVE-2017-7293 Windows: Dolby Audio X2 Service Elevation of...

Realtek Audio Driver 6.0.1.7898 (Windows 10) - Dolby Audio X2 Service Privilege Escalation

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1075 Windows: Dolby Audio X2 Service Elevation of Privilege Platform: Windows 10 + Realtek Audio Driver version 6.0.1.7898 on a Lenovo P50. Version of the service binary 0.7.2.61 built on 7/18/2016. Class: Elevation of Privilege...

Microsoft Windows - ManagementObject Arbitrary .NET Serialization Remote Code Execution Exploit

Exploit for windows platform in category remote exploits Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1081 Windows: ManagementObject Arbitrary .NET Serialization RCE Platform: .NET 4.6, Powershell 4. Tested between Server 2016 and Windows 10 Anniversary Edition Class: Remote...

Microsoft Windows - ManagementObject Arbitrary .NET Serialization Remote Code Execution

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1081 Windows: ManagementObject Arbitrary .NET Serialization RCE Platform: .NET 4.6, Powershell 4. Tested between Server 2016 and Windows 10 Anniversary Edition Class: Remote Code Execution Summary: Accessing a compromised WMI serve...

Microsoft Windows - ManagementObject Arbitrary .NET Serialization Remote Code Execution

Microsoft Windows - ManagementObject Arbitrary .NET Serialization Remote Code Execution Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1081 Windows: ManagementObject Arbitrary .NET Serialization RCE Platform: .NET 4.6, Powershell 4. Tested between Server 2016 and Windows 10...

Windows: ManagementObject Arbitrary .NET Serialization RCE（CVE-2017-0160）

Windows: ManagementObject Arbitrary .NET Serialization RCE Platform: .NET 4.6, Powershell 4. Tested between Server 2016 and Windows 10 Anniversary Edition Class: Remote Code Execution Summary: Accessing a compromised WMI server over DCOM using System.Management classes or the Powershell...

CVE-2017-0100

A DCOM object in Helppane.exe in Microsoft Windows 7 SP1; Windows Server 2008 R2; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows local users to gain privileges via a crafted application, aka "Windows HelpPane Elevation...