QEMU安全绕过漏洞

BUGTRAQ ID: 30604 CVE ID：CVE-2008-1945 CNCVE ID：CNCVE-20081945 QEMU是一款面向完整PC系统的开源仿真器。 QEMU不正确限制对部分功能的访问，本地攻击者可以利用漏洞绕过安全限制，执行未授权攻击。 QEMU没有正确处理针对可移动媒介的更改，允许客户操作系统用户通过使用diskformat读取宿主OS上的任意文件。通过在-usbdevice选项的参数可修改磁盘映像头字段数据而识别为不同的格式来读取文件。 MandrakeSoft Linux Mandrake 2008.1 x8664 MandrakeSoft Linux...

CVE-2008-1945

QEMU 0.9.0 does not properly handle changes to removable media, which allows guest OS users to read arbitrary files on the host OS by using the diskformat: parameter in the -usbdevice option to modify the disk-image header to identify a different format, a related issue to CVE-2008-2004...

CVE-2008-1945

QEMU 0.9.0 does not properly handle changes to removable media, which allows guest OS users to read arbitrary files on the host OS by using the diskformat: parameter in the -usbdevice option to modify the disk-image header to identify a different format, a related issue to CVE-2008-2004...

CVE-2008-2324

The Repair Permissions tool in Disk Utility in Apple Mac OS X 10.4.11 adds the setuid bit to the emacs executable file, which allows local users to gain privileges by executing commands within emacs...

Design/Logic Flaw

The Repair Permissions tool in Disk Utility in Apple Mac OS X 10.4.11 adds the setuid bit to the emacs executable file, which allows local users to gain privileges by executing commands within emacs...

CVE-2008-2324

The Repair Permissions tool in Disk Utility in Apple Mac OS X 10.4.11 adds the setuid bit to the emacs executable file, which allows local users to gain privileges by executing commands within emacs...

CVE-2008-2324

CVE-2008-2324 affects Apple Mac OS X (Disk Utility’s Repair Permissions tool). The vulnerability arises when Repair Permissions runs and incorrectly adds the setuid bit to /usr/bin/emacs, enabling a local attacker to execute commands as root by invoking emacs. This is a local privilege-escalation...

Apple Mac OS X 2008-005更新修复多个安全漏洞

BUGTRAQ ID: 30487,30488,30489,30490,30492,30493 CVECAN ID: CVE-2008-2320,CVE-2008-2321,CVE-2008-2322,CVE-2008-2323,CVE-2008-2324,CVE-2008-2325 Mac OS X是苹果家族机器所使用的操作系统。 Apple 2008-005安全更新修复了Mac OS X中的多个安全漏洞，本地或远程攻击者可能利用这些漏洞造成多种威胁。 CVE-2008-2320 处理超长文件名时的栈溢出漏洞可能导致应用意外终止或执行任意指令。 CVE-2008-2321...

CVE-2008-2324: Undefined Security Weakness

The Repair Permissions tool in Disk Utility in Apple Mac OS X 10.4.11 adds the setuid bit to the emacs executable file, which allows local users to gain privileges by executing commands within emacs...

AIX 530006 : U819385

The remote host is missing AIX PTF U819385 which is related to the security of the package devices.common.IBM.disk.rte You should install this PTF for your system to be up-to-date. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0;...

AIX 530006 : U819392

The remote host is missing AIX PTF U819392 which is related to the security of the package devices.fcp.disk.array.rte You should install this PTF for your system to be up-to-date. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0;...

UDF truncating issue

The Universal Disk Format UDF filesystem driver in Linux kernel 2.6.17 and earlier allows local users to cause a denial of service hang and crash via certain operations involving truncated files, as demonstrated via the dd command...

Microsoft Malware Protection Engine TWO DoS Vulnerabilities

CVE-2008-1437 CVE-2008-1438 There are two vulnerabilities idenitified in Microsoft Antivirus product. These vulnerabilities can be exploited to cause Denial of service. 1. CVE-2008-1437 PE Parsing Memory Corruption While scanning a specially crafted PE file, Malware orotection engine...

Microsoft SQL Server磁盘数据结构整数溢出漏洞（MS08-040）

BUGTRAQ ID: 30119 CVECAN ID: CVE-2008-0107 Microsoft SQL Server是一款流行的SQL数据库系统。 SQL Server负责解析存储备份数据的代码存在漏洞，该段代码从文件获得了代表记录大小的32位整数值用于计算所要读取到堆缓冲区的字节数。这个计算可能下溢，导致分配不充分的内存，之后的操作会触发溢出。 如果要利用这个漏洞，攻击者必须能够诱骗服务器加载特制的备份文件，可通过提交到远程文件的路径或使用SMB/WebDAV来实现。 Microsoft SQL Server 7.0 SP4 Microsoft SQL Server 2005...

NASM 2.0 - 'ppscan()' Off-by-One Buffer Overflow

source: https://www.securityfocus.com/bid/29656/info NASM is prone to an off-by-one buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data. Successfully exploiting this issue will allow attackers to execute arbitrary code within the...

openSUSE 10 Security Update : qemu (qemu-5270)

Local attackers could use raw formatted disk images to access the hosting environment. CVE-2008-2004 has been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update qemu-5270...

Protection anti is Protection error--Taoyuan disk new vulnerability-vulnerability warning-the black bar safety net

Recently I took up the study of“Taoyuan Network Hard security”related tasks. The following operation is the latest of the“Taoyuan Network Hard Disk V3. 1 Personal Edition free version”, so the following is the analysis of vulnerability is possible only for the above version is useful, but the...

Code injection

Unspecified vulnerability in the Service Tag Registry on Sun Solaris 10, and Sun Service Tag before 1.1.3, allows local users to cause a denial of service disk consumption via unspecified vectors...

CVE-2008-2552

Unspecified vulnerability in the Service Tag Registry on Sun Solaris 10, and Sun Service Tag before 1.1.3, allows local users to cause a denial of service disk consumption via unspecified vectors...

CVE-2008-2552

CVE-2008-2552 affects Sun Solaris 10 and Sun Service Tag prior to 1.1.3. The issue arises in the Service Tag Registry and allows a local attacker to cause a denial of service (disk consumption) via unspecified vectors. Nessus plugins list patches 136839-01 for SPARC and 136840-01 for x86 as the r...