Microsft COFEE v1.1.2 DLL Hijacking Exploit

=========================================== Microsft COFEE v1.1.2 DLL Hijacking Exploit =========================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' /' / /' 0 0 /, // ,/ / 1 1 // /' / // /' / /' 0 0 / / / / / / 1 1 / / 0 0 ////// //...

Report: More Than 1 Million Web Sites Serving Malware in Q2

Web anti malware firm Dasient has published data claiming that more than 1 million Web sites were compromised in the second quarter, 2010 – a sharp increase. More than one million Web domains were infected with malicious code in the second quarter of 2010 – around one percent of all active Web...

Xplico 0.5.7 Cross Site Scripting

Xplico v0.5.7 add.ctp Remote XSS Vulnerability Title: Xplico v0.5.7 add.ctp Remote XSS Vulnerability Type: Remote Impact: Cross-Site Scripting Release Date: 02.07.2010 Release mode: Coordinated release Summary ======= The goal of Xplico is extract from an internet traffic capture the applications...

SUMATRA PDF READER version 1.1 (CRASHER) DoS File Creator

Exploit for windows platform in category dos / poc ========================================================= SUMATRA PDF READER version 1.1 CRASHER DoS File Creator ========================================================= SUMATRA PDF READER version 1.1 CRASHER DoS File Creator Vulnerability...

Sumatra PDF Reader 1.1 Denial Of Service

SUMATRA PDF READER version 1.1 CRASHER DoS File Creator Vulnerability Detection Time : 21st June 2010, 1:13 AM Tested on version 1.1 of Sumara PDF Reader Nature : Accidental Discovery Description : Sumatra PDF Reader crashed while testing recovered PDF Files from a HardDisk. PDF Files recovered...

r57shell Backdoor Detection

At least one instance of r57shell is hosted on the remote web server. This is a PHP script that acts as a backdoor and provides a convenient set of tools for attacking the affected host. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Free COFEE Helps Law Enforcement Forensics

Microsoft has announced plans to give away free versions of its COFEE Computer Online Forensic Evidence Extractor utility to help law enforcement agencies in cyber-crime investigations. COFEE uses digital forensic technologies to help investigators gather evidence of live computer activity at the...

The Reality Behind SQL Injection Attacks

TORONTO — The frequency and scope of SQL injection attacks has exploded in the last year or two, with thousands of legitimate Web sites having been compromised and used to serve malware or further Web exploits. That’s the bad news. The good news is that there are some remarkably effective...

Forensic experts fuse technology, intelligence for investigations

From The New York Times John Markoff The small cadre of experts who spend their time doing the meticulous, painstaking work of tracing cyber attacks is increasingly relying on a combination of advanced technical tools and old-fashioned intelligence-gathering techniques to track down the people an...

Design/Logic Flaw

The getfiletype function in lib/filecontent.php in DFLabs PTK 0.1, 0.2, and 1.0 allows remote attackers to execute arbitrary commands via shell metacharacters after an arg1= sequence in a filename within a forensic image...

James Butler and Peter Silberman talk malware

James Butler and Peter Silberman of MANDIANT with Threatpost’s Robert Vamosi about malware and their new memory forensic software, Memoryze...

Cross site scripting

Cross-site scripting XSS vulnerability in DFLabs PTK 1.0.0 through 1.0.4 allows remote attackers to inject arbitrary web script or HTML by providing a forensic image containing HTML documents, which are rendered in web browsers during inspection by PTK. NOTE: the vendor states that the product is...

Design/Logic Flaw

Multiple unspecified vulnerabilities in DFLabs PTK 1.0.0 through 1.0.4 allow remote attackers to execute arbitrary commands in processes launched by PTK's Apache HTTP Server via 1 "external tools" or 2 a crafted forensic image...

CVE-2009-0917

Cross-site scripting XSS vulnerability in DFLabs PTK 1.0.0 through 1.0.4 allows remote attackers to inject arbitrary web script or HTML by providing a forensic image containing HTML documents, which are rendered in web browsers during inspection by PTK. NOTE: the vendor states that the product is...

CVE-2009-0917

Cross-site scripting XSS vulnerability in DFLabs PTK 1.0.0 through 1.0.4 allows remote attackers to inject arbitrary web script or HTML by providing a forensic image containing HTML documents, which are rendered in web browsers during inspection by PTK. NOTE: the vendor states that the product is...

CVE-2009-0918

Multiple unspecified vulnerabilities in DFLabs PTK 1.0.0 through 1.0.4 allow remote attackers to execute arbitrary commands in processes launched by PTK's Apache HTTP Server via 1 "external tools" or 2 a crafted forensic image...

DFLabs PTK <= 1.0 Local Command Execution Vulnerability

Exploit for unknown platform in category web applications ======================================================= DFLabs PTK = 1.0 Local Command Execution Vulnerability ======================================================= ==================================================== Security Research...

DFLabs PTK 1.0 - Local Command Execution

==================================================== Security Research Advisory Vulnerability name: DFLabs PTK Local Command Execution Vulnerability Advisory number: LC-2008-07 Advisory URL: http://www.ikkisoft.com ==================================================== 1 Affected Software DFLabs PT...

Guidance EnCase Enterprise uses weak authentication to identify target machines

Overview Guidance Software's EnCase Enterprise uses IP authentication to identify target machines. An attacker may be able to provide the EnCase SAFE server with a disk image from a different machine than an investigator requested. Description Guidance Software's EnCase Enterprise allows...

Guidance EnCase fails to detect more than 25 partitions

Overview Guidance Software's EnCase Forensic can only detect the first 25 partitions on a volume. Description Guidance Software's EnCase Forensic is a tool that allows an investigator to acquire and analyze a disk image. EnCase names partitions either c: through z:, with an additional partition...