Design/Logic Flaw

Parallels allows local users to cause a denial of service virtual machine abort via 1 certain INT instructions, as demonstrated by INT 0xAA; 2 an IRET instruction when an invalid address is at the top of the stack; 3 a malformed MOVNTI instruction, as demonstrated by using a register as a...

OS X Command Shell, Reverse TCP Inline

Connect back to attacker and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 65 include Msf::Payload::Single include Msf::Payload::Osx include...

Important: XFree86 security update

4.3.0-120.EL.0.1 - Add oracle detection to Imake. 4.3.0-120.EL - add cve-2007-1351.patch 234056 4.3.0-119.EL - Add int-overflow.patch 231684 - comment out requirement on fonts-base as that is an unreleased change. 4.3.0-118.EL - Add cve-2007-1003.patch 232996 4.3.0-117.EL - Make xfs depend on...

Important: xorg-x11 security update

6.8.2-1.EL.13.37.0.1 - Add Enterprise Linux detection 6.8.2-1.EL.13.37.7 - Add cve-2007-1351.patch 234056 6.8.2-1.EL.13.37.6 - Add cve-2007-1003.patch 233000 - Add int-overflow.patch 231693 6.8.2-1.EL.13.37.5 - Add xorg-x11-6.8.2-sorted-xkbcomp-dirs.patch to fix rpmdiff multilib failure...

Fedora Core 5 : libwmf-0.2.8.4-5.1 (2006-805)

CVE-2006-3376 int overflow Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenab...

linux/x86 - execve/bin/sh 22 bytes

linux/x86 execve/bin/sh 22 bytes. Shellcode exploit for linx86 platform / revenge-execve.c, v1.0 2006/10/14 16:32 Yet another linux execve shellcode.. linux/x86 execve"/bin//sh/","/bin//sh",NULL shellcode http://www.0xcafebabe.it But this time it's 22 bytes We could start the shellcode with a mov...

linux/x86 execve(/bin/sh) + RIFF Header 28 bytes

No description provided by source. / linux/x86 - execve"/bin/sh", "/bin/sh", NULL + RIFF Header - 28 bytes root@magicbox: file linux-sh-riffhdr.bin linux-sh-riffhdr.bin: RIFF little-endian data - izik [email protected] / char shellcode = // // RIFF Header 5 bytes // "\x52" // push %edx "\x49" // dec...

CVE-2006-0635

Tiny C Compiler TCC 0.9.23 aka TinyCC evaluates the "isizeofint" expression to false when i equals -1, which might introduce integer overflow vulnerabilities into applications that could be exploited by context-dependent attackers...

linux/x86 anti-debug trick (INT 3h trap) + execve /bin/sh 39 bytes

Exploit for linux/x86 platform in category shellcode ================================================================== linux/x86 anti-debug trick INT 3h trap + execve /bin/sh 39 bytes ================================================================== / linux/x86 anti-debug trick INT 3h trap +...

linux/x86 anti-debug trick INT 3h trap + execve /bin/sh 39 bytes

linux/x86 anti-debug trick INT 3h trap + execve /bin/sh 39 bytes. Shellcode exploit for linx86 platform / linux/x86 anti-debug trick INT 3h trap + execve"/bin/sh", "/bin/sh", NULL, NULL - 39 bytes The idea behind a shellcode w/ an anti-debugging trick embedded in it, is if for any reason the IDS...

linux/x86 setreuid0, 0 + execve/bin/sh 31 bytes

linux/x86 setreuid0, 0 + execve/bin/sh 31 bytes. Shellcode exploit for linx86 platform / linux/x86 setreuid0, 0 + execve"/bin/sh", "/bin/sh", NULL, NULL - 31 bytes - izik / char shellcode = "\x6a\x46" // push $0x46 "\x58" // pop %eax "\x31\xdb" // xor %ebx,%ebx "\x31\xc9" // xor %ecx,%ecx...

linux/x86 /bin/sh sysenter Opcode Array Payload 45 bytes

Exploit for linux/x86 platform in category shellcode ======================================================== linux/x86 /bin/sh sysenter Opcode Array Payload 45 bytes ======================================================== / lnxbinsh2.c - v1 - 45 Byte /bin/sh sysenter Opcode Array Payload...

Debian DSA-278-1 : sendmail - char-to-int conversion

Michal Zalewski discovered a buffer overflow, triggered by a char to int conversion, in the address parsing code in sendmail, a widely used powerful, efficient, and scalable mail transport agent. This problem is potentially remotely exploitable. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Debian DSA-290-1 : sendmail-wide - char-to-int conversion

Michal Zalewski discovered a buffer overflow, triggered by a char to int conversion, in the address parsing code in sendmail, a widely used powerful, efficient, and scalable mail transport agent. This problem is potentially remotely exploitable. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

[SECURITY] [DSA 290-1] New sendmail-wide packages fix DoS and arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 290-1 [email protected] http://www.debian.org/security/ Martin Schulze April 17th, 2003 http://www.debian.org/security/faq -...

DSA-290 sendmail-wide - char-to-int conversion

Bulletin has no description...

[SECURITY] [DSA 278-2] New sendmail packages fix DoS and arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 278-2 [email protected] http://www.debian.org/security/ Martin Schulze April 4th, 2003 http://www.debian.org/security/faq -...

Sendmail: -1 gone wild

CVE: CAN-2003-0161 CERT: VU897604 FORCED RELEASE -- VENDOR NOTIFIED AS OF 03/18/03 There is a vulnerability in Sendmail versions 8.12.8 and prior. The address parser performs insufficient bounds checking in certain conditions due to a char to int conversion, making it possible for an attacker to...

Sendmail address parsing buffer overflow

Overview Sendmail contains a buffer overflow in code that parses email addresses. A remote attacker could execute arbitrary code or cause a denial of service on a vulnerable system. Description Sendmail is a widely used mail transfer agent MTA. There is a stack overflow vulnerability in code that...