VT-d (PCI passthrough) MSI trap injection

ISSUE DESCRIPTION Intel VT-d chipsets without interrupt remapping do not prevent a guest which owns a PCI device from using DMA to generate MSI interrupts by writing to the interrupt injection registers. This can be exploited to inject traps and gain control of the host. VULNERABLE SYSTEMS You ar...

kvm: x86: zero kvm_vcpu_events->interrupt.pad infoleak

Linux kernel 2.6.33 and 2.6.34.y does not initialize the kvmvcpuevents-interrupt.pad structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via unspecified vectors...

Motorola SB5101 Hax0rware Rajko HTTPd Remote Proof Of Concept

!/usr/bin/perl Motorola SB5101 Hax0rware Rajko HttpD Remote Exploit PoC Author: Dillon Beresford Date: 6/6/2010 Vendor: SBHacker & Motorola Software Link: http://www.sbhacker.net/forum/index.php Tested on Hax0rware 1.1 R30, R32 and R39 Description: Motorola SB5101 Hax0rware Rajko HttpD Remote...

Motorola SB5101 Hax0rware Rajko HTTPd - Remote Denial of Service (PoC)

Motorola SB5101 Hax0rware Rajko HTTPd - Remote Denial of Service PoC !/usr/bin/perl Motorola SB5101 Hax0rware Rajko HttpD Remote Exploit PoC Author: Dillon Beresford Date: 6/6/2010 Vendor: SBHacker & Motorola Software Link: http://www.sbhacker.net/forum/index.php Tested on Hax0rware 1.1 R30, R32...

CentOS 5 : kernel (CESA-2010:0398)

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed...

Design/Logic Flaw

The sysvshm extension for PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to write to arbitrary memory addresses by using an object's sleep function to interrupt an internal call to the shmputvar function, which triggers access of a freed resource...

CVE-2010-1864

The addcslashes function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information memory contents by causing a userspace interruption of an internal function, related to the call time pass by reference feature...

linux/x86 forkbombe - 6 bytes

Exploit for linux/x86 platform in category shellcode ============================= linux/x86 forkbombe - 6 bytes ============================= / Title: Linux x86 forkbombe - 6 bytes Author: Jonathan Salwan Web: http://www.shell-storm.org ! Database of shellcodes:...

CVE-2010-1460: Undefined Security Weakness

The IBM BladeCenter with Advanced Management Module AMM firmware before bpet50g does not properly perform interrupt sharing for USB and iSCSI, which allows remote attackers to cause a denial of service management module reboot via TCP packets with malformed application data...

Mandriva Update for php MDVSA-2010:045 (php)

Check for the Version of php OpenVAS Vulnerability Test Mandriva Update for php MDVSA-2010:045 php Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms ...

CVE-2009-4143

PHP before 5.2.12 does not properly handle session data, which has unspecified impact and attack vectors related to 1 interrupt corruption of the SESSION superglobal array and 2 the session.savepath directive...

CVE-2009-4143

PHP before 5.2.12 does not properly handle session data, which has unspecified impact and attack vectors related to 1 interrupt corruption of the SESSION superglobal array and 2 the session.savepath directive...

CVE-2009-4143: Undefined Security Weakness

PHP before 5.2.12 does not properly handle session data, which has unspecified impact and attack vectors related to 1 interrupt corruption of the SESSION superglobal array and 2 the session.savepath directive...

Null pointer dereference

The updatecr8intercept function in arch/x86/kvm/x86.c in the KVM subsystem in the Linux kernel before 2.6.32-rc1 does not properly handle the absence of an Advanced Programmable Interrupt Controller APIC, which allows local users to cause a denial of service NULL pointer dereference and system...

PT-2009-5912 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 2.6.32-rc1 Description: The issue is related to the KVM subsystem in the Linux kernel, where the update cr8 intercept function does not properly handle the absence of an Advanced Programmable Interrupt Controlle...

Talking about the Ring0 privilege of obtain-vulnerability warning-the black bar safety net

Recently been trying to write a program to kill 3 6 0, but encountered a lot of trouble, even if elevated, the 能干 掉 Winlogon.exe 也 干 不 掉 360tray.exe depressed for half a day. Don't know 3 6 0 what weird means. Then find the Find the previous comparison of the bovine X-virus Panda burning incense...

netbsd/x86 kill all processes shellcode 23 bytes

No description provided by source. / netbsd/x86 kill all processes shellcode this shellcode is using syscall number 37 or 0x25 37 STD int syskillint pid, int signum; here is assembler code using intel syntaxe and NASM --------------begin----------- section .note.netbsd.ident dd 0x07,0x04,0x01 db...

CentOS Update for kernel CESA-2007:1104 centos4 x86_64

Check for the Version of kernel OpenVAS Vulnerability Test CentOS Update for kernel CESA-2007:1104 centos4 x8664 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

Novell Netware 6.5 Denial Of Service

!/usr/bin/perl novellnwibsysdos.pl Novell Netware 6.5 ICEbrowser Remote System Denial of Service Exploit Jeremy Brown [email protected]/jbrownsec.blogspot.com "Mozilla/5.0 NetWare; U; NetWare 6.50.06; en-US ICEbrowser/6.1.2 NovellViewPort/3.7.2" After target views exploit page, the browser wil...

kernel security and bug fix update

2.6.18-92.1.10.0.1.el5 - NET Add entropy support to e1000 and bnx2 John Sobecki orabug 6045759 - splice Fix bad unlockpage in error case Jens Axboe orabug 6263574 - dio fix error-path crashes Linus Torvalds orabug 6242289 - NET fix netpoll race Tina Yang orabugz 5791 2.6.18-92.1.10.el5 - ia64...