Advisory: Arbitrary kernel mode memory writes in AVG

======= Summary ======= Name: Arbitrary kernel mode memory writes in AVG Antivirus Release Date: 10 July 2007 Reference: NGS00500 Discover: Jonathan Lindsay john-lindsay ngssoftware com Vendor: Grisoft Vendor Reference: N/A Systems Affected: Windows NT based systems Risk: High Status: Fixed...

WinPcap 4.0 - NPF.SYS Local Privilege Escalation

WinPcap 4.0 - NPF.SYS Local Privilege Escalation / WinPcap NPF.SYS Privilege Elevation Vulnerability PoC exploit ------------------------------------------------------------- Affected software: WinPcap versions affected Confirmed - WinPcap 4.0 and previous WinPcap fixed version stable : WinPcap...

WinPcap NPF.SYS Privilege Elevation Vulnerability

WinPcap NPF.SYS Privilege Elevation Vulnerability PoC exploit ------------------------------------------------------------- Affected software: WinPcap versions affected Confirmed - WinPcap 3.1 - WinPcap 4.1 Operating systems affected Confirmed - Windows 2000 SP4 Both server and workstation -...

WinPcap 4.0 - 'NPF.SYS' Local Privilege Escalation

/ WinPcap NPF.SYS Privilege Elevation Vulnerability PoC exploit ------------------------------------------------------------- Affected software: WinPcap versions affected Confirmed - WinPcap 4.0 and previous WinPcap fixed version stable : WinPcap 4.0.1 Note : There was an error in the previous...

WinPcap 4.0 NPF.SYS Privilege Elevation Vulnerability PoC Exploit

Exploit for unknown platform in category local exploits ================================================================= WinPcap 4.0 NPF.SYS Privilege Elevation Vulnerability PoC Exploit ================================================================= / WinPcap NPF.SYS Privilege Elevation...

[Full-disclosure] SafeNET High Assurance Remote/SoftRemote (IPSecDrv.sys) remote DoS

Attached is POC for a remote DoS in IPSecDrv.sys shipped with SafeNET High Assurance Remote and SoftRemote. The version tested is 10.4.0.12. The bug itself is due to SafeNET making a complete hash of IPv6 support for IPSec. The result of the code is a complete DoS of the machine in Kernel mode...

CVE-2007-1724

Unspecified vulnerability in ReactOS 0.3.1 has unknown impact and attack vectors, related to a fix for "dozens of win32k bugs and failures," in which the fix itself introduces a vulnerability, possibly related to user-mode and kernel-mode copy failures...

Madwifi 0.9.2.1 - SIOCGIWSCAN Buffer Overflow (Metasploit)

Madwifi 0.9.2.1 - SIOCGIWSCAN Buffer Overflow Metasploit Madwifi remote kernel exploit 100% reliable, does'nt crash wifi stack, can exploit same target multiple times Julien TINNES Laurent BUTTI vuln in giwscancb, here's the path: ieee80211ioctlgiwscan - ieee80211scaniterate - staiterate -...

Broadcom Wireless Driver Probe Response SSID Overflow Exploit (meta)

No description provided by source. require 'msf/core' module Msf class Exploits::Windows::Driver::BroadcomWiFiSSID Msf::Exploit::Remote include Exploit::Lorcon include Exploit::KernelMode def initializeinfo = superupdateinfoinfo, 'Name' = 'Broadcom Wireless Driver Probe Response SSID Overflow',...

D-Link DWL-G132 Wireless Driver Beacon Rates Overflow Exploit (meta)

No description provided by source. require 'msf/core' module Msf class Exploits::Windows::Driver::DLinkDWLG132WiFiRates Msf::Exploit::Remote include Exploit::Lorcon include Exploit::KernelMode def initializeinfo = superupdateinfoinfo, 'Name' = 'D-Link DWL-G132 Wireless Driver Beacon Rates...

dlink_wifi_rates.rb.txt

require 'msf/core' module Msf class Exploits::Windows::Driver::DLinkDWLG132WiFiRates 'D-Link DWL-G132 Wireless Driver Beacon Rates Overflow', 'Description' = %q This module exploits a stack overflow in the A5AGU.SYS driver provided with the D-Link DWL-G132 USB wireless adapter. This stack overflo...

broadcom_wifi_ssid.rb.txt

require 'msf/core' module Msf class Exploits::Windows::Driver::BroadcomWiFiSSID 'Broadcom Wireless Driver Probe Response SSID Overflow', 'Description' = %q This module exploits a stack overflow in the Broadcom Wireless driver that allows remote code execution in kernel mode by sending a 802.11...

D-Link DWL-G132 Wireless Driver Beacon Rates Overflow Expl (meta)

Exploit for unknown platform in category remote exploits ==================================================================== D-Link DWL-G132 Wireless Driver Beacon Rates Overflow Exploit meta ==================================================================== require 'msf/core' module Msf class...

Broadcom Wireless Driver - Probe Response SSID Overflow (Metasploit)

Broadcom Wireless Driver - Probe Response SSID Overflow Metasploit $Id: broadcomwifissid.rb 9669 2010-07-03 03:13:45Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more...

D-Link DWL-G132 - Wireless Driver Beacon Rates Overflow (Metasploit)

D-Link DWL-G132 - Wireless Driver Beacon Rates Overflow Metasploit $Id: dlinkwifirates.rb 9670 2010-07-03 03:19:07Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more...

Broadcom Wireless Driver Probe Response SSID Overflow Expl (meta)

Exploit for unknown platform in category remote exploits ==================================================================== Broadcom Wireless Driver Probe Response SSID Overflow Exploit meta ==================================================================== require 'msf/core' module Msf class...

D-Link DWL-G132 - Wireless Driver Beacon Rates Overflow (Metasploit)

$Id: dlinkwifirates.rb 9670 2010-07-03 03:19:07Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework...

Broadcom Wireless Driver - Probe Response SSID Overflow (Metasploit)

$Id: broadcomwifissid.rb 9669 2010-07-03 03:13:45Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Kerio Multiple insufficient argument validation of hooked SSDT function Vulnerability

Hello, I would like to inform you about a vulnerability in Sunbelt Kerio Personal Firewall. Description: Sunbelt Kerio Personal Firewall hooks many functions in SSDT and in at least six cases it fails to validate arguments that come from user mode. User calls to NtCreateFile, NtDeleteFile,...

Kerio Multiple insufficient argument validation of hooked SSDT function Vulnerability

Hello, I would like to inform you about a vulnerability in Sunbelt Kerio Personal Firewall. Description: Sunbelt Kerio Personal Firewall hooks many functions in SSDT and in at least six cases it fails to validate arguments that come from user mode. User calls to NtCreateFile, NtDeleteFile,...