Microsoft Windows Vista/2008 - NtUserCheckAccessForIntegrityLevel Use-After-Free

Windows Vista/Server 2008 NtUserCheckAccessForIntegrityLevel Use-after-free Vulnerability Intro: Due to hostility toward security researchers, the most recent example being of Tavis Ormandy, a number of us from the industry and some not from the industry have come together to form MSRC: the...

Does Google Have a Double Standard on Full Disclosure?

Early this morning Google’s Tavis Ormandy published a vulnerability in the hcp protocol handler. It allows the attacker to run arbitrary commands as the user. In practice it created a lot of alerts and warnings for me – but the XP install I was using is somewhat locked down. So I’m not sure how...

Sun Java Web Start Plugin Command Line Argument Injection

$Id: javawsarginjectaltjvm.rb 9097 2010-04-16 08:08:40Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Sun About Face: Out-of-Cycle Java Update Patches Critical Flaw

In a sudden about-face, Sun has rushed out a Java update to fix a drive-by download vulnerability that exposed Windows users to in-the-wild malware attacks. The patch comes less than a week after Sun told a Google researcher it did not consider the issue serious enough to warrant an out-of-cycle...

Sun Java Web Start Plugin Command Line Argument Injection

This module exploits a flaw in the Web Start plugin component of Sun Java Web Start. The arguments passed to Java Web Start are not properly validated. By passing the lesser known -J option, an attacker can pass arbitrary options directly to the Java runtime. By utilizing the -XXaltjvm option, as...

JAVA Web Start Arbitrary command-line injection

Exploit for multiple platform in category remote exploits =============================================== JAVA Web Start Arbitrary command-line injection =============================================== Bye bye my little 0day :, Tavis Ormandy did a great job uncovering a big logic flaw within Java...

Ubuntu 9.10 : erlang vulnerability (USN-624-2)

USN-624-1 fixed a vulnerability in PCRE. This update provides the corresponding update for Erlang. Tavis Ormandy discovered that the PCRE library did not correctly handle certain in-pattern options. An attacker could cause applications linked against pcre3 to crash, leading to a denial of service...

Microsoft Windows XPVista20002003 - Double-Free Memory Corruption Privilege Escalation

Microsoft Windows XPVista20002003 - Double-Free Memory Corruption Privilege Escalation // source: https://www.securityfocus.com/bid/38044/info // Microsoft Windows is prone to a local privilege-escalation vulnerability that occurs in the kernel. // An attacker can exploit this issue to execute...

Microsoft Windows XP/Vista/2000/2003 - Double-Free Memory Corruption Privilege Escalation

// source: https://www.securityfocus.com/bid/38044/info // Microsoft Windows is prone to a local privilege-escalation vulnerability that occurs in the kernel. // An attacker can exploit this issue to execute arbitrary code with kernel-level privileges. Successful exploits will result in the...

CentOS 5 : pcre (CESA-2007:0967)

Updated pcre packages that correct two security flaws are now available for Red Hat Enterprise Linux 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. PCRE is a Perl-compatible regular expression library. Multiple flaws were found in the way...

CentOS 5 : kernel (CESA-2009:1222)

Updated kernel packages that fix two security issues and a bug are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux operating...

VMWare Virtual 8086 Linux Local Ring0 Exploit

Exploit for unknown platform in category local exploits ============================================= VMWare Virtual 8086 Linux Local Ring0 Exploit ============================================= Title: VMWare Virtual 8086 Linux Local Ring0 Exploit CVE-ID: OSVDB-ID: Author: Tavis Ormandy and Julien...

SuSE 11 Security Update : freetype2 (SAT Patch Number 792)

Freetype was updated to fix some integer overflows that can be exploited remotely in conjunction with programs like a web-browser. CVE-2009-0946 Thanks to Tavis Ormandy who found the bugs. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

Linux Kernel 2.42.6 - sock_sendpage() Local Privilege Escalation (3)

Linux Kernel 2.42.6 - socksendpage Local Privilege Escalation 3 This third version features: Complete support for i386, x8664, ppc and ppc64; The personality trick published by Tavis Ormandy and Julien Tinnes; The TOC pointer workaround for data items addressing on ppc64 i.e. functions on exploit...

Linux Kernel < 2.6.19 udp_sendmsg Local Root Exploit

No description provided by source. / hoagieudpsendmsg.c LOCAL LINUX KERNEL ROOT EXPLOIT 2.6.19 - CVE-2009-2698 udpsendmsg bug exploit via output callback function used in dstentry / rtable Bug reported by Tavis Ormandy and Julien Tinnes of the Google Security Team Tested with Debian Etch r0 $ cat...

Debian Security Advisory DSA 1864-1 (linux-2.6.24)

The remote host is missing an update to linux-2.6.24 announced via advisory DSA 1864-1. OpenVAS Vulnerability Test $Id: deb18641.nasl 6615 2017-07-07 12:09:52Z cfischer $ Description: Auto-generated from advisory DSA 1864-1 linux-2.6.24 Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft In...

Linux Kernel 2.6.19 (Debian 4) - udp_sendmsg Local Privilege Escalation (3)

Linux Kernel 2.6.19 Debian 4 - udpsendmsg Local Privilege Escalation 3 / hoagieudpsendmsg.c LOCAL LINUX KERNEL ROOT EXPLOIT include include include include include include include include / this code will be called from NFHOOK via output callback in kernel mode / void setcurrenttaskuidsgidstozero...

RedHat Security Advisory RHSA-2009:1233

The remote host is missing updates announced in advisory RHSA-2009:1233. The kernel packages contain the Linux kernel, the core of any Linux operating system. These updated packages fix the following security issues: a flaw was found in the SOCKOPSWRAP macro in the Linux kernel. This macro did no...

RedHat Security Advisory RHSA-2009:1223

The remote host is missing updates announced in advisory RHSA-2009:1223. The kernel packages contain the Linux kernel, the core of any Linux operating system. These updated packages fix the following security issues: a flaw was found in the SOCKOPSWRAP macro in the Linux kernel. This macro did no...

Linux Kernel < 2.6.19 (Debian 4) - 'udp_sendmsg' Local Privilege Escalation (3)

/ hoagieudpsendmsg.c LOCAL LINUX KERNEL ROOT EXPLOIT include include include include include include include include / this code will be called from NFHOOK via output callback in kernel mode / void setcurrenttaskuidsgidstozero asm"push %eax\n" "movl $0xffffe000, %eax\n" "andl %esp, %eax\n" "movl...