Rapid7 Security Advisory 36

R7-0036: FCKEditor.NET File Upload Code Execution August 30, 2010 -- Vulnerability Details: FCKEditor contains a file renaming bug that allows remote code execution. Specifically, it is possible to upload ASP code via the ASP.NET connector in FCKEditor. The vulnerability requires that the remote...

Exploit Code, List of Apps Vulnerable to DLL Hijacking Hit the Web

The list of applications known to be vulnerable to the Windows DLL-hijacking bug is growing by the hour, with some sites listing more than 30 vulnerable applications right now. A large portion of the known vulnerable apps belong to Microsoft, including PowerPoint 2010 and Microsoft Live Email. On...

[R7-0035] VxWorks Authentication Library Weak Password Hashing

R7-0035: VxWorks Authentication Library Weak Password Hashing August 2, 2010 -- Vulnerability Details: This vulnerability allows remote attackers to bypass the authentication process for the Telnet and FTP services of the VxWorks operating system. This flaw occurs due to an insecure password...

Microsoft Windows Shell LNK Code Execution

This module exploits a vulnerability in the handling of Windows Shortcut files .LNK that contain an icon resource pointing to a malicious DLL. This creates an SMB resource to provide the payload inside a DLL, and generates a LNK file which must be sent to the target. Module Options msf use...

Q&A: HD Moore on Metasploit, Disclosure and Ethics

We conducted our third live chat this week, this one with HD Moore, the founder of the Metasploit Project and the CSO of Rapid7. Moore got a lot of great questions on a wide variety of topics, so if you weren’t able to join us, here’s a full transcript of the chat. Dennis Fisher: Hi everyone, and...

HD Moore on Metasploit, Exploitation and the Art of Pen Testing

Dennis Fisher talks with HD Moore, the founder of the Metasploit Project and the chief security officer at Rapid7, about the evolution of Metasploit, the difficulty of client-side exploitation in the age of DEP and ASLR and the decision on when to publish an exploit. Podcast audio courtesy of...

The Penetration Testing Marketplace in 2010

By Nick Selby Managing Director, Trident Risk Management Vulnerability assessment vendor Rapid7 has announced the first of a series of steps to integrate its penetration testing and vulnerability assessment scanning products. The first step is a module that allows users of the Metasploit Framewor...

PuTTy.exe <= v0.53 Buffer Overflow

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ class Metasploit3 'PuTTy.exe %q This module exploi...

Trident Risk Management's Nick Selby on Metasploit and Rapid7

The Big Story podcast with Ryan Naraine – October 22, 2009 Trident Risk Management‘s Nick Selby joins the Big Story podcast to discuss the latest news around Metasploit and Rapid7 and how this affects issues around penetration testing and exploit creation and release. Download Podcast audio...

Windows x64 VNC Server (Reflective Injection), Windows x64 Bind TCP Stager

Inject a VNC Dll via a reflective loader Windows x64 staged. Listen for a connection Windows x64 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 483 include Msf::Payload::Stager...

DB2 Discovery Service Detection

This module simply queries the DB2 discovery service for information. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'DB2 Discovery Service Detection', 'Description' = 'This module simply queri...

Oracle XML DB SID Discovery

This module simply makes an authenticated request to retrieve the sid from the Oracle XML DB httpd server. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Oracle XML DB SID Discovery',...

CVE-2009-0545 — ZeroShell Remote Code Execution

cgi-bin/kerbynet in ZeroShell 1.0beta11 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the type parameter in a NoAuthREQ x509List action. Recent assessments: hrbrmstr at September 10, 2020 2:42pm UTC reported: MSF module — Assessed Attacker Value: 5...

Apache mod_proxy_ftp XSS vulnerability

Overview The Apache web server modproxyftp module contains a cross-site scripting XSS vulnerability. Description The Apache modproxyftp module allows the Apache web server to act as a proxy for FTP sites. Filename globbing is the process of using wildcards to match filenames. The modproxyftp modu...

R7-0031: JFreeChart Image Map Cross-Site Scripting Vulnerabilities

Rapid7 Security Advisory Visit http://www.rapid7.com/ to download NeXpose, SC Magazine Winner of Best Vulnerability Management product. Rapid7 Advisory R7-0031 JFreeChart Image Map Cross-Site Scripting Vulnerabilities Published: Dec 06, 2007 Revision: 1.0...

NVIDIA binary graphics driver: Privilege escalation vulnerability

Background The NVIDIA binary graphics driver from NVIDIA Corporation provides the kernel module and the GL modules for graphic acceleration on the NVIDIA based graphic cards. Description Rapid7 reported a boundary error in the NVIDIA binary graphics driver that leads to a buffer overflow in the...

FreeBSD : NVIDIA UNIX driver -- arbitrary root code execution vulnerability (a6d9da4a-5d5e-11db-8faf-000c6ec775d9)

Rapid7 reports : The NVIDIA Binary Graphics Driver for Linux is vulnerable to a buffer overflow that allows an attacker to run arbitrary code as root. This bug can be exploited both locally or remotely via a remote X client or an X client which visits a malicious web page. A working...

Rapid7 Advisory R7-0026: HTTP Header Injection Vulnerabilities in the Flash Player Plugin

Rapid7 Advisory R7-0026 HTTP Header Injection Vulnerabilities in the Flash Player Plugin Published: Oct 17, 2006 Revision: 1.0 http://www.rapid7.com/advisories/R7-0026.jsp 1. Affected Systems: KNOWN VULNERABLE: o Flash Player plugin 9.0.16 for Windows o Flash Player plugin 7.0.63 for Linux PROBAB...

NVIDIA Display Driver for Unix systems vulnerable to buffer overflow

Overview A vulnerability in the NVIDIA Display Driver for Unix systems may allow a remote attacker to execute code on a vulnerable system. Description The NVIDIA Display Driver for Unix systems provides access to the display adapter's accelerated features on supported systems, and includes a modu...

NVIDIA UNIX driver -- arbitrary root code execution vulnerability

Rapid7 reports: The NVIDIA Binary Graphics Driver for Linux is vulnerable to a buffer overflow that allows an attacker to run arbitrary code as root. This bug can be exploited both locally or remotely via a remote X client or an X client which visits a malicious web page. A working proof-of-conce...