Apple Mac OSX Kernel - IOAccelDisplayPipeUserClient2 Use-After-Free

/ Source: https://code.google.com/p/google-security-research/issues/detail?id=565 Kernel UaF with IOAccelDisplayPipeUserClient2 with spoofed no more senders notifications repro: while true; do ./iospoofig4; done Likely to crash in various ways; have observed NULL derefs and NX traps. Tested on...

Apple Mac OSX Kernel - IOAccelDisplayPipeUserClient2 Use-After-Free

Apple Mac OSX Kernel - IOAccelDisplayPipeUserClient2 Use-After-Free / Source: https://code.google.com/p/google-security-research/issues/detail?id=565 Kernel UaF with IOAccelDisplayPipeUserClient2 with spoofed no more senders notifications repro: while true; do ./iospoofig4; done Likely to crash i...

Apple Mac OSX - Kernel no-more-senders Use-After-Free

Exploit for macOS platform in category dos / poc / Source: https://code.google.com/p/google-security-research/issues/detail?id=567 Kernel UaF due to audit session port failing to correctly account for spoofed no-more-senders notifications Tested on ElCapitan 10.11 15a284 on MacBookAir 5,2 / //...

Apple Mac OSX - Kernel IOAccelMemoryInfoUserClient Use-After-Free

Exploit for macOS platform in category dos / poc / Source: https://code.google.com/p/google-security-research/issues/detail?id=566 Kernel UaF with IOAccelMemoryInfoUserClient with spoofed no more senders notifications repro: while true; do ./iospoofig7; done Tested on ElCapitan 10.11 15a284 on...

Apple Mac OSX - IOBluetoothHCIPacketLogUserClient Memory Corruption

Exploit for macOS platform in category dos / poc / Source: https://code.google.com/p/google-security-research/issues/detail?id=572 The OS data types OSArray etc are explicity not thread safe; they rely on their callers to implement the required locking to serialize all accesses and manipulations ...

DHCP IP exhaustion attack: DHCPwn

DHCPwn is a tool used for testing DHCP IP exhaustion attacks. It can also be used to sniff local DHCP traffic. The DHCP protocol is connectionless and implemented via UDP. These two characteristics allow this attack to be performed. Since there is no actual connection being made between the clien...

eWON Unauthorized Access Vulnerability

eWON is an industrial router product from eWON Belgium. A security vulnerability exists in eWON using firmware versions prior to 10.1s0. The vulnerability can be exploited by an attacker with the help of a spoofed URL to obtain information and the status of the I/O server...

Authentication flaw

CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 do not require authentication from Alarm Receiving Center ARC servers, which allows man-in-the-middle attackers to bypass intended access restrictions via a spoofed HSxx response...

CVE-2015-7285

CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 do not require authentication from Alarm Receiving Center ARC servers, which allows man-in-the-middle attackers to bypass intended access restrictions via a spoofed HSxx response...

US-CERT Alerts Users to Holiday Phishing Scams and Malware Campaigns

US-CERT reminds users to remain vigilant when browsing or shopping online this holiday season. Ecards from unknown senders may contain malicious links. Fake advertisements or shipping notifications may deliver infected attachments. Spoofed email messages and fraudulent posts on social networking...

Oracle Linux 7 : ntp (ELSA-2015-2231)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-2231 advisory. - check origin timestamp before accepting KoD RATE packet CVE-2015-7704 - allow only one step larger than panic threshold with -g CVE-2015-5300 -...

ntp security, bug fix, and enhancement update

4.2.6p5-22 - check origin timestamp before accepting KoD RATE packet CVE-2015-7704 - allow only one step larger than panic threshold with -g CVE-2015-5300 4.2.6p5-20 - validate lengths of values in extension fields CVE-2014-9297 - drop packets with spoofed source address ::1 CVE-2014-9298 - rejec...

Cisco FireSIGHT Management Center Arbitrary Code Execution Vulnerability

Cisco FireSIGHT Management Center enables centralized management of network security and operational functions for Cisco ASA with FirePOWER Services and Cisco FirePOWER devices. An arbitrary code execution vulnerability exists in Cisco FireSIGHT Management Center versions 5.2 through 5.4.0.1. Thi...

Bug in Gmail app for Android Allows anyone to Send Spoofed Emails

A security researcher has discovered an interesting loophole in Gmail Android app that lets anyone send an email that looks like it was sent by someone else, potentially opening doors for Phishers. This is something that we call E-mail Spoofing – the forgery of an e-mail header so that the email...

ANA App SSL Certificate Validation Security Bypass Vulnerability

ANA App is a suite of ANA airline inquiry applications. ANA App fails to properly validate SSL certificates, allowing remote attackers to exploit this vulnerability to conduct man-in-the-middle attacks and spoof trusted servers...

CVE-2003-0857

The 1 ipqread and 2 ipulogread functions in iptables allow local users to cause a denial of service by sending spoofed messages as other users to the kernel netlink interface...

CVE-2006-1624

The default configuration of syslogd in the Linux sysklogd package does not enable the -x disable name lookups option, which allows remote attackers to cause a denial of service traffic amplification via messages with spoofed source IP addresses...

CVE-2002-2103

Apache before 1.3.24, when writing to the log file, records a spoofed hostname from the reverse lookup of an IP address, even when a double-reverse lookup fails, which allows remote attackers to hide the original source of activities...

phpmyadmin: content spoofing

This vulnerability allows an attacker to perform a content spoofing attack using the phpMyAdmin's redirection mechanism to external sites. This vulnerability is not considered to be critical since the spoofed content is escaped and no HTML injection is possible...

NTP Denial of Service Vulnerability (CNVD-2015-07015)

NTP Network Time Protocol is a network protocol that synchronizes the clocks of two computers by exchanging packets. A security vulnerability exists in NTP versions prior to 4.2.8p4 and 4.3.x prior to 4.3.77. due to the client failing to properly validate the timestamp field in a Kiss-of-Death...