kernel security and bug fix update

2.6.9-78.0.8.0.1.EL - fix entropy flag in bnx2 driver to generate entropy pool John Sobecki orabug 5931647 - fix skb alignment that was causing sendto to fail with EFAULT Olaf Kirch orabug 6845794 - fix enomem due to larger mtu size page alloc Zach Brown orabug 5486128 - fix percpu api bugon with...

kernel: dio: zero struct dio with kzalloc instead of manually

fs/direct-io.c in the dio subsystem in the Linux kernel before 2.6.23 does not properly zero out the dio struct, which allows local users to cause a denial of service OOPS, as demonstrated by a certain fio test...

FreeBSD Security Advisory (FreeBSD-SA-03:17.procfs.asc)

The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-03:17.procfs.asc ADV FreeBSD-SA-03:17.procfs.asc OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Sof...

NetFTPd 4.2.2 User Authentication Remote Buffer Overflow Exploit

No description provided by source. Net-ftpd 4.2.2 user autentication b0f exploit 0day coded by Sergio 'shadown' Alvarez import struct import socket import sys import time class warftpd: def initself, host, port: self.host = host self.port = port self.bsize = 512 self.ebpaddr = 0xcacacaca...

Xitami Web Server 2.5c2 - LRWP Processing Format String (PoC)

/ PoC exploit for Xitami Web Server v2.5c2 LRWP processing format string bug Advisory is available at: http://www.bratax.be/advisories/b013.html multiple vulnerabilities! check it out! @author: bratax @url: http://www.bratax.be/ @email: [email protected] Thanks to BuzzDee for learning me how to us...

CVE-2007-6151

The isdnioctl function in isdncommon.c in Linux kernel 2.6.23 allows local users to cause a denial of service via a crafted ioctl struct in which iocts is not null terminated, which triggers a buffer overflow...

jetAudio 7.x (m3u File) Local SEH Overwrite Exploit

No description provided by source. !/usr/bin/python jetAudio 7.x m3u File 0day Local SEH Overwrite Exploit Bug discovered by Krystian Kloskowski h07 [email protected] Tested on: jetAudio 7.0.3 Basic / 2k SP4 Polish Shellcode: Windows Execute Command calc metasploit.com Just for fun ; from struct...

jetAudio 7.x - .m3u Local Overwrite (SEH)

jetAudio 7.x - .m3u Local Overwrite SEH !/usr/bin/python jetAudio 7.x m3u File 0day Local SEH Overwrite Exploit Bug discovered by Krystian Kloskowski h07 Tested on: jetAudio 7.0.3 Basic / 2k SP4 Polish Shellcode: Windows Execute Command calc Just for fun ; from struct import pack m3u =...

jetAudio 7.x (m3u File) Local SEH Overwrite Exploit

Exploit for unknown platform in category local exploits =================================================== jetAudio 7.x m3u File Local SEH Overwrite Exploit =================================================== !/usr/bin/python jetAudio 7.x m3u File 0day Local SEH Overwrite Exploit Bug discovered ...

Norman Virus Control - 'nvcoaft51.sys' ioctl BF672028

/ Norman Virus Control nvcoaft51.sys ioctl BF672028 exploit Abstract nvcoaft51.sys driver receive as parameter in some ioctl's a pointer to a KEVENT struct, calling KeSetEvent without any prior check. The device created by the driver NvcOa can be opened by any user. As result, a user can send a...

Norman Virus Control nvcoaft51.sys ioctl BF672028 Exploit

Exploit for unknown platform in category local exploits ========================================================= Norman Virus Control nvcoaft51.sys ioctl BF672028 Exploit ========================================================= / Norman Virus Control nvcoaft51.sys ioctl BF672028 exploit Abstrac...

corehttp 0.5.3alpha (httpd) Remote Buffer Overflow Exploit

No description provided by source. / corehttpv0.5.3alpha: httpd remote buffer overflow exploit. by: vade79/v9 [email protected] fakehalo/realhalo ...

ViRC 2.0 (JOIN Response) Remote SEH Overwrite Exploit 0day

No description provided by source. !/usr/bin/python ViRC 2.0 'JOIN Response' 0day Remote SEH Overwrite PoC Exploit Bug discovered by Krystian Kloskowski h07 [email protected] Tested on Visual IRC 2.0 / 2k SP4 Polish Shellcode type: Windows Execute Command calc.exe How stuff works ? .. ViRC -----...

webdesproxy 0.0.1 - exec-shield GET Remote Code Execution

webdesproxy 0.0.1 - exec-shield GET Remote Code Execution / Fedora Core 6 exec-shield based Webdesproxy webdesproxy-0.0.1.tgz remote root exploit reverse connect-back method by Xpl017Elz Advanced exploitation in exec-shield Fedora Core case study URL:...

ZOO - .ZOO Decompression Infinite Loop Denial of Service (PoC)

ZOO - .ZOO Decompression Infinite Loop Denial of Service PoC / Exploit for the vulnerability: Multiple vendors ZOO file decompression infinite loop DoS coded by Jean-Sébastien Guay-Leroux September 2006 / include include include // Structure of a ZOO header define ZOOHEADERSIZE 0x0000002a define...

Cross site scripting

The ufslookup function in the Mac OS X 10.4.8 and FreeBSD 6.1 kernels allows local users to cause a denial of service kernel panic and possibly corrupt other filesystems by mounting a crafted UNIX File System UFS DMG image that contains a corrupted directory entry struct direct, related to the...

CVE-2007-0267

The CVE-2007-0267 issue affects Mac OS X 10.4.8 and FreeBSD 6.1 kernels, where the ufs_lookup function can be triggered to cause a denial of service (kernel panic) and potentially corrupt other filesystems by mounting a crafted UFS DMG image containing a corrupted directory entry (struct direct) ...

CVE-2005-4784

Multiple buffer overflows in the POSIX readdirr function, as used in multiple packages, allow local users to cause a denial of service and possibly execute arbitrary code via 1 a symlink attack that exploits a race condition between opendir and pathcon calls and changes the filesystem to one with...

CVE-2005-4784

Multiple buffer overflows in the POSIX readdirr function, as used in multiple packages, allow local users to cause a denial of service and possibly execute arbitrary code via 1 a symlink attack that exploits a race condition between opendir and pathcon calls and changes the filesystem to one with...

security flaw

The dofork function in Linux 2.4.x before 2.4.26, and 2.6.x before 2.6.6, does not properly decrement the mmcount counter when an error occurs after the mmstruct for a child process has been activated, which triggers a memory leak that allows local users to cause a denial of service memory...