kernel security and bug fix update

2.6.9-89.0.28.0.1.EL - XEN fix cpu hotplug crash Joe Jin orabug 7521308 - XEN Bring up vcpus before khelper init Joe Jin orabug 7521308 - XEN flush the tlb cache immediately Dave McCracken, Scott Shi orabug 9138767 - fix skb alignment that was causing sendto to fail with EFAULT Olaf Kirch orabug...

FreeBSD mbuf本地权限提升漏洞

BUGTRAQ ID: 41577 CVE ID: CVE-2010-2693 FreeBSD就是一种运行在Intel平台上、可以自由使用的开放源码Unix类系统。 mbuf是FreeBSD内核进程间通讯和联网子系统中的基础内存管理单元。网络报文和套接字缓冲区依赖于mbuf进行存储。 在复制mbuf缓冲区引用时没有正确地拷贝只读标志，如果使用sendfile2系统调用在回环接口上传输数据，就可能导致修改所传送数据的后端内存页，造成数据破坏。本地攻击者可以通过精心控制系统文件的破坏情况来利用这种数据破坏提升权限。请注意攻击者可以破坏任意可读访问的文件。 FreeBSD FreeBSD 8....

Memory corruption

FreeBSD 7.1 through 8.1-PRERELEASE does not copy the read-only flag when creating a duplicate mbuf buffer reference, which allows local users to cause a denial of service system file corruption and gain privileges via the sendfile system call...

CVE-2010-2693

CVE-2010-2693 affects FreeBSD 7.1–8.1-PRERELEASE where the read-only flag is not copied when duplicating an mbuf buffer reference. This can allow a local attacker to cause data corruption via sendfile(2) on the loopback path and potentially escalate privileges by corrupting system files. The issu...

Windows Vista/Server 2008 NtUserCheckAccessForIntegrityLevel Use-after-free Vulnerability

No description provided by source. Due to hostility toward security researchers, the most recent example being of Tavis Ormandy, a number of us from the industry and some not from the industry have come together to form MSRC: the Microsoft-Spurned Researcher Collective. MSRC will fully disclose...

FreeBSD 8.07.37.2 - nfs_mount() Local Privilege Escalation

FreeBSD 8.07.37.2 - nfsmount Local Privilege Escalation / nfsmountex.c -- Patroklos Argyroudis, argp at domain census-labs.com Local kernel exploit for FreeBSD 8.0, 7.3 and 7.2. FreeBSD 8.0-RELEASE: Local kernel crash/denial-of-service. FreeBSD 7.3/7.2-RELEASE: Local privilege escalation...

FreeBSD Kernel nfs_mount() Exploit

Exploit for freebsd platform in category local exploits ================================== FreeBSD Kernel nfsmount Exploit ================================== / nfsmountex.c -- Patroklos Argyroudis, argp at domain census-labs.com Local kernel exploit for FreeBSD 8.0, 7.3 and 7.2. FreeBSD...

Sophos Anti-Virus NtQueryAttributesFile()系统调用本地权限提升漏洞

BUGTRAQ ID: 40715 Sophos Anti-Virus是一款适用于多种操作系统的杀毒软件。 Sophos杀毒软件所使用的savonaccessfilter.sys过滤器驱动没有正确地处理NtQueryAttributesFile系统调用参数参数，本地用户可以通过提交特制的IOCTL请求以ring 0权限执行任意代码。 Sophos Anti-Virus 7.6.20 厂商补丁： Sophos ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

FreeBSD Security Advisory (FreeBSD-SA-10:04.jail.asc)

The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-10:04.jail.asc SPDX-FileCopyrightText: 2010 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

New local NT attack - TOCTOU (Time-Of-Check-to-Time-Of-Use race conditions)

If service hooks are used for argument filtering, race conditions are possible between argument check and actual sytem call...

Microsoft Windows内核空指针本地拒绝服务漏洞（MS10-021）

BUGTRAQ ID: 39297 CVE ID: CVE-2010-0234 Microsoft Windows是微软发布的非常流行的操作系统。 Windows内核中没有充分验证传递到Windows内核系统调用的注册表项参数。攻击者可以通过运行特制应用程序来利用该漏洞，导致系统变得没有响应并自动重新启动。 Microsoft Windows XP SP3 Microsoft Windows XP SP2 Microsoft Windows Vista SP2 Microsoft Windows Vista SP1 Microsoft Windows Vista Microsoft...

chmod"/etc/shadow", 0777 Shellcode33 Bytes

33 Bytes chmod"/etc/shadow", 0777 Shellcode. Shellcode exploit for linx86 platform [email protected] http://plasticsouptaste.blogspot.com Name: 33 bytes chmod"/etc/shadow", 0777 shellcode Platform: Linux x86 include "stdio.h" int mainint argc, char argv char shellcode...

Important: Red Hat Security Advisory: kernel security and bug fix update

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5.2 Extended Update Support. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel...

Rising AntiVirus 2008/2009/2010 Local Privilege Escalation Exploit

RsNtGdi.sys not verify the Irp-UserBuffer address. Exploit code will restore all of the kernel SSDT hook Rising AntiVirus 2008 / 2009 / 2010 none include "stdafx.h" include "windows.h" enum SystemModuleInformation = 11 ; typedef struct ULONG Unknown1; ULONG Unknown2; PVOID Base; ULONG Size; ULONG...

CentOS 5 : kernel (CESA-2009:0473)

Updated kernel packages that fix several security issues and several bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux...

SuSE9 Security Update : Linux kernel (YOU Patch Number 12541)

This update fixes various security issues and some bugs in the SUSE Linux Enterprise 9 kernel. The following security bugs were fixed : - A race condition in the pipe2 systemcall could be used by local attackers to execute code. CVE-2009-3547 - On x8664 systems a information leak of high register...

PT-2009-3691 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions prior to the fixed version Description: The issue arises from the Windows kernel's failure to properly validate an argument passed to a system call, allowing local users to gain privileges via a crafted application...

Code injection

Unspecified vulnerability in the ZFS filesystem in Sun Solaris 10, and OpenSolaris snv100 through snv117, allows local users to bypass intended limitations of the filechownself privilege via certain uses of the chown system call...

CVE-2009-3706

CVE-2009-3706 affects the ZFS filesystem in Sun Solaris 10 and OpenSolaris snv_100–snv_117. A local attacker can bypass the file_chown_self privilege via certain uses of the chown system call, effectively bypassing intended limitations. The description does not specify concrete affected component...

Linux Kernel perf_counter_open()函数本地溢出漏洞

BUGTRAQ ID: 36423 CVECAN ID: CVE-2009-3234 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的kernel/perfcounter.c文件中的perfcopyattr函数存在缓冲区溢出漏洞。本地攻击者可以通过向perfcounteropen系统调用传送特制数据触发这个溢出，导致内核崩溃。 Linux kernel 2.6.31 厂商补丁： Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...