Malware Analysis Windows VM: Malboxes

Malware Analysis Windows VM Vagrant box builder and config generator for malware analysis. The malware battle online is far from being over. Several thousands of new malware binaries are collected by antivirus companies every day. Most organizations don’t have the expertise on staff to know if th...

PT-2016-3195

Name of the Vulnerable Software and Affected Versions IBM J9 VM affected versions not specified Oracle Java SE affected versions not specified Description The issue is related to a flaw in the class verifier of the IBM J9 VM, which is associated with inadequate access control. This flaw can be...

Citrix XenServer Multiple Security Updates (CTX218775)

A number of security vulnerabilities have been identified in Citrix XenServer that may allow malicious code running within a guest VM to compromise the host. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

shopify-scripts: Null target_class DoS

The Objectinstanceexec method in mrbgems/mruby-object-ext/src/object.c executes a block in the context of an object. It sets the VM's targetclass pointer to the singleton class of this object. targetclass is used as the definition target for constants and methods. If a singleton class cannot be...

shopify-scripts: Undefined method_missing null pointer dereference

It's possible to segfault mruby by undefining BasicObjectmethodmissing in certain cases. There is a fallback methodmissing C function mrbmethodmissing which is called in some cases when the VM fails to look up the methodmissing method: BasicObject.removemethod:methodmissing; 1.foo NoMethodError:...

Teradata Virtual Machine Community Edition 15.10 Insecure File Permission Vulnerability

Teradata Virtual Machine Community Edition version 15.10 suffers from an insecure file permission vulnerability. Title: Teradata Virtual Machine Community Edition v15.10 has insecure file permission Author: Larry W. Cashdollar, @larry0 Date: 2016-10-01 Download Site:...

Code injection

Teradata Virtual Machine Community Edition v15.10's perl script /opt/teradata/gsctools/bin/t2a.pl creates files in /tmp in an insecure manner, this may lead to elevated code execution...

Command injection

Teradata Virtual Machine Community Edition v15.10 has insecure file permissions on /etc/luminex/pkgmgr. These could allow a local user to modify its contents and execute commands as root...

CVE-2016-7488

Teradata Virtual Machine Community Edition v15.10 has insecure file permissions on /etc/luminex/pkgmgr, enabling a local user to modify its contents and execute commands as root. The issue originates from insecure permissions in the /etc/luminex directory (pkgmgr file). Public references indicate...

Boot Signal fails while reboot and shutdown signal works properly

The machines created from Streaming VM setup wizard are unable to boot when boot signal is sent from the PVS console. If we send the reboot or shutdown signal it reboots or shuts down the machines...

MacOS 10.12 - 'task_t' Privilege Escalation Exploit

Exploit for macOS platform in category local exploits Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=837 TL;DR you cannot hold or use a task struct pointer and expect the euid of that task to stay the same. Many many places in the kernel do this and there are a great many very...

CVE-2016-5611

Unspecified vulnerability in the Oracle VM VirtualBox component before 5.0.28 and 5.1.x before 5.1.8 in Oracle Virtualization allows local users to affect confidentiality via vectors related to Core...

CVE-2016-5610

Unspecified vulnerability in the Oracle VM VirtualBox component before 5.0.28 and 5.1.x before 5.1.8 in Oracle Virtualization allows local users to affect confidentiality, integrity, and availability via vectors related to Core...

CVE-2016-5608

Unspecified vulnerability in the Oracle VM VirtualBox component before 5.0.28 and 5.1.x before 5.1.8 in Oracle Virtualization allows local users to affect availability via vectors related to Core, a different vulnerability than CVE-2016-5613...

CVE-2016-5605

Unspecified vulnerability in the Oracle VM VirtualBox component before 5.1.4 in Oracle Virtualization allows remote attackers to affect confidentiality and integrity via vectors related to VRDE...

Design/Logic Flaw

Unspecified vulnerability in the Oracle VM VirtualBox component before 5.0.28 and 5.1.x before 5.1.8 in Oracle Virtualization allows local users to affect confidentiality, integrity, and availability via vectors related to Core...

Design/Logic Flaw

Unspecified vulnerability in the Oracle VM VirtualBox component before 5.0.28 and 5.1.x before 5.1.8 in Oracle Virtualization allows local users to affect availability via vectors related to Core, a different vulnerability than CVE-2016-5608...

Design/Logic Flaw

Unspecified vulnerability in the Oracle VM VirtualBox component before 5.0.28 and 5.1.x before 5.1.8 in Oracle Virtualization allows local users to affect availability via vectors related to Core, a different vulnerability than CVE-2016-5613...

CVE-2016-5605

Unspecified vulnerability in the Oracle VM VirtualBox component before 5.1.4 in Oracle Virtualization allows remote attackers to affect confidentiality and integrity via vectors related to VRDE...

CVE-2016-5608

Unspecified vulnerability in the Oracle VM VirtualBox component before 5.0.28 and 5.1.x before 5.1.8 in Oracle Virtualization allows local users to affect availability via vectors related to Core, a different vulnerability than CVE-2016-5613...