MS09-050 Microsoft SRV2.SYS SMB Negotiate ProcessID Function Table Dereference

This module exploits an out of bounds function table dereference in the SMB request validation code of the SRV2.SYS driver included with Windows Vista, Windows 7 release candidates not RTM, and Windows 2008 Server prior to R2. Windows Vista without SP1 does not seem affected by this flaw. Module...

VLC Media Player URI Buffer Overflow

!/usr/bin/env python VLC Media Player 1.0.0\1.0.1 smb:// URI Handling Remote Stack Overflow PoC Found By: DrIDE Tested: Windows XP SP2 , XP SP3 and Windows 7 RC1 Thanks: Pankaj Kohli for finding this in 0.8.6f Original: http://www.milw0rm.com/exploits/9303 Crash Breakdown of vlc v1.0.1 on XP...

CVE-2009-2764

Microsoft Internet Explorer 8.0.7100.0 on Windows 7 RC on the x64 platform allows remote attackers to cause a denial of service application crash via a certain DIV element in conjunction with SCRIPT elements that have empty contents and no reference to a valid external script location...

Design/Logic Flaw

Microsoft Internet Explorer 8.0.7100.0 on Windows 7 RC on the x64 platform allows remote attackers to cause a denial of service application crash via a certain DIV element in conjunction with SCRIPT elements that have empty contents and no reference to a valid external script location...

CVE-2009-2764

Microsoft Internet Explorer 8.0.7100.0 on Windows 7 RC (x64) is described as vulnerable to denial of service (application crash) through a crafted DIV element combined with SCRIPT elements that have empty contents and no reference to a valid external script location. This CVE entry explicitly cov...

CVE-2009-2764

Microsoft Internet Explorer 8.0.7100.0 on Windows 7 RC on the x64 platform allows remote attackers to cause a denial of service application crash via a certain DIV element in conjunction with SCRIPT elements that have empty contents and no reference to a valid external script location...

CVE-2009-2764: Undefined Security Weakness

Microsoft Internet Explorer 8.0.7100.0 on Windows 7 RC on the x64 platform allows remote attackers to cause a denial of service application crash via a certain DIV element in conjunction with SCRIPT elements that have empty contents and no reference to a valid external script location...

VideoLAN VLC Media Player 1.0.01.0.1 - smb: URI Handling Buffer Overflow (PoC)

VideoLAN VLC Media Player 1.0.01.0.1 - smb: URI Handling Buffer Overflow PoC !/usr/bin/env python VLC Media Player 1.0.0\1.0.1 smb:// URI Handling Remote Stack Overflow PoC Found By: DrIDE Tested: Windows XP SP2 , XP SP3 and Windows 7 RC1 Thanks: Pankaj Kohli for finding this in 0.8.6f Original:...

VideoLAN VLC Media Player 1.0.0/1.0.1 - 'smb://' URI Handling Buffer Overflow (PoC)

!/usr/bin/env python VLC Media Player 1.0.0\1.0.1 smb:// URI Handling Remote Stack Overflow PoC Found By: DrIDE Tested: Windows XP SP2 , XP SP3 and Windows 7 RC1 Thanks: Pankaj Kohli for finding this in 0.8.6f Original: http://www.milw0rm.com/exploits/9303 Crash Breakdown of vlc v1.0.1 on XP...

Windows x86 null-free bindshell for Windows 5.0-7.0 all service packs

No description provided by source. BITS 32 ; Windows x86 null-free bindshell for Windows 5.0-7.0 all service packs. ; See http://skypher.com/wiki/index.php/Hacking/Shellcode/Bind/NGS. ; Based largely on code and ideas C 2005 by Dafydd Stuttard, NGS Software. ; See...

Microsoft Visual Studio Active Template Library COM Object Remote Code Execution Vulnerability

Description Microsoft Visual Studio is prone to a remote code-execution vulnerability in the Active Template Library ATL. Remote attackers can exploit this issue to execute arbitrary code with the privileges of the user running an application built against the affected library. Failed exploit...

windows x86 null-free bindshell for Windows 5.0-7.0 all service packs

Exploit for win32 platform in category shellcode ===================================================================== Windows x86 null-free bindshell for Windows 5.0-7.0 all service packs ===================================================================== BITS 32 ; Windows x86 null-free...

Windows x86 null-free bindshell for Windows 5.0-6.0 all service packs

No description provided by source. BITS 32 ; Windows x86 null-free bindshell for Windows 5.0-6.0 all service packs. ; See http://skypher.com/wiki/index.php/Hacking/Shellcode/Bind/NGS. ; Based largely on code and ideas C 2005 by Dafydd Stuttard, NGS Software. ; See...

When should Microsoft backport security advances?

From PC Mag Larry Seltzer Microsoft has made much of the security advances in their recent products but some people ask why these are not incorporated into their earlier products. The basic answer is that it usually would come at a cost that users aren’t willing to pay in a software patch, but ma...

Winamp MAKI Buffer Overflow

This module exploits a stack based buffer overflow in Winamp 5.55. The flaw exists in the genff.dll and occurs while parsing a specially crafted MAKI file, where memmove is used in an insecure way with user controlled data. To exploit the vulnerability the attacker must convince the victim to...

WINDOWS 7 RC 7100 GDI驱动Win32k.sys内核D.O.S漏洞

Win32k.sys是WINDOWS的GDI驱动程序，包含大量复杂的图形界面处理，由于其中大量代码是从WIN3.1中修改过来，因此成了WINDOWS漏洞多发之地。 这个漏洞主要是因为Windows 7 在其NtUserGetDc/NtUserGetDcEx函数中（也许不仅仅是这两个函数）不正确地使用了共享临界锁，导致了任何权限下的GDI程序可以引发内核BSOD，从而进行DOS攻击. =============== 在WINDOWS VISTA中，在这两个函数进入前，会调用UserEnterUserCirtSec，进入临界区，同时会将gptiCurrent设置为当前线程的WIN32THRE...

Snow Leopard security is all relative

Little, if anything, gets Mac users more exercised than a mention of their favorite machine’s security problems. Despite the fact that security experts believe Macs to be much easier to exploit than Windows machines, Mac users simply trot out the old saw about there not being any virus attacks on...

Pirated Windows 7 builds botnet with Trojan

From eWEEK Brian Prince Attackers pushing pirated, malware-laced copies of Microsoft’s upcoming Windows 7 operating system have been actively trying to build a botnet. According to researchers at Damballa, attackers hid a Trojan inside of pirated copies of the operating system and began circulati...

Windows 7 retains Windows Explorer security risk

From InformationWeek Thomas Claburn Windows 7 RC is now available, but Microsoft’s new operating system could use a bit more tinkering to improve security. Specifically, Windows Explorer provides a way to hide a file’s extension. Virus writers use this feature to disguise executable files as...

Leaked copies of Windows 7 RC contain malware

From Computerworld Gregg Keizer Pirated copies of Windows 7 Release Candidate RC on file-sharing sites contain malware, according to users who have downloaded the upgrade. Some of the pirated builds include a Trojan horse, numerous users said in message forums and in comments on BitTorrent sites...