Jeff Moss on the vulnerability economy

Jeff Moss, the founder of DEFCON and Black Hat, discusses the unfolding of the vulnerability economy. Nowadays, instead of exposing high profile zero-day vulnerabilities at conferences, many researchers opt for selling their discoveries on a growing market...

Mozilla Firefox XUL Linked Clones Double Free Vulnerability — Mozilla

An anonymous researcher, via TippingPoint's Zero Day Initiative program, reported a vulnerability in Mozilla's garbage collection process. The vulnerability was caused by improper memory management of a set of cloned XUL DOM elements which were linked as a parent and child. After reloading the...

Pwn2Own hacker: Safari is 'easy pickings'

Charlie Miller right, the security researcher who won last year’s Pwn2Own hacker contest, is predicting that Apple’s Safari browser will be the easiest target this year. In a note posted on the popular Daily Dave mailing list, Miller describes Safari as “easy pickin’s” and forecasts that at least...

Adobe under fire for poor security response

In the wake of the zero-day attacks against Adobe’s Acrobat and Reader product lines, the company is taking a lot of flack for its poor response to handling the issue — specifically around communicating the risks and providing migitation guidance for end users. Over on the ZDNet Zero Day blog, I...

Trojan exploiting Excel zero-day flaw

Reports have been circulating in the last couple of days about an unpatched vulnerability in Microsoft Excel, and the software giant has now confirmed the problem. The flaw allows attackers to run code on remote machines if they can entice a user into opening a malicious Excel file. Some security...

Pwn2Own 2009: Browsers and smart phones are targets

TippingPoint’s Zero Day Initiative has released the rules for this year’s CanSecWest PWN2OWN contest, which will target unpatched flaws in Web browsers and mobile devices. Among the target list this year: Microsoft’s Internet Explorer 8, Apple’s Safari, Google’s Chrome, Windows Mobile, Google...

ZDI-09-012: Microsoft Internet Explorer Malformed CSS Memory Corruption

ZDI-09-012: Microsoft Internet Explorer Malformed CSS Memory Corruption Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-012 February 10, 2009 -- CVE ID: CVE-2009-0076 -- Affected Vendors: Microsoft -- Affected Products: Microsoft Internet Explorer -- TippingPointTM IPS Customer...

ZDI-09-011: Microsoft Internet Explorer CFunctionPointer Memory Corruption Vulnerability

ZDI-09-011: Microsoft Internet Explorer CFunctionPointer Memory Corruption Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-011 February 10, 2009 -- CVE ID: CVE-2009-0075 -- Affected Vendors: Microsoft -- Affected Products: Microsoft Internet Explorer -- TippingPointTM IPS Custome...

ZDI-09-010: Novell Netware Groupwise GWIA RCPT Command Buffer Overflow Vulnerability

ZDI-09-010: Novell Netware Groupwise GWIA RCPT Command Buffer Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-010 February 2, 2009 -- Affected Vendors: Novell -- Affected Products: Novell Netware -- TippingPointTM IPS Customer Protection: TippingPoint IPS customers have...

ZDI-09-009: EMC AutoStart Backbone Engine Trusted Pointer Code Execution Vulnerability

ZDI-09-009: EMC AutoStart Backbone Engine Trusted Pointer Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-009 January 23, 2009 -- Affected Vendors: EMC -- Affected Products: EMC AutoStart -- TippingPointTM IPS Customer Protection: TippingPoint IPS customers have be...

ZDI-09-007: Apple QuickTime Cinepak Codec MDAT Heap Corruption Vulnerability

ZDI-09-007: Apple QuickTime Cinepak Codec MDAT Heap Corruption Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-007 January 21, 2009 -- CVE ID: CVE-2009-2006 -- Affected Vendors: Apple -- Affected Products: Apple Quicktime -- TippingPointTM IPS Customer Protection: TippingPoint IP...

Oracle Secure Backup login.php rbtool command injection

Added: 01/20/2009 CVE: CVE-2008-5448 BID: 33177 OSVDB: 51342 Background Oracle Secure Backup is a centralized tape backup management solution for Oracle Database. Problem A command injection vulnerability in the Oracle Secure Backup web interface allows a remote attacker to execute arbitrary...

ZDI-09-002: Microsoft SMB NT Trans2 Request Parsing Remote Code Execution Vulnerability

ZDI-09-002: Microsoft SMB NT Trans2 Request Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-002 January 13, 2009 -- CVE ID: CVE-2008-4835 -- Affected Vendors: Microsoft -- Affected Products: Microsoft Windows Server 2008 Microsoft Windows Vista...

ZDI-09-001: Microsoft SMB NT Trans Request Parsing Remote Code Execution Vulnerability

ZDI-09-001: Microsoft SMB NT Trans Request Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-001 January 13, 2009 -- CVE ID: CVE-2008-4834 -- Affected Vendors: Microsoft -- Affected Products: Microsoft Windows XP Microsoft Windows 2000 SP4 Microsoft...

ZDI-08-088: Oracle E-Business Suite Business Intelligence SQL Injection Vulnerability

ZDI-08-088: Oracle E-Business Suite Business Intelligence SQL Injection Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-08-088 December 16, 2008 -- Affected Vendors: Oracle -- Affected Products: Oracle Database Server -- TippingPointTM IPS Customer Protection: TippingPoint IPS...

eZ Publish 3.9.0/3.9.5/3.10.1 Command Execution Exploit (admin req)

No description provided by source. / eZ Publish OS Commanding executing exploit by s4avrd0w [email protected] Versions affected 3.x tested on version 3.9.0, 3.9.5, 3.10.1 usage: ./eZPublishabuseoffunctionalityzeroday -u=username -p=password -s=EZPublishserver The options are required: -u Login of t...

ZDI-08-082: BMC PatrolAgent Version Logging Format String Vulnerability

ZDI-08-082: BMC PatrolAgent Version Logging Format String Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-08-082 December 8, 2008 -- Affected Vendors: BMC Software -- Affected Products: BMC Software Patrol -- TippingPointTM IPS Customer Protection: TippingPoint IPS customers have be...

ZDI-08-083: Microsoft Animation ActiveX Control Malformed AVI Parsing Code Execution Vulnerability

ZDI-08-083: Microsoft Animation ActiveX Control Malformed AVI Parsing Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-08-083 December 9, 2008 -- CVE ID: CVE-2008-4255 -- Affected Vendors: Microsoft -- Affected Products: Microsoft Windows XP -- TippingPointTM IPS...

ZDI-08-080: Sun Java AWT Library Sandbox Violation Vulnerability

ZDI-08-080: Sun Java AWT Library Sandbox Violation Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-08-080 December 4, 2008 -- Affected Vendors: Sun Microsystems -- Affected Products: Sun Microsystems Java Runtime -- TippingPointTM IPS Customer Protection: TippingPoint IPS customers...

ZDI-08-077: Trillian AIM IMG Tag Parsing Stack Overflow Vulnerability

ZDI-08-077: Trillian AIM IMG Tag Parsing Stack Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-08-077 December 4, 2008 -- Affected Vendors: Cerulean Studios -- Affected Products: Cerulean Studios Trillian -- Vulnerability Details: This vulnerability allows remote attackers ...