jetlib.sec » Tags » data-execution-prevention

Feeds

133345 items (0 unread) in 27 feeds

• 1337day (was: Inj3ct0r, 1337db)
• OSVDB Vulnerabilities
• Exploit-DB
• SecurityFocus Vulnerabilities
• Bugtraq
• Full Disclosure
• XSSed
• Packet Storm Security Headlines
• Packet Storm Security Advisories
• Packet Storm Security Exploits
• Packet Storm Security Recent Files
• Packet Storm Security Tools
• Packet Storm Security Misc. Files
• Sophos security news
• Sophos product advisories
• Penetration Testing
• SecuriTeam
• BackTrack Linux Forums
• Threatpost
• SecDocs
• carnal0wnage.attackresearch.com
• Carnal0wnage
• Kernel Fun
• Darknet
• The Exploitant
• Hack a Day
• Wirevolution

8 items tagged "data execution prevention"

Related tags: execution [+], vulnerability [+], overflow vulnerability [+], java runtime environment [+], heap [+], protection mechanisms [+], aslr [+], windows systems [+], windows [+], usa [+], technical detail [+], releases [+], read [+], prevention [+], out [+], moore tags [+], microsoft [+], memory corruption [+], memory [+], hacking [+], google [+], germany [+], france [+], exploitation techniques [+], exploitation [+], dino dai zovi [+], depth [+], dep [+], data [+], darknet [+], corruption [+], General [+]

• January 27, 2012
• 16:45

  MS12-004 midiOutPlayNextPolyEvent Heap Overflow

   » ‎ Packet Storm Security Exploits
  This Metasploit module exploits a heap overflow vulnerability in the Windows Multimedia Library (winmm.dll). The vulnerability occurs when parsing specially crafted MIDI files. Remote code execution can be achieved by using Windows Media Player's ActiveX control. Exploitation is done by supplying a specially crafted MIDI file with specific events, causing the offset calculation being higher than how much is available on the heap (0x400 allocated by WINMM!winmmAlloc), and then allowing us to either "inc al" or "dec al" a byte. This can be used to corrupt an array (CImplAry) we setup, and force the browser to confuse types from tagVARIANT objects, which leverages remote code execution under the context of the user. At this time, for IE 8 target, JRE (Java Runtime Environment) is required to bypass DEP (Data Execution Prevention). Note: Based on our testing, the vulnerability does not seem to trigger when the victim machine is operated via rdesktop.

  Tags:  execution vulnerability heap java-runtime-environment overflow-vulnerability data-execution-prevention  

• 16:45

  MS12-004 midiOutPlayNextPolyEvent Heap Overflow

   » ‎ Packet Storm Security Recent Files
  This Metasploit module exploits a heap overflow vulnerability in the Windows Multimedia Library (winmm.dll). The vulnerability occurs when parsing specially crafted MIDI files. Remote code execution can be achieved by using Windows Media Player's ActiveX control. Exploitation is done by supplying a specially crafted MIDI file with specific events, causing the offset calculation being higher than how much is available on the heap (0x400 allocated by WINMM!winmmAlloc), and then allowing us to either "inc al" or "dec al" a byte. This can be used to corrupt an array (CImplAry) we setup, and force the browser to confuse types from tagVARIANT objects, which leverages remote code execution under the context of the user. At this time, for IE 8 target, JRE (Java Runtime Environment) is required to bypass DEP (Data Execution Prevention). Note: Based on our testing, the vulnerability does not seem to trigger when the victim machine is operated via rdesktop.

  Tags:  execution vulnerability heap java-runtime-environment overflow-vulnerability data-execution-prevention  

• 16:45

  MS12-004 midiOutPlayNextPolyEvent Heap Overflow

   » ‎ Packet Storm Security Misc. Files
  This Metasploit module exploits a heap overflow vulnerability in the Windows Multimedia Library (winmm.dll). The vulnerability occurs when parsing specially crafted MIDI files. Remote code execution can be achieved by using Windows Media Player's ActiveX control. Exploitation is done by supplying a specially crafted MIDI file with specific events, causing the offset calculation being higher than how much is available on the heap (0x400 allocated by WINMM!winmmAlloc), and then allowing us to either "inc al" or "dec al" a byte. This can be used to corrupt an array (CImplAry) we setup, and force the browser to confuse types from tagVARIANT objects, which leverages remote code execution under the context of the user. At this time, for IE 8 target, JRE (Java Runtime Environment) is required to bypass DEP (Data Execution Prevention). Note: Based on our testing, the vulnerability does not seem to trigger when the victim machine is operated via rdesktop.

  Tags:  execution vulnerability heap java-runtime-environment overflow-vulnerability data-execution-prevention  

• September 08, 2011
• 10:37

  [Slides] Return-Oriented Exploitation

   » ‎ SecDocs
  Authors: Dino Dai Zovi
  Tags: exploiting
  Event: Black Hat USA 2010
  Abstract: The latest advances in exploitation of memory corruption vulnerabilities revolve around applying return-oriented exploitation techniques to evade non-executable memory protections such as Microsoft's Data Execution Prevention (DEP), CPU-supported non-executable memory (NX/XD), and mandatory code-signing such as on iPhone OS. Although the ideas behind these exploitation techniques can be traced quite far back, they are receiving more attention as non-executable memory protections become more prevalent. This presentation will cover the current state of memory corruption exploitation and exploit mitigation as well as an in-depth discussion of a variety of return-oriented exploitation techniques. Finally, the presentation will discuss what ramifications return-oriented exploitation techniques have for exploit developers, software vendors, malware analysts, and enterprise IT security professionals.

  Tags:  memory exploitation corruption dino-dai-zovi usa memory-corruption exploitation-techniques data-execution-prevention  

• July 05, 2011
• 7:52

  Defeating Data Execution Prevention And ASLR In Windows XP SP3

   » ‎ Packet Storm Security Recent Files
  Whitepaper called Defeating Data Execution Prevention and ASLR in Windows XP SP3. Data prevention Execution (DEP) and Address space layout randomization (ASLR) are two protection mechanisms integrated in Windows operating system to make more complicated the task of exploiting software. This document show how these two features can be bypassed using different techniques.

  Tags:  prevention data execution data-execution-prevention aslr protection-mechanisms  

• 7:52

  Defeating Data Execution Prevention And ASLR In Windows XP SP3

   » ‎ Packet Storm Security Misc. Files
  Whitepaper called Defeating Data Execution Prevention and ASLR in Windows XP SP3. Data prevention Execution (DEP) and Address space layout randomization (ASLR) are two protection mechanisms integrated in Windows operating system to make more complicated the task of exploiting software. This document show how these two features can be bypassed using different techniques.

  Tags:  data-execution-prevention aslr protection-mechanisms  

• December 25, 2010
• 21:25

  [Slides] DEP in Depth

   » ‎ SecDocs
  Authors: Brett Moore
  Tags: Windows exploiting DEP
  Event: Ruxcon 2010
  Abstract: An in-depth look into Data Execution Prevention on Windows systems, and how it can be bypassed. Multiple different bypass techniques will be explained in technical detail, covering Windows 2003 through to Windows 7. Examples will cover both stack and heap exploitation scenarios, and will cover DEP opt-in/out/permanent states.

  Tags:  dep depth windows moore-tags data-execution-prevention technical-detail windows-systems  

• January 21, 2010
• 0:01

  Microsoft Releases Out-Of-Band Patch For IE 0-Day Vulnerability

   » ‎ Darknet
  Ah Microsoft is treating this one seriously after France and Germany advised users to avoid IE. The current strain being exploited only targets IE6 users, but one security company has developed an exploit for IE8 which also bypasses DEP (Data Execution Prevention). It was rumoured this was the exploit used last week to compromise Google and...
  
  Read the full post at darknet.org.uk

  
  

  

  Tags:  microsoft releases out read germany france data-execution-prevention google darknet General hacking