«
Expand/Collapse
30 items tagged "null byte"
Related tags:
null [+],
proof of concept [+],
day [+],
code execution [+],
adobe shockwave player [+],
vulnerability [+],
zero day [+],
unicode string [+],
string [+],
source [+],
server code [+],
server authentication [+],
server [+],
reader [+],
pypam [+],
oracle database 11g [+],
novell zenworks asset management [+],
netsaro [+],
microsoft reader [+],
microsoft [+],
messenger server [+],
initiative [+],
dll library [+],
directory traversal [+],
code attempts [+],
service vulnerability [+],
net [+],
double [+],
denial of service [+],
condition [+],
byte [+],
arbitrary code [+],
password [+],
linus [+],
javascript [+],
infinite supply [+],
hacks [+],
flock browser [+],
flock [+],
file [+],
dev [+],
computing [+],
classic [+],
bugtraq [+],
browser [+],
zero [+],
code [+]
-
-
7:44
»
Packet Storm Security Exploits
By supplying a NULL-byte to the PyPAM module, a double-free condition is triggered. This condition may allow for remote code execution. Proof of concept included.
-
7:44
»
Packet Storm Security Recent Files
By supplying a NULL-byte to the PyPAM module, a double-free condition is triggered. This condition may allow for remote code execution. Proof of concept included.
-
7:44
»
Packet Storm Security Misc. Files
By supplying a NULL-byte to the PyPAM module, a double-free condition is triggered. This condition may allow for remote code execution. Proof of concept included.
-
-
14:09
»
Hack a Day
Here’s something we thought we would never see: computing with just pipes, /dev/zero, and /dev/null. As a thought experiment, [Linus] imagined a null byte represented an electron. /dev/zero would have an infinite supply of electrons and /dev/null would make a wonderful positive power supply. With a very short program (named mosfet.c), [Linus] can use Linux pipes [...]
-
-
9:23
»
Packet Storm Security Advisories
Microsoft ASP.NET Forms suffers from a null byte termination authentication bypass vulnerability that exists in the CopyStringToUnAlingnedBuffer() function of the webengine4.dll library used by the .NET framework. The unicode string length is determined using the lstrlenW function. The lstrlenW function returns the length of the string, in characters not including the terminating null character. If the unicode string containing a null byte is passed, its length is incorrectly calculated, so only characters before the null byte are copied into the buffer.
-
9:23
»
Packet Storm Security Recent Files
Microsoft ASP.NET Forms suffers from a null byte termination authentication bypass vulnerability that exists in the CopyStringToUnAlingnedBuffer() function of the webengine4.dll library used by the .NET framework. The unicode string length is determined using the lstrlenW function. The lstrlenW function returns the length of the string, in characters not including the terminating null character. If the unicode string containing a null byte is passed, its length is incorrectly calculated, so only characters before the null byte are copied into the buffer.
-
9:23
»
Packet Storm Security Misc. Files
Microsoft ASP.NET Forms suffers from a null byte termination authentication bypass vulnerability that exists in the CopyStringToUnAlingnedBuffer() function of the webengine4.dll library used by the .NET framework. The unicode string length is determined using the lstrlenW function. The lstrlenW function returns the length of the string, in characters not including the terminating null character. If the unicode string containing a null byte is passed, its length is incorrectly calculated, so only characters before the null byte are copied into the buffer.
-
-
20:00
»
Packet Storm Security Advisories
Zero Day Initiative Advisory 11-342 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Zenworks Asset Management. Authentication is not required to exploit this vulnerability. The flaw exists within the rtrlet component. This process listens on TCP port 8080. When handling an unauthenticated file upload the process does not properly sanitize the path. Directory traversal can be used to drop a file in an arbitrary location and a null byte inserted into the filename to provide arbitrary extension. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of SYSTEM.
-
20:00
»
Packet Storm Security Recent Files
Zero Day Initiative Advisory 11-342 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Zenworks Asset Management. Authentication is not required to exploit this vulnerability. The flaw exists within the rtrlet component. This process listens on TCP port 8080. When handling an unauthenticated file upload the process does not properly sanitize the path. Directory traversal can be used to drop a file in an arbitrary location and a null byte inserted into the filename to provide arbitrary extension. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of SYSTEM.
-
20:00
»
Packet Storm Security Misc. Files
Zero Day Initiative Advisory 11-342 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Zenworks Asset Management. Authentication is not required to exploit this vulnerability. The flaw exists within the rtrlet component. This process listens on TCP port 8080. When handling an unauthenticated file upload the process does not properly sanitize the path. Directory traversal can be used to drop a file in an arbitrary location and a null byte inserted into the filename to provide arbitrary extension. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of SYSTEM.
-
-
15:48
»
Packet Storm Security Advisories
A vulnerability exists in the NetSaro Enterprise Messenger Server Administration Console allowing a remote attacker to obtain unauthenticated access to the applications source code. Attackers may make HTTP GET requests and append a Null Byte to allow download of the source code for the applications web pages. An attacker does not need to authenticate to obtain access to source code for pages that usually require authentication prior to viewing.
-
15:48
»
Packet Storm Security Recent Files
A vulnerability exists in the NetSaro Enterprise Messenger Server Administration Console allowing a remote attacker to obtain unauthenticated access to the applications source code. Attackers may make HTTP GET requests and append a Null Byte to allow download of the source code for the applications web pages. An attacker does not need to authenticate to obtain access to source code for pages that usually require authentication prior to viewing.
-
15:48
»
Packet Storm Security Misc. Files
A vulnerability exists in the NetSaro Enterprise Messenger Server Administration Console allowing a remote attacker to obtain unauthenticated access to the applications source code. Attackers may make HTTP GET requests and append a Null Byte to allow download of the source code for the applications web pages. An attacker does not need to authenticate to obtain access to source code for pages that usually require authentication prior to viewing.
-
-
19:46
»
Packet Storm Security Advisories
Zero Day Initiative Advisory 11-246 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Sybase Adaptive Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the way Sybase Backup and Monitor servers handles certain data in the login packets. Malformed packets can cause the service in question to write a NULL byte on the stack which can be leveraged by a remote attacker to execute code under the context of the running service.
-
19:46
»
Packet Storm Security Recent Files
Zero Day Initiative Advisory 11-246 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Sybase Adaptive Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the way Sybase Backup and Monitor servers handles certain data in the login packets. Malformed packets can cause the service in question to write a NULL byte on the stack which can be leveraged by a remote attacker to execute code under the context of the running service.
-
19:46
»
Packet Storm Security Misc. Files
Zero Day Initiative Advisory 11-246 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Sybase Adaptive Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the way Sybase Backup and Monitor servers handles certain data in the login packets. Malformed packets can cause the service in question to write a NULL byte on the stack which can be leveraged by a remote attacker to execute code under the context of the running service.
-
-
16:02
»
Packet Storm Security Advisories
Zero Day Initiative Advisory 11-207 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Adobe Shockwave Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the support for embedding various file types within the RIFF-based Director file format. Several of the asset modules distributed with Shockwave do not properly extract string values from within embedded media objects. The code attempts to null-terminate such strings using a 32-bit size value specified prior to the string value. By crafting an embedded media object with a large string size an attacker can write a NULL byte to a controlled offset from the buffer containing the string. This can be leveraged to execute arbitrary code under the context of the user running the browser.
-
16:02
»
Packet Storm Security Recent Files
Zero Day Initiative Advisory 11-207 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Adobe Shockwave Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the support for embedding various file types within the RIFF-based Director file format. Several of the asset modules distributed with Shockwave do not properly extract string values from within embedded media objects. The code attempts to null-terminate such strings using a 32-bit size value specified prior to the string value. By crafting an embedded media object with a large string size an attacker can write a NULL byte to a controlled offset from the buffer containing the string. This can be leveraged to execute arbitrary code under the context of the user running the browser.
-
16:02
»
Packet Storm Security Misc. Files
Zero Day Initiative Advisory 11-207 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Adobe Shockwave Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the support for embedding various file types within the RIFF-based Director file format. Several of the asset modules distributed with Shockwave do not properly extract string values from within embedded media objects. The code attempts to null-terminate such strings using a 32-bit size value specified prior to the string value. By crafting an embedded media object with a large string size an attacker can write a NULL byte to a controlled offset from the buffer containing the string. This can be leveraged to execute arbitrary code under the context of the user running the browser.
-
-
19:23
»
Packet Storm Security Exploits
Microsoft Reader versions 2.1.1.3143 and below suffer a vulnerability where it is possible to write a NULL byte in an arbitrary location. Proof of concept code included.
-
19:23
»
Packet Storm Security Recent Files
Microsoft Reader versions 2.1.1.3143 and below suffer a vulnerability where it is possible to write a NULL byte in an arbitrary location. Proof of concept code included.
-
19:23
»
Packet Storm Security Misc. Files
Microsoft Reader versions 2.1.1.3143 and below suffer a vulnerability where it is possible to write a NULL byte in an arbitrary location. Proof of concept code included.
-
-
14:06
»
Packet Storm Security Advisories
Zero Day Initiative Advisory 11-018 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Database 11g. Authentication is not required to exploit this vulnerability. The specific flaw exists within a JSP script exposed via an HTTPS server running by default on TCP port 1158. The script allows clients to upload XML files to the server. However, if a NULL byte is supplied within a POST parameter during a request to this JSP page, the process will fail to properly append the XML extension to the created file. An attacker can abuse this to upload executable code which can later be accessed remotely allowing for code execution to be achieved on the server system.
-
14:06
»
Packet Storm Security Recent Files
Zero Day Initiative Advisory 11-018 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Database 11g. Authentication is not required to exploit this vulnerability. The specific flaw exists within a JSP script exposed via an HTTPS server running by default on TCP port 1158. The script allows clients to upload XML files to the server. However, if a NULL byte is supplied within a POST parameter during a request to this JSP page, the process will fail to properly append the XML extension to the created file. An attacker can abuse this to upload executable code which can later be accessed remotely allowing for code execution to be achieved on the server system.
-
14:06
»
Packet Storm Security Misc. Files
Zero Day Initiative Advisory 11-018 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Database 11g. Authentication is not required to exploit this vulnerability. The specific flaw exists within a JSP script exposed via an HTTPS server running by default on TCP port 1158. The script allows clients to upload XML files to the server. However, if a NULL byte is supplied within a POST parameter during a request to this JSP page, the process will fail to properly append the XML extension to the created file. An attacker can abuse this to upload executable code which can later be accessed remotely allowing for code execution to be achieved on the server system.
-
-
21:30
»
Packet Storm Security Recent Files
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Shockwave Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within DIRAPIX.dll which is responsible for parsing the Director movies, a RIFF-based file format. The code directly uses a value from the file while seeking into a heap buffer. The process then attempts to write a NULL byte to the seeked address. By specifying a large enough value for this field, an attacker can force the process to seek beyond the allocated bounds of the buffer. This can be leveraged by an attacker to execute arbitrary code under the context of the user running the web browser.
-
21:29
»
Packet Storm Security Advisories
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Shockwave Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within DIRAPIX.dll which is responsible for parsing the Director movies, a RIFF-based file format. The code directly uses a value from the file while seeking into a heap buffer. The process then attempts to write a NULL byte to the seeked address. By specifying a large enough value for this field, an attacker can force the process to seek beyond the allocated bounds of the buffer. This can be leveraged by an attacker to execute arbitrary code under the context of the user running the web browser.
1337day (was: Inj3ct0r, 1337db)
OSVDB Vulnerabilities
Exploit-DB
SecurityFocus Vulnerabilities
Bugtraq
XSSed
Sophos security news
Penetration Testing
SecuriTeam
BackTrack Linux Forums
Threatpost
SecDocs
carnal0wnage.attackresearch.com
Carnal0wnage
Darknet
The Exploitant
Wirevolution