«
Expand/Collapse
76 items tagged "process"
Related tags:
zero day [+],
arbitrary code execution [+],
string [+],
red hat security [+],
process dumper [+],
network node manager [+],
manager. authentication [+],
linux [+],
code [+],
zero [+],
user [+],
ubuntu [+],
system management tasks [+],
security notice [+],
ruby securerandom [+],
ruby [+],
prng [+],
port 587 [+],
paolo bonzini [+],
mode design [+],
memory corruption [+],
memory [+],
low [+],
logging function [+],
linux kernel [+],
jonathan brossard [+],
ioctl [+],
internet explorer [+],
integrity [+],
hacker [+],
exploitation [+],
dll [+],
day [+],
corruption bug [+],
child [+],
chemistry [+],
chaos communication congress [+],
buffer overflow condition [+],
arcserve replication [+],
zip [+],
x86 [+],
windows version [+],
win [+],
usa [+],
tivoli storage manager [+],
tar bz2 [+],
stack buffer [+],
ssh version [+],
ssh connection [+],
ssh [+],
slides [+],
security event [+],
security [+],
running [+],
red [+],
quot [+],
preferred image [+],
pipe character [+],
packet data [+],
null pointer [+],
new image [+],
manager fastback [+],
lnx [+],
keychain [+],
jboss application server [+],
jboss [+],
image base [+],
image [+],
icc [+],
hp network [+],
hollowing [+],
format specifier [+],
file [+],
exe [+],
dumper [+],
development [+],
cron jobs [+],
cisco security advisory [+],
cisco security [+],
cisco ios [+],
business process automation [+],
bsd [+],
bruce potter [+],
based buffer overflow [+],
arbitrary code [+],
adobe reader [+],
BackTrack [+],
zabbix [+],
york [+],
vulnerability research [+],
vulnerability assessment [+],
video encoding [+],
video [+],
uv light [+],
usefull info [+],
usb [+],
typewriter [+],
trap [+],
transportation [+],
todd [+],
target area [+],
sun chart [+],
sun [+],
steven dufresne [+],
steven christey [+],
steven [+],
stereolithographic [+],
spray [+],
solar [+],
slplink [+],
shellcode [+],
shapes and sizes [+],
service vulnerability [+],
sensors [+],
selective laser sintering process [+],
s miles [+],
richard johnson tags [+],
response plan [+],
remediation measures [+],
relays [+],
reed switches [+],
priority 1 [+],
printing process [+],
printer [+],
polyester resins [+],
pidgin [+],
pcbs [+],
paul [+],
passive component [+],
parallel port [+],
oracle [+],
msn [+],
monitoring [+],
misc [+],
mike szczys [+],
materiel [+],
material check [+],
management [+],
machine [+],
luminol [+],
look [+],
led [+],
lead [+],
killall [+],
kill [+],
ken [+],
jonathan klein [+],
htop [+],
household chemicals [+],
household [+],
home [+],
hammers strike [+],
gregory s. miles tags [+],
google [+],
gantry [+],
forensics [+],
foregone conclusion [+],
firmware [+],
exploits [+],
electronic components [+],
drone [+],
door handle [+],
door [+],
diy [+],
desktop image [+],
denial of service [+],
d printed [+],
computer forensics [+],
computer [+],
compatible hardware [+],
comparable results [+],
color [+],
code execution [+],
cnc [+],
classic [+],
christian reed [+],
chris wysopal [+],
carole fennelly [+],
bug [+],
bubbler [+],
bpm [+],
boston [+],
bob martin [+],
battery acid [+],
batch jobs [+],
batch [+],
arduino [+],
aquarium [+],
andy [+],
and [+],
aluminum [+],
affiche x [+],
aerial drone [+],
aerial [+],
acid [+],
Support [+],
Fixes [+],
Bugs [+],
vulnerability [+],
hacks [+],
php [+],
integer overflow vulnerability [+],
exif [+]
-
-
![Permalink for '[Video] Post Memory Corruption Memory Analysis'](/themes/lilina/web//media/mark_off.gif)
22:38
»
SecDocs
Authors:
Jonathan Brossard Tags:
memory Event:
Chaos Communication Congress 28th (28C3) 2011 Abstract: Pmcma is a tool aimed at automating the most time consuming taskes of exploitation. It for instance determine why an application is triggering a segmentention fault, evaluate if the faulting instruction can be used to write to memory or execute arbitrary code, and list all the function pointers potentially called from a given point in time by an application. Pmcma is a totally new kind of debugger, which allows for easy experimentation with a process in memory by forcing it to fork. The exact replicas of the process created in memory can then be intrumented while keeping the properties (eg: state of variables, ASLR, permissions...) of the original process. Pmcma is an easily extensible framework available under the Apache 2.0 license from http://www.pmcma.org/ . In this presentation, we introduce a new exploitation methodology of invalid memory reads and writes, based on dataflow analysis after a memory corruption bug has occured inside a running process. We will expose a methodology which shall help writting a reliable exploit out of a PoC triggering an invalid memory write, in presence of security defense mechanisme such as compiler enchancements (full RELRO, SSP...), or kernel anti exploitation features (ASLR, NX...). We will demonstrate how to:find all the function pointers inside a running process, how to determine which ones would have been dereferenced after the crash, which ones are truncable (in particular with 0x00000000). In case all of the above fail, how to test for specific locations overwrites in order to indirectly trigger a second vulnerability allowing greater control and eventually control flow hijacking. All of the above without source code, indeed ;) In the case of invalid memory reads, we will exemplify how indirectly influence the control flow of execution by reading arbitary values, how to trace all the unaligned memory access and how to test if an invalid read can be turned into an invalid write or used to infere the mapping of the binary. We will also introduce a new debugging technique which allows for very effective testing of all of the above by forcing the debugged process to fork(). Automatically. And with a rating of the best read/write location based on probabilities of mapping addresses (because of ASLR). Finally, since overwriting function pointers doesn't allow direct shellcode execution because of W^X mappings, we introduce a new exploitation technique which works even in the most hardcore kernels such as grsecurity. IT is called "stack desynchronization" and allows frame faking inside the stack itself. Those techniques are implemented in the form of a proof of concept tool available under the Apache 2.0 license at : http://www.pmcma.org/ .
-
22:38
»
SecDocs
Authors:
Jonathan Brossard Tags:
memory Event:
Chaos Communication Congress 28th (28C3) 2011 Abstract: Pmcma is a tool aimed at automating the most time consuming taskes of exploitation. It for instance determine why an application is triggering a segmentention fault, evaluate if the faulting instruction can be used to write to memory or execute arbitrary code, and list all the function pointers potentially called from a given point in time by an application. Pmcma is a totally new kind of debugger, which allows for easy experimentation with a process in memory by forcing it to fork. The exact replicas of the process created in memory can then be intrumented while keeping the properties (eg: state of variables, ASLR, permissions...) of the original process. Pmcma is an easily extensible framework available under the Apache 2.0 license from http://www.pmcma.org/ . In this presentation, we introduce a new exploitation methodology of invalid memory reads and writes, based on dataflow analysis after a memory corruption bug has occured inside a running process. We will expose a methodology which shall help writting a reliable exploit out of a PoC triggering an invalid memory write, in presence of security defense mechanisme such as compiler enchancements (full RELRO, SSP...), or kernel anti exploitation features (ASLR, NX...). We will demonstrate how to:find all the function pointers inside a running process, how to determine which ones would have been dereferenced after the crash, which ones are truncable (in particular with 0x00000000). In case all of the above fail, how to test for specific locations overwrites in order to indirectly trigger a second vulnerability allowing greater control and eventually control flow hijacking. All of the above without source code, indeed ;) In the case of invalid memory reads, we will exemplify how indirectly influence the control flow of execution by reading arbitary values, how to trace all the unaligned memory access and how to test if an invalid read can be turned into an invalid write or used to infere the mapping of the binary. We will also introduce a new debugging technique which allows for very effective testing of all of the above by forcing the debugged process to fork(). Automatically. And with a rating of the best read/write location based on probabilities of mapping addresses (because of ASLR). Finally, since overwriting function pointers doesn't allow direct shellcode execution because of W^X mappings, we introduce a new exploitation technique which works even in the most hardcore kernels such as grsecurity. IT is called "stack desynchronization" and allows frame faking inside the stack itself. Those techniques are implemented in the form of a proof of concept tool available under the Apache 2.0 license at : http://www.pmcma.org/ .
-
22:38
»
SecDocs
Authors:
Jonathan Brossard Tags:
memory Event:
Chaos Communication Congress 28th (28C3) 2011 Abstract: Pmcma is a tool aimed at automating the most time consuming taskes of exploitation. It for instance determine why an application is triggering a segmentention fault, evaluate if the faulting instruction can be used to write to memory or execute arbitrary code, and list all the function pointers potentially called from a given point in time by an application. Pmcma is a totally new kind of debugger, which allows for easy experimentation with a process in memory by forcing it to fork. The exact replicas of the process created in memory can then be intrumented while keeping the properties (eg: state of variables, ASLR, permissions...) of the original process. Pmcma is an easily extensible framework available under the Apache 2.0 license from http://www.pmcma.org/ . In this presentation, we introduce a new exploitation methodology of invalid memory reads and writes, based on dataflow analysis after a memory corruption bug has occured inside a running process. We will expose a methodology which shall help writting a reliable exploit out of a PoC triggering an invalid memory write, in presence of security defense mechanisme such as compiler enchancements (full RELRO, SSP...), or kernel anti exploitation features (ASLR, NX...). We will demonstrate how to:find all the function pointers inside a running process, how to determine which ones would have been dereferenced after the crash, which ones are truncable (in particular with 0x00000000). In case all of the above fail, how to test for specific locations overwrites in order to indirectly trigger a second vulnerability allowing greater control and eventually control flow hijacking. All of the above without source code, indeed ;) In the case of invalid memory reads, we will exemplify how indirectly influence the control flow of execution by reading arbitary values, how to trace all the unaligned memory access and how to test if an invalid read can be turned into an invalid write or used to infere the mapping of the binary. We will also introduce a new debugging technique which allows for very effective testing of all of the above by forcing the debugged process to fork(). Automatically. And with a rating of the best read/write location based on probabilities of mapping addresses (because of ASLR). Finally, since overwriting function pointers doesn't allow direct shellcode execution because of W^X mappings, we introduce a new exploitation technique which works even in the most hardcore kernels such as grsecurity. IT is called "stack desynchronization" and allows frame faking inside the stack itself. Those techniques are implemented in the form of a proof of concept tool available under the Apache 2.0 license at : http://www.pmcma.org/ .
-
-
12:01
»
Hack a Day
[York] wrote in to share a video he stumbled across while researching reed switches and relays, which documents the tightly controlled process through which they are produced. Like many other electronic components out there, we usually don’t give a lot of thought to how they are made, especially when the final cost is relatively small. [...]
-
-
15:58
»
Packet Storm Security Advisories
Ubuntu Security Notice 1384-1 - A bug was discovered in the Linux kernel's calculation of OOM (Out of memory) scores, that would result in the wrong process being killed. A user could use this to kill the process with the highest OOM score, even if that process belongs to another user or the system. Paolo Bonzini discovered a flaw in Linux's handling of the SG_IO ioctl command. A local user, or user in a VM could exploit this flaw to bypass restrictions and gain read/write access to all data on the affected block device. Various other issues were also addressed.
-
15:58
»
Packet Storm Security Recent Files
Ubuntu Security Notice 1384-1 - A bug was discovered in the Linux kernel's calculation of OOM (Out of memory) scores, that would result in the wrong process being killed. A user could use this to kill the process with the highest OOM score, even if that process belongs to another user or the system. Paolo Bonzini discovered a flaw in Linux's handling of the SG_IO ioctl command. A local user, or user in a VM could exploit this flaw to bypass restrictions and gain read/write access to all data on the affected block device. Various other issues were also addressed.
-
15:58
»
Packet Storm Security Misc. Files
Ubuntu Security Notice 1384-1 - A bug was discovered in the Linux kernel's calculation of OOM (Out of memory) scores, that would result in the wrong process being killed. A user could use this to kill the process with the highest OOM score, even if that process belongs to another user or the system. Paolo Bonzini discovered a flaw in Linux's handling of the SG_IO ioctl command. A local user, or user in a VM could exploit this flaw to bypass restrictions and gain read/write access to all data on the affected block device. Various other issues were also addressed.
-
-
9:01
»
Hack a Day
If you have ever produced your own PCBs at home, you know that it can be somewhat of a time consuming process. Spending 20 or so minutes manually agitating a board is a drag, and while aquarium bubbler setups improve the process, they are far from ideal. [Christian Reed] knew that if he really wanted [...]
-
-
8:00
»
Hack a Day
[Steven Dufresne] does a lot of tinkering with solar-powered applications, a hobby which can be very time consuming if done right. One process he carries out whenever building a solar installation is creating a sun chart to determine how much (or little) sun the target area will get. The process requires [Steven] to take elevation [...]
-
-
15:55
»
Packet Storm Security Advisories
Red Hat Security Advisory 2011-1581-03 - Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to do system management tasks. It was found that Ruby did not reinitialize the PRNG after forking a child process. This could eventually lead to the PRNG returning the same result twice. An attacker keeping track of the values returned by one child process could use this flaw to predict the values the PRNG would return in other child processes. A flaw was found in the Ruby SecureRandom module. When using the SecureRandom.random_bytes class, the PRNG state was not modified after forking a child process. This could eventually lead to SecureRandom.random_bytes returning the same string more than once. An attacker keeping track of the strings returned by one child process could use this flaw to predict the strings SecureRandom.random_bytes would return in other child processes.
-
15:55
»
Packet Storm Security Recent Files
Red Hat Security Advisory 2011-1581-03 - Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to do system management tasks. It was found that Ruby did not reinitialize the PRNG after forking a child process. This could eventually lead to the PRNG returning the same result twice. An attacker keeping track of the values returned by one child process could use this flaw to predict the values the PRNG would return in other child processes. A flaw was found in the Ruby SecureRandom module. When using the SecureRandom.random_bytes class, the PRNG state was not modified after forking a child process. This could eventually lead to SecureRandom.random_bytes returning the same string more than once. An attacker keeping track of the strings returned by one child process could use this flaw to predict the strings SecureRandom.random_bytes would return in other child processes.
-
15:55
»
Packet Storm Security Misc. Files
Red Hat Security Advisory 2011-1581-03 - Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to do system management tasks. It was found that Ruby did not reinitialize the PRNG after forking a child process. This could eventually lead to the PRNG returning the same result twice. An attacker keeping track of the values returned by one child process could use this flaw to predict the values the PRNG would return in other child processes. A flaw was found in the Ruby SecureRandom module. When using the SecureRandom.random_bytes class, the PRNG state was not modified after forking a child process. This could eventually lead to SecureRandom.random_bytes returning the same string more than once. An attacker keeping track of the strings returned by one child process could use this flaw to predict the strings SecureRandom.random_bytes would return in other child processes.
-
-
5:01
»
Hack a Day
If you happen to do a lot of video encoding, you know that your computer can really drag while the process is carried out. Our own [Mike Szczys] transcodes videos at home fairly often, and because the process is automated, he doesn’t always know if a conversion is taking place in the background. He has [...]
-
-
15:01
»
Hack a Day
[Andy's] 3D printer build uses lasers to create objects from goo. The Stereolithographic process uses resin that is cured by UV light to create the finished product. A single laser mounted to a CNC gantry is able to precisely target a point on the surface of the resin to begin the printing process. As the [...]
-
-
15:01
»
Hack a Day
While many people have tried their hand at anodizing aluminum at home, there are plenty who would just as soon leave it up to the professionals due to the highly concentrated sulfuric acid required for the process. [Ken] started thinking about the process and wondered if there was a way to get comparable results using [...]
-
9:01
»
Hack a Day
What to make your own chemiluminescent material? Check out this process that uses common household goods to synthesize luminol. You’ll need some lab equipment, and [NurdRage] mentions some precautions to take as luminol is not itself toxic, but some of the fumes and intermediary chemicals found during the process are. Start by cutting up some [...]
-
-
6:49
»
Packet Storm Security Recent Files
Whitepaper called Process Hollowing. Process hollowing is yet another tool in the kit of those who seek to hide the presence of a process. The idea is rather straight forward: a bootstrap application creates a seemingly innocent process in a suspended state. The legitimate image is then unmapped and replaced with the image that is to be hidden. If the preferred image base of the new image does not match that of the old image, the new image must be rebased. Once the new image is loaded in memory the EAX register of the suspended thread is set to the entry point. The process is then resumed and the entry point of the new image is executed.
-
6:49
»
Packet Storm Security Misc. Files
Whitepaper called Process Hollowing. Process hollowing is yet another tool in the kit of those who seek to hide the presence of a process. The idea is rather straight forward: a bootstrap application creates a seemingly innocent process in a suspended state. The legitimate image is then unmapped and replaced with the image that is to be hidden. If the preferred image base of the new image does not match that of the old image, the new image must be rebased. Once the new image is loaded in memory the EAX register of the suspended thread is set to the entry point. The process is then resumed and the entry point of the new image is executed.
-
-
7:44
»
Packet Storm Security Recent Files
Red Hat Security Advisory 2011-1334-01 - JBoss Enterprise SOA Platform is the next-generation ESB and business process automation infrastructure. JBoss Enterprise SOA Platform allows IT to leverage existing, modern, and future integration methodologies to dramatically improve business process execution speed and quality. Multiple flaws were found in the way Spring Framework 3 deserialized certain Java objects. If an attacker were able to control the stream from which an application with the Spring Framework 3 AOP in its class-path was deserializing objects, they could use these flaws to execute arbitrary code with the privileges of the JBoss Application Server process via a specially-crafted, serialized Java object.
-
7:44
»
Packet Storm Security Misc. Files
Red Hat Security Advisory 2011-1334-01 - JBoss Enterprise SOA Platform is the next-generation ESB and business process automation infrastructure. JBoss Enterprise SOA Platform allows IT to leverage existing, modern, and future integration methodologies to dramatically improve business process execution speed and quality. Multiple flaws were found in the way Spring Framework 3 deserialized certain Java objects. If an attacker were able to control the stream from which an application with the Spring Framework 3 AOP in its class-path was deserializing objects, they could use these flaws to execute arbitrary code with the privileges of the JBoss Application Server process via a specially-crafted, serialized Java object.
-
-
14:01
»
Hack a Day
Relief is here from long compile times when developing firmware for your Arduino project. [Paul] was puzzled by the fact that every file used in a sketch is fully recompiled every time you hit upload–even if that file didn’t change. To make things more confusing, this behavior isn’t consistent across all Arduino compatible hardware. The [...]
-
-
0:28
»
SecDocs
Authors:
Lurene Grenier Richard Johnson Tags:
vulnerability assessment bug hunting fuzzing Event:
Black Hat USA 2010 Abstract: Much work has been presented in the past few years concerning bug discovery through fuzzing. Everything from the feasibility of exhaustive generation fuzzing, to the continued productivity of simple mutation fuzzing has been covered. This talk will assume finding bugs is a foregone conclusion, and instead discuss the pre and post fuzzing process necessary to efficiently analyze vulnerabilities for a given program to the stage where exploitability has a high confidence, and exploitation can be handed off or undertaken in house. This process will be driven by intelligent, analyst driven automation, with a focus on the continued production of exploitable bugs with a minimum of wasted effort.
-
-
11:59
»
Hack a Day
This color changing door handle was made using a very simple manufacturing process. [Barmak] already had experience working with polyester resins when making passive component filled drawer pulls (he included a couple of pictures at the end of his post). The same process was used here except that instead making it from one solid chunk [...]
-
-
21:19
»
Packet Storm Security Advisories
Zero Day Initiative Advisory 11-249 - This vulnerability allows remote attackers to escape Protected Mode on vulnerable installations of Internet Explorer. Internet Explorer Protected Mode consists of a Medium Integrity and a Low Integrity process. The Low Integrity process is only allowed to write to special Low Integrity locations. File written there are marked as Low Integrity files. When a new Internet Explorer process is launched it checks the Integrity of the file it is launched against. If the file is a Low Integrity file it will run the process in Low Integrity Mode. It is however possible to give the file an even lower permission: Untrusted, since this does not match the check for 'Low Integrity' the Internet Explorer will run in Medium Integrity instead of Low Integrity. This can be abused in an exploit to bypass the Protected Mode design and thus allow an attacker to escalate their privileges.
-
21:19
»
Packet Storm Security Recent Files
Zero Day Initiative Advisory 11-249 - This vulnerability allows remote attackers to escape Protected Mode on vulnerable installations of Internet Explorer. Internet Explorer Protected Mode consists of a Medium Integrity and a Low Integrity process. The Low Integrity process is only allowed to write to special Low Integrity locations. File written there are marked as Low Integrity files. When a new Internet Explorer process is launched it checks the Integrity of the file it is launched against. If the file is a Low Integrity file it will run the process in Low Integrity Mode. It is however possible to give the file an even lower permission: Untrusted, since this does not match the check for 'Low Integrity' the Internet Explorer will run in Medium Integrity instead of Low Integrity. This can be abused in an exploit to bypass the Protected Mode design and thus allow an attacker to escalate their privileges.
-
21:19
»
Packet Storm Security Misc. Files
Zero Day Initiative Advisory 11-249 - This vulnerability allows remote attackers to escape Protected Mode on vulnerable installations of Internet Explorer. Internet Explorer Protected Mode consists of a Medium Integrity and a Low Integrity process. The Low Integrity process is only allowed to write to special Low Integrity locations. File written there are marked as Low Integrity files. When a new Internet Explorer process is launched it checks the Integrity of the file it is launched against. If the file is a Low Integrity file it will run the process in Low Integrity Mode. It is however possible to give the file an even lower permission: Untrusted, since this does not match the check for 'Low Integrity' the Internet Explorer will run in Medium Integrity instead of Low Integrity. This can be abused in an exploit to bypass the Protected Mode design and thus allow an attacker to escalate their privileges.
-
-
6:02
»
Hack a Day
Drones come in many shapes and sizes, but now they can also be 3d printed! To make these drones, the [Decode] group used a selective laser sintering process which is pretty interesting in itself. Once the printing process is done, these little planes are built with only five structural and aerodynamic components. Because of their [...]
-
-
20:31
»
Packet Storm Security Advisories
Zero Day Initiative Advisory 11-171 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Sybase OneBridge Mobile Data Suite. Authentication is not required to exploit this vulnerability. The specific flaw exists within the iMailGatewayService server process (ECTrace.dll) which listens for encrypted requests by default on TCP port 993 (IMAP) and port 587 (SMTP). The process fails to properly sanitize malformed user string inputs before passing to the authentication logging function. By providing a specially crafted string with format specifiers this can be leveraged to trigger a format string vulnerability which can lead to arbitrary code execution in the context of the server process.
-
20:31
»
Packet Storm Security Recent Files
Zero Day Initiative Advisory 11-171 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Sybase OneBridge Mobile Data Suite. Authentication is not required to exploit this vulnerability. The specific flaw exists within the iMailGatewayService server process (ECTrace.dll) which listens for encrypted requests by default on TCP port 993 (IMAP) and port 587 (SMTP). The process fails to properly sanitize malformed user string inputs before passing to the authentication logging function. By providing a specially crafted string with format specifiers this can be leveraged to trigger a format string vulnerability which can lead to arbitrary code execution in the context of the server process.
-
20:31
»
Packet Storm Security Misc. Files
Zero Day Initiative Advisory 11-171 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Sybase OneBridge Mobile Data Suite. Authentication is not required to exploit this vulnerability. The specific flaw exists within the iMailGatewayService server process (ECTrace.dll) which listens for encrypted requests by default on TCP port 993 (IMAP) and port 587 (SMTP). The process fails to properly sanitize malformed user string inputs before passing to the authentication logging function. By providing a specially crafted string with format specifiers this can be leveraged to trigger a format string vulnerability which can lead to arbitrary code execution in the context of the server process.
-
-
19:28
»
Packet Storm Security Advisories
Zero Day Initiative Advisory 10-263 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of CA ARCserve Replication and High Availability. Authentication is not required to exploit this vulnerability. The specific flaw exists within the "create_session_bab" SOAP operation, which is handled by the xosoapapi.asmx process that is crucial to the remote administration of both the High Availability and the Replication products. By sending a specially crafted POST request to the xosoapapi.asmx process a remote, unauthenticated attacker can trigger a buffer overflow condition that results in arbitrary code execution under the context of the SOAP server process.
-
19:28
»
Packet Storm Security Recent Files
Zero Day Initiative Advisory 10-263 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of CA ARCserve Replication and High Availability. Authentication is not required to exploit this vulnerability. The specific flaw exists within the "create_session_bab" SOAP operation, which is handled by the xosoapapi.asmx process that is crucial to the remote administration of both the High Availability and the Replication products. By sending a specially crafted POST request to the xosoapapi.asmx process a remote, unauthenticated attacker can trigger a buffer overflow condition that results in arbitrary code execution under the context of the SOAP server process.
-
19:28
»
Packet Storm Security Misc. Files
Zero Day Initiative Advisory 10-263 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of CA ARCserve Replication and High Availability. Authentication is not required to exploit this vulnerability. The specific flaw exists within the "create_session_bab" SOAP operation, which is handled by the xosoapapi.asmx process that is crucial to the remote administration of both the High Availability and the Replication products. By sending a specially crafted POST request to the xosoapapi.asmx process a remote, unauthenticated attacker can trigger a buffer overflow condition that results in arbitrary code execution under the context of the SOAP server process.
-
-
15:01
»
Packet Storm Security Recent Files
Zero Day Initiative Advisory 10-191 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Reader. User interaction is required in that a target must be coerced into opening a file or visiting a web page. The specific flaw exists within the ACE.dll module responsible for parsing ICC streams. When processing an ICC stream, the process performs math on two DWORD values from the input file. If these values wrap over the maximum integer value of 0xFFFFFFFF a mis-allocation can occur. Later, the process uses one of the original DWORD values as a size to a copy function. This can be abused by an attacker to overflow a stack buffer and subsequently execute code under the context of the user running the process.
-
15:01
»
Packet Storm Security Advisories
Zero Day Initiative Advisory 10-191 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Reader. User interaction is required in that a target must be coerced into opening a file or visiting a web page. The specific flaw exists within the ACE.dll module responsible for parsing ICC streams. When processing an ICC stream, the process performs math on two DWORD values from the input file. If these values wrap over the maximum integer value of 0xFFFFFFFF a mis-allocation can occur. Later, the process uses one of the original DWORD values as a size to a copy function. This can be abused by an attacker to overflow a stack buffer and subsequently execute code under the context of the user running the process.
-
-
20:01
»
Packet Storm Security Recent Files
Zero Day Initiative Advisory 10-185 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Tivoli Storage Manager Fastback. Authentication is not required to exploit this vulnerability. The specific flaw exists within the FastBack server process (FastBackServer.exe) which listens by default on TCP port 11406. The process searches received packet data for a pipe character (0x7c) and then sends the remaining portion of the string to the event log without sanitization. By providing a specially crafted string with format specifiers this can be leveraged to trigger a format string vulnerability which can lead to arbitrary code execution in the context of the server process.
-
20:00
»
Packet Storm Security Advisories
Zero Day Initiative Advisory 10-185 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Tivoli Storage Manager Fastback. Authentication is not required to exploit this vulnerability. The specific flaw exists within the FastBack server process (FastBackServer.exe) which listens by default on TCP port 11406. The process searches received packet data for a pipe character (0x7c) and then sends the remaining portion of the string to the event log without sanitization. By providing a specially crafted string with format specifiers this can be leveraged to trigger a format string vulnerability which can lead to arbitrary code execution in the context of the server process.
-
-
7:00
»
Hack a Day
[Jackzylkin] has posted an instructible showing, in detail, the process of creating a USB typewriter. He takes us through the process of disassembling the typewriter, mounting all the sensors where the little hammers strike, and wiring it all up to a custom board to interface with the computer via USB. While he is selling the [...]
-
-
4:54
»
SecDocs
Tags:
vulnerability Event:
Source Conference Boston 2010 Abstract: Vulnerability management - how tough can it be? Vulnerabilities are identified, categorized, and then (hopefully) fixed through patches or upgrades. Simple enough, right? Actually, the process is far from simple, as anyone who has worked in the area of vulnerability management can tell you. Identifying vulnerabilities through a slew of vendor alerts, vulnerability databases, and third-party references is only the first step. From there, solutions must be identified, fixes obtained and tested, patch and upgrade deployments scheduled, and then monitor the whole mess... until the next patch cycle comes around so you can start the process all over again. This panel will discuss various aspects of the vulnerability management cycle: the assignment of common names for easy identification, using available information to gather appropriate remediation measures, pros and cons of patch testing, and how vulnerability management can be improved as an overall process. Join panelists Chris Wysopal of Veracode, Steven Christey and Bob Martin of MITRE Corporation, Jonathan Klein of Broadridge Financial Solutions, Kelly Todd of Tenable Network Security and moderator Carole Fennelly of Tenable Network Security as they look at vulnerability management: what works, what doesn't work, and what can be done to help improve processes, procedures, and remediation techniques
-
-
23:01
»
Packet Storm Security Tools
keychain is a utility that helps manage ssh keys in a convenient and secure manner. It acts as a frontend to ssh-agent, but allows the user to easily have one long running ssh-agent process per system, rather than the norm of one ssh-agent per login session. It also makes it easy for remote cron jobs to securely hook-in to a long running ssh-agent process, allowing your scripts to take advantage of key-based logins.
-
23:00
»
Packet Storm Security Recent Files
keychain is a utility that helps manage ssh keys in a convenient and secure manner. It acts as a frontend to ssh-agent, but allows the user to easily have one long running ssh-agent process per system, rather than the norm of one ssh-agent per login session. It also makes it easy for remote cron jobs to securely hook-in to a long running ssh-agent process, allowing your scripts to take advantage of key-based logins.
-
-
20:00
»
Packet Storm Security Recent Files
Zero Day Initiative Advisory 10-081 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP Network Node Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ovet_demandpoll.exe process. This process can be started by invoking the webappmon.exe CGI application through the webserver. The process calls vnsprintf() directly with the contents of the 'sel' POST variable. By providing a malicious value this format string vulnerability can be leveraged by remote attackers to execute arbitrary code under the context of the ovet_demandpoll.exe process.
-
20:00
»
Packet Storm Security Recent Files
Zero Day Initiative Advisory 10-083 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP Network Node Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the snmpviewer.exe CGI. The doLoad function in this process calls sprintf() with a %s format specifier and unsanitized user input retrieved from two separate POST variables (act and app). By providing large enough strings a remote attacker can cause a stack-based buffer overflow and eventually execute arbitrary code under the context of the webserver process.
-
20:00
»
Packet Storm Security Advisories
Zero Day Initiative Advisory 10-081 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP Network Node Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ovet_demandpoll.exe process. This process can be started by invoking the webappmon.exe CGI application through the webserver. The process calls vnsprintf() directly with the contents of the 'sel' POST variable. By providing a malicious value this format string vulnerability can be leveraged by remote attackers to execute arbitrary code under the context of the ovet_demandpoll.exe process.
-
20:00
»
Packet Storm Security Advisories
Zero Day Initiative Advisory 10-083 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP Network Node Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the snmpviewer.exe CGI. The doLoad function in this process calls sprintf() with a %s format specifier and unsanitized user input retrieved from two separate POST variables (act and app). By providing large enough strings a remote attacker can cause a stack-based buffer overflow and eventually execute arbitrary code under the context of the webserver process.
-
23:00
»
Packet Storm Security Recent Files
Process Dumper is able to make a dump of a running process in a forensical manner. Linux version.
-
23:00
»
Packet Storm Security Recent Files
Process Dumper is able to make a dump of a running process in a forensical manner. Windows version.
-
-
20:00
»
Packet Storm Security Recent Files
Zero Day Initiative Advisory 10-032 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP MaxDB. Authentication is not required to exploit this vulnerability. The specific flaw exists within the serv.exe process which listens by default on TCP port 7210. The process trusts a value from a handshake packet and uses it as a length when copying data to the stack. If provided a malicious value and packet data, this can be leveraged to execute arbitrary code under the context of the SYSTEM user.
-
19:09
»
Packet Storm Security Advisories
Zero Day Initiative Advisory 10-032 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP MaxDB. Authentication is not required to exploit this vulnerability. The specific flaw exists within the serv.exe process which listens by default on TCP port 7210. The process trusts a value from a handshake packet and uses it as a length when copying data to the stack. If provided a malicious value and packet data, this can be leveraged to execute arbitrary code under the context of the SYSTEM user.
-
-
14:52
»
remote-exploit & backtrack
hi fellas i was playing with my own installed VM with BT4 final and i installed
htop as an easy process manager for the console
so after install and everything i run htop and after short orienting on the "gui"
i was seeing 60 same processes named console-kit-deamon
here a screenshot
Screenshot
after a short research on GOOGLE i found something like it is used for user identification and other stuff but nothing sounded usefull for me
so befor doing something stupid and other things i thought it is a good idea to post it here and see the response from more advanced people
and it seem that this problem is in ubuntu also but also no usefull info on it
i have installed the iso desktop image
and a second running the vmware image ^^ (here is the same bug)
just for fun and finding differences
also i wantet to have it all configurt my way
and naturaly i speak german so excuse me vor my bad grammar
-
-
6:02
»
remote-exploit & backtrack
Bonjour tout le monde,
je viens d'acheter un Pavillon DV6 et quand j'arrive à la commande "startx" il me met un écran noir pendant même pas une seconde et il m'affiche ça :
X : warning; process set to priority -1 instead of request prioriti 0.
et plus bas :
Xinit : Connection refused (errno111): unable to connect to X server
Xinit : No such process (errno3): Server error.
Merci de m'aider s'il vous plait backtrack me manque :(
Merci d'avance !
-
-
16:00
»
Packet Storm Security Recent Files
Cisco Security Advisory - The SSH server implementation in Cisco IOS XR Software contains a vulnerability that an unauthenticated, remote user could exploit to cause a denial of service condition. An attacker could trigger this vulnerability by sending a crafted SSH version 2 packet that may cause a new SSH connection handler process to crash. Repeated exploitation may cause each new SSH connection handler process to crash and lead to a significant amount of memory being consumed, which could introduce instability that may adversely impact other system functionality. During this event, the parent SSH daemon process will continue to function normally.
-
16:00
»
Packet Storm Security Advisories
Cisco Security Advisory - The SSH server implementation in Cisco IOS XR Software contains a vulnerability that an unauthenticated, remote user could exploit to cause a denial of service condition. An attacker could trigger this vulnerability by sending a crafted SSH version 2 packet that may cause a new SSH connection handler process to crash. Repeated exploitation may cause each new SSH connection handler process to crash and lead to a significant amount of memory being consumed, which could introduce instability that may adversely impact other system functionality. During this event, the parent SSH daemon process will continue to function normally.
1337day (was: Inj3ct0r, 1337db)
OSVDB Vulnerabilities
Exploit-DB
SecurityFocus Vulnerabilities
Bugtraq
XSSed
Sophos security news
Penetration Testing
SecuriTeam
BackTrack Linux Forums
Threatpost
carnal0wnage.attackresearch.com
Carnal0wnage
Darknet
The Exploitant
Wirevolution