jetlib.sec

Feeds

133445 items (0 unread) in 27 feeds

« Expand/Collapse

611 items tagged "user"

Skip to page: 1 2 3

May 21, 2012
17:21
Red Hat Security Advisory 2012-0677-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2012-0677-01 - PostgreSQL is an advanced object-relational database management system. The pg_dump utility inserted object names literally into comments in the SQL script it produces. An unprivileged database user could create an object whose name includes a newline followed by an SQL command. This SQL command might then be executed by a privileged user during later restore of the backup dump, allowing privilege escalation. CREATE TRIGGER did not do a permissions check on the trigger function to be called. This could possibly allow an authenticated database user to call a privileged trigger function on data of their choosing.
Tags: database user sql relational-database-management relational-database-management-system database-management-system

17:21
Red Hat Security Advisory 2012-0677-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2012-0677-01 - PostgreSQL is an advanced object-relational database management system. The pg_dump utility inserted object names literally into comments in the SQL script it produces. An unprivileged database user could create an object whose name includes a newline followed by an SQL command. This SQL command might then be executed by a privileged user during later restore of the backup dump, allowing privilege escalation. CREATE TRIGGER did not do a permissions check on the trigger function to be called. This could possibly allow an authenticated database user to call a privileged trigger function on data of their choosing.
Tags: database user sql relational-database-management relational-database-management-system database-management-system

17:21
Red Hat Security Advisory 2012-0677-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2012-0677-01 - PostgreSQL is an advanced object-relational database management system. The pg_dump utility inserted object names literally into comments in the SQL script it produces. An unprivileged database user could create an object whose name includes a newline followed by an SQL command. This SQL command might then be executed by a privileged user during later restore of the backup dump, allowing privilege escalation. CREATE TRIGGER did not do a permissions check on the trigger function to be called. This could possibly allow an authenticated database user to call a privileged trigger function on data of their choosing.
Tags: database user sql relational-database-management relational-database-management-system database-management-system

May 05, 2012
18:30
Ubuntu Security Notice USN-1430-3
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 1430-3 - USN-1430-1 fixed vulnerabilities in Firefox. This update provides the corresponding fixes for Thunderbird. Bob Clary, Christian Holler, Brian Hackett, Bobby Holley, Gary Kwong, Hilary Hall, Honza Bambas, Jesse Ruderman, Julian Seward, and Olli Pettay discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. Aki Helin discovered a use-after-free vulnerability in XPConnect. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. Various other issues were also addressed.
Tags: user ubuntu firefox julian-seward hilary-hall gary-kwong christian-holler jesse-ruderman brian-hackett bob-clary memory-safety

18:30
Ubuntu Security Notice USN-1430-3
» ‎ Packet Storm Security Misc. Files

Ubuntu Security Notice 1430-3 - USN-1430-1 fixed vulnerabilities in Firefox. This update provides the corresponding fixes for Thunderbird. Bob Clary, Christian Holler, Brian Hackett, Bobby Holley, Gary Kwong, Hilary Hall, Honza Bambas, Jesse Ruderman, Julian Seward, and Olli Pettay discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. Aki Helin discovered a use-after-free vulnerability in XPConnect. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. Various other issues were also addressed.
Tags: user ubuntu firefox julian-seward hilary-hall gary-kwong christian-holler jesse-ruderman brian-hackett bob-clary memory-safety

May 01, 2012
14:34
Ubuntu Security Notice USN-1435-1
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 1435-1 - Joonas Kuorilehto and Aleksis Kauppinen discovered that ImageMagick incorrectly handled certain ResolutionUnit tags. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program. Joonas Kuorilehto and Aleksis Kauppinen discovered that ImageMagick incorrectly handled certain IFD structures. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service. Various other issues were also addressed.
Tags: imagemagick user ubuntu denial-of-service joonas automated-system

14:34
Ubuntu Security Notice USN-1435-1
» ‎ Packet Storm Security Recent Files

Ubuntu Security Notice 1435-1 - Joonas Kuorilehto and Aleksis Kauppinen discovered that ImageMagick incorrectly handled certain ResolutionUnit tags. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program. Joonas Kuorilehto and Aleksis Kauppinen discovered that ImageMagick incorrectly handled certain IFD structures. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service. Various other issues were also addressed.
Tags: imagemagick user ubuntu denial-of-service joonas automated-system

14:34
Ubuntu Security Notice USN-1435-1
» ‎ Packet Storm Security Misc. Files

Ubuntu Security Notice 1435-1 - Joonas Kuorilehto and Aleksis Kauppinen discovered that ImageMagick incorrectly handled certain ResolutionUnit tags. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program. Joonas Kuorilehto and Aleksis Kauppinen discovered that ImageMagick incorrectly handled certain IFD structures. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service. Various other issues were also addressed.
Tags: imagemagick user ubuntu denial-of-service joonas automated-system

April 27, 2012
13:16
Ubuntu Security Notice USN-1430-1
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 1430-1 - Bob Clary, Christian Holler, Brian Hackett, Bobby Holley, Gary Kwong, Hilary Hall, Honza Bambas, Jesse Ruderman, Julian Seward, and Olli Pettay discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. Aki Helin discovered a use-after-free vulnerability in XPConnect. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. Various other issues were also addressed.
Tags: user ubuntu firefox julian-seward hilary-hall gary-kwong christian-holler jesse-ruderman brian-hackett bob-clary memory-safety

13:16
Ubuntu Security Notice USN-1430-1
» ‎ Packet Storm Security Recent Files

Ubuntu Security Notice 1430-1 - Bob Clary, Christian Holler, Brian Hackett, Bobby Holley, Gary Kwong, Hilary Hall, Honza Bambas, Jesse Ruderman, Julian Seward, and Olli Pettay discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. Aki Helin discovered a use-after-free vulnerability in XPConnect. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. Various other issues were also addressed.
Tags: user ubuntu firefox julian-seward hilary-hall gary-kwong christian-holler jesse-ruderman brian-hackett bob-clary memory-safety

13:16
Ubuntu Security Notice USN-1430-1
» ‎ Packet Storm Security Misc. Files

Ubuntu Security Notice 1430-1 - Bob Clary, Christian Holler, Brian Hackett, Bobby Holley, Gary Kwong, Hilary Hall, Honza Bambas, Jesse Ruderman, Julian Seward, and Olli Pettay discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. Aki Helin discovered a use-after-free vulnerability in XPConnect. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. Various other issues were also addressed.
Tags: user ubuntu firefox julian-seward hilary-hall gary-kwong christian-holler jesse-ruderman brian-hackett bob-clary memory-safety

April 23, 2012
16:04
Asterisk Project Security Advisory - AST-2012-004
» ‎ Packet Storm Security Advisories

Asterisk Project Security Advisory - A user of the Asterisk Manager Interface can bypass a security check and execute shell commands when they lack permission to do so. Under normal conditions, a user should only be able to run shell commands if that user has System class authorization. Users could bypass this restriction by using the MixMonitor application with the originate action or by using either the GetVar or Status manager actions in combination with the SHELL and EVAL functions. The patch adds checks in each affected action to verify if a user has System class authorization. If the user does not have those authorizations, Asterisk rejects the action if it detects the use of any functions or applications that run system commands.
Tags: user security asterisk manager-interface shell-commands project-security

16:04
Asterisk Project Security Advisory - AST-2012-004
» ‎ Packet Storm Security Recent Files

Asterisk Project Security Advisory - A user of the Asterisk Manager Interface can bypass a security check and execute shell commands when they lack permission to do so. Under normal conditions, a user should only be able to run shell commands if that user has System class authorization. Users could bypass this restriction by using the MixMonitor application with the originate action or by using either the GetVar or Status manager actions in combination with the SHELL and EVAL functions. The patch adds checks in each affected action to verify if a user has System class authorization. If the user does not have those authorizations, Asterisk rejects the action if it detects the use of any functions or applications that run system commands.
Tags: user security asterisk manager-interface shell-commands project-security

16:04
Asterisk Project Security Advisory - AST-2012-004
» ‎ Packet Storm Security Misc. Files

Asterisk Project Security Advisory - A user of the Asterisk Manager Interface can bypass a security check and execute shell commands when they lack permission to do so. Under normal conditions, a user should only be able to run shell commands if that user has System class authorization. Users could bypass this restriction by using the MixMonitor application with the originate action or by using either the GetVar or Status manager actions in combination with the SHELL and EVAL functions. The patch adds checks in each affected action to verify if a user has System class authorization. If the user does not have those authorizations, Asterisk rejects the action if it detects the use of any functions or applications that run system commands.
Tags: user security asterisk manager-interface shell-commands project-security

13:00
Bugtraq: AST-2012-004: Asterisk Manager User Unauthorized Shell Access
» ‎ SecurityFocus Vulnerabilities

AST-2012-004: Asterisk Manager User Unauthorized Shell Access
Tags: manager asterisk user unauthorized-shell bugtraq ast

April 09, 2012
21:31
Zero Day Initiative Advisory 12-060
» ‎ Packet Storm Security Recent Files

Zero Day Initiative Advisory 12-060 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within cmm.dll. While parsing multi-function a to b curve data the size of an allocation is calculated based on user supplied data. It is possible to cause an integer wrap on the nTblSize variable. This variable is later used to allocate an heap buffer which will be smaller than necessary resulting in heap memory corruption. This can lead to remote code execution under the context of the current user.
Tags: day zero user heap-memory curve-data memory-corruption

21:31
Zero Day Initiative Advisory 12-060
» ‎ Packet Storm Security Misc. Files

Zero Day Initiative Advisory 12-060 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within cmm.dll. While parsing multi-function a to b curve data the size of an allocation is calculated based on user supplied data. It is possible to cause an integer wrap on the nTblSize variable. This variable is later used to allocate an heap buffer which will be smaller than necessary resulting in heap memory corruption. This can lead to remote code execution under the context of the current user.
Tags: day zero user heap-memory curve-data memory-corruption

8:00
Bugtraq: [CVE-2012-1574] Apache Hadoop user impersonation vulnerability
» ‎ SecurityFocus Vulnerabilities

[CVE-2012-1574] Apache Hadoop user impersonation vulnerability
Tags: user hadoop apache impersonation cve vulnerability

April 06, 2012
19:05
Apache Hadoop User Impersonation
» ‎ Packet Storm Security Advisories

Apache Hadoop suffers from a user impersonation vulnerability. Versions 0.20.203.0, 0.20.204.0, 0.20.205.0, 1.0.0 to 1.0.1, and 0.23.0 to 0.23.1 are affected.
Tags: hadoop apache user impersonation vulnerability

19:05
Apache Hadoop User Impersonation
» ‎ Packet Storm Security Misc. Files

Apache Hadoop suffers from a user impersonation vulnerability. Versions 0.20.203.0, 0.20.204.0, 0.20.205.0, 1.0.0 to 1.0.1, and 0.23.0 to 0.23.1 are affected.
Tags: hadoop apache user impersonation vulnerability

April 04, 2012
17:01
Ubuntu Security Notice USN-1416-1
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 1416-1 - Alexander Gavrun discovered that the TIFF library incorrectly allocated space for a tile. If a user or automated system were tricked into opening a specially crafted TIFF image, a remote attacker could execute arbitrary code with user privileges, or crash the application, leading to a denial of service. It was discovered that the tiffdump utility incorrectly handled directory data structures with many directory entries. If a user or automated system were tricked into opening a specially crafted TIFF image, a remote attacker could crash the application, leading to a denial of service, or possibly execute arbitrary code with user privileges. This issue only applied to Ubuntu 8.04 LTS, Ubuntu 10.04 LTS, Ubuntu 10.10 and Ubuntu 11.04. Various other issues were also addressed.
Tags: user ubuntu security alexander-gavrun tiff tiff-library tiff-image denial-of-service

March 26, 2012
13:38
Ricoh DC DL-10 SR10 FTP USER Command Buffer Overflow
» ‎ Packet Storm Security Exploits

This Metasploit module exploits a vulnerability found in Ricoh DC's DL-10 SR10 FTP service. By supplying a long string of data to the USER command, it is possible to trigger a stack-based buffer overflow, which allows remote code execution under the context of the user. Please note that in order to trigger the vulnerability, the server must be configured with a log file name (by default, it's disabled).
Tags: ricoh user ftp dc-dl- based-buffer-overflow code-execution

13:38
Ricoh DC DL-10 SR10 FTP USER Command Buffer Overflow
» ‎ Packet Storm Security Recent Files

This Metasploit module exploits a vulnerability found in Ricoh DC's DL-10 SR10 FTP service. By supplying a long string of data to the USER command, it is possible to trigger a stack-based buffer overflow, which allows remote code execution under the context of the user. Please note that in order to trigger the vulnerability, the server must be configured with a log file name (by default, it's disabled).
Tags: ricoh user ftp dc-dl- based-buffer-overflow code-execution

13:38
Ricoh DC DL-10 SR10 FTP USER Command Buffer Overflow
» ‎ Packet Storm Security Misc. Files

This Metasploit module exploits a vulnerability found in Ricoh DC's DL-10 SR10 FTP service. By supplying a long string of data to the USER command, it is possible to trigger a stack-based buffer overflow, which allows remote code execution under the context of the user. Please note that in order to trigger the vulnerability, the server must be configured with a log file name (by default, it's disabled).
Tags: ricoh user ftp dc-dl- based-buffer-overflow code-execution

March 23, 2012
16:38
Ubuntu Security Notice USN-1401-2
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 1401-2 - USN-1401-1 fixed vulnerabilities in Xulrunner. This update provides the corresponding fixes for Thunderbird. It was discovered that a flaw in the Mozilla SVG implementation could result in an out-of-bounds memory access if SVG elements were removed during a DOMAttrModified event handler. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash. Atte Kettunen discovered a use-after-free vulnerability in the Gecko Rendering Engine's handling of SVG animations. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking the Xulrunner based application. Atte Kettunen discovered an out of bounds read vulnerability in the Gecko Rendering Engine's handling of SVG Filters. An attacker could potentially exploit this to make data from the user's memory accessible to the page content. Soroush Dalili discovered that the Gecko Rendering Engine did not adequately protect against dropping JavaScript links onto a frame. A remote attacker could, through cross-site scripting (XSS), exploit this to modify the contents of the frame or steal confidential data. Mariusz Mlynski discovered that the Home button accepted JavaScript links to set the browser Home page. An attacker could use this vulnerability to get the script URL loaded in the privileged about:sessionrestore context. Bob Clary, Vincenzo Iozzo, and Willem Pinckaers discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. Various other issues were also addressed.
Tags: user attacker svg dalili bob-clary willem-pinckaers svg-animations application-crash memory-safety

16:38
Ubuntu Security Notice USN-1401-2
» ‎ Packet Storm Security Recent Files

Ubuntu Security Notice 1401-2 - USN-1401-1 fixed vulnerabilities in Xulrunner. This update provides the corresponding fixes for Thunderbird. It was discovered that a flaw in the Mozilla SVG implementation could result in an out-of-bounds memory access if SVG elements were removed during a DOMAttrModified event handler. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash. Atte Kettunen discovered a use-after-free vulnerability in the Gecko Rendering Engine's handling of SVG animations. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking the Xulrunner based application. Atte Kettunen discovered an out of bounds read vulnerability in the Gecko Rendering Engine's handling of SVG Filters. An attacker could potentially exploit this to make data from the user's memory accessible to the page content. Soroush Dalili discovered that the Gecko Rendering Engine did not adequately protect against dropping JavaScript links onto a frame. A remote attacker could, through cross-site scripting (XSS), exploit this to modify the contents of the frame or steal confidential data. Mariusz Mlynski discovered that the Home button accepted JavaScript links to set the browser Home page. An attacker could use this vulnerability to get the script URL loaded in the privileged about:sessionrestore context. Bob Clary, Vincenzo Iozzo, and Willem Pinckaers discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. Various other issues were also addressed.
Tags: user attacker svg dalili bob-clary willem-pinckaers svg-animations application-crash memory-safety

16:38
Ubuntu Security Notice USN-1401-2
» ‎ Packet Storm Security Misc. Files

Ubuntu Security Notice 1401-2 - USN-1401-1 fixed vulnerabilities in Xulrunner. This update provides the corresponding fixes for Thunderbird. It was discovered that a flaw in the Mozilla SVG implementation could result in an out-of-bounds memory access if SVG elements were removed during a DOMAttrModified event handler. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash. Atte Kettunen discovered a use-after-free vulnerability in the Gecko Rendering Engine's handling of SVG animations. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking the Xulrunner based application. Atte Kettunen discovered an out of bounds read vulnerability in the Gecko Rendering Engine's handling of SVG Filters. An attacker could potentially exploit this to make data from the user's memory accessible to the page content. Soroush Dalili discovered that the Gecko Rendering Engine did not adequately protect against dropping JavaScript links onto a frame. A remote attacker could, through cross-site scripting (XSS), exploit this to modify the contents of the frame or steal confidential data. Mariusz Mlynski discovered that the Home button accepted JavaScript links to set the browser Home page. An attacker could use this vulnerability to get the script URL loaded in the privileged about:sessionrestore context. Bob Clary, Vincenzo Iozzo, and Willem Pinckaers discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. Various other issues were also addressed.
Tags: user attacker svg dalili bob-clary willem-pinckaers svg-animations application-crash memory-safety

March 22, 2012
23:10
Ubuntu Security Notice USN-1403-1
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 1403-1 - Mateusz Jurczyk discovered that FreeType did not correctly handle certain malformed BDF font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash. Mateusz Jurczyk discovered that FreeType did not correctly handle certain malformed BDF font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash. Mateusz Jurczyk discovered that FreeType did not correctly handle certain malformed TrueType font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash. Various other issues were also addressed.
Tags: user font freetype mateusz-jurczyk truetype-font-files bdf-font mateusz

23:10
Ubuntu Security Notice USN-1403-1
» ‎ Packet Storm Security Recent Files

Ubuntu Security Notice 1403-1 - Mateusz Jurczyk discovered that FreeType did not correctly handle certain malformed BDF font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash. Mateusz Jurczyk discovered that FreeType did not correctly handle certain malformed BDF font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash. Mateusz Jurczyk discovered that FreeType did not correctly handle certain malformed TrueType font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash. Various other issues were also addressed.
Tags: user font freetype mateusz-jurczyk truetype-font-files bdf-font mateusz

23:10
Ubuntu Security Notice USN-1403-1
» ‎ Packet Storm Security Misc. Files

Ubuntu Security Notice 1403-1 - Mateusz Jurczyk discovered that FreeType did not correctly handle certain malformed BDF font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash. Mateusz Jurczyk discovered that FreeType did not correctly handle certain malformed BDF font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash. Mateusz Jurczyk discovered that FreeType did not correctly handle certain malformed TrueType font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash. Various other issues were also addressed.
Tags: user font freetype mateusz-jurczyk truetype-font-files bdf-font mateusz

March 19, 2012
15:21
Ubuntu Security Notice USN-1401-1
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 1401-1 - It was discovered that a flaw in the Mozilla SVG implementation could result in an out-of-bounds memory access if SVG elements were removed during a DOMAttrModified event handler. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash. Atte Kettunen discovered a use-after-free vulnerability in the Gecko Rendering Engine's handling of SVG animations. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking the Xulrunner based application. Atte Kettunen discovered an out of bounds read vulnerability in the Gecko Rendering Engine's handling of SVG Filters. An attacker could potentially exploit this to make data from the user's memory accessible to the page content. Various other issues were also addressed.
Tags: user attacker svg svg-animations application-crash denial-of-service

15:21
Ubuntu Security Notice USN-1401-1
» ‎ Packet Storm Security Recent Files

Ubuntu Security Notice 1401-1 - It was discovered that a flaw in the Mozilla SVG implementation could result in an out-of-bounds memory access if SVG elements were removed during a DOMAttrModified event handler. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash. Atte Kettunen discovered a use-after-free vulnerability in the Gecko Rendering Engine's handling of SVG animations. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking the Xulrunner based application. Atte Kettunen discovered an out of bounds read vulnerability in the Gecko Rendering Engine's handling of SVG Filters. An attacker could potentially exploit this to make data from the user's memory accessible to the page content. Various other issues were also addressed.
Tags: user attacker svg svg-animations application-crash denial-of-service

15:21
Ubuntu Security Notice USN-1401-1
» ‎ Packet Storm Security Misc. Files

Ubuntu Security Notice 1401-1 - It was discovered that a flaw in the Mozilla SVG implementation could result in an out-of-bounds memory access if SVG elements were removed during a DOMAttrModified event handler. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash. Atte Kettunen discovered a use-after-free vulnerability in the Gecko Rendering Engine's handling of SVG animations. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking the Xulrunner based application. Atte Kettunen discovered an out of bounds read vulnerability in the Gecko Rendering Engine's handling of SVG Filters. An attacker could potentially exploit this to make data from the user's memory accessible to the page content. Various other issues were also addressed.
Tags: user attacker svg svg-animations application-crash denial-of-service

March 18, 2012
13:19
[Slides] Rootkits in your Web application
» ‎ SecDocs

Authors: Artur Janc
Tags: web application XSS
Event: Chaos Communication Congress 28th (28C3) 2011
Abstract: XSS bugs are the most widely known and commonly occurring Web vulnerability, but their impact has often been limited to cookie theft and/or simple actions, such as setting malicious email filters, stealing some data, or self-propagation via an XSS worm. In this work, I discuss practical approaches for exploiting XSS and other client-side script injection attacks, and introduce novel techniques for maintaining and escalating access within the victim's browser. In particular, I introduce the concept of resident XSS where attacker-supplied code is running in the context of an affected user's main application window and describe its consequences. I also draw analogies between such persistent Web threats and the traditional rootkit model, including similarities in the areas of embedding malicious code, maintaining access, stealthy communication with a C&C server, and the difficulty of detecting and removing attacker-supplied code. Despite a few high profile cases of XSS worms, most XSS exploitation attempts have so far been limited to cookie-stealing and executing simple malicious actions. However, as a consequence of the same-origin policy and a combination of other browser mechanisms, a single XSS vulnerability can often lead to a long-term compromise all of a user's interactions with an affected webapp in the same browser profile, long after the original bug has been fixed. In particular, an attacker can maintain access across window/browser closures, survive cookie and cache deletions, and compromise other user accounts accessed from the same browser. Yet more troubling is the fact that Web application authors currently have no means to detect or mitigate such threats once an attack has taken place. In the talk I provide an overview of techniques to escalate an XSS into long-term account compromise, and explore the similarities between such persistent Web bugs and traditional rootkits. In particular, I: 1) Introduce the concept of resident XSS, where malicious JavaScript is executed in the context of the victim's main application window/tab. Contrary to the traditional methods of exploiting XSS via a hidden frame or malicious link which are opened in a separate, usually short-lived window, resident XSS gives an attacker full freedom to monitor and alter the user's interaction with the affected application. 2) Describe several techniques to convert various Web bugs into a resident XSS. Such techniques include backdooring client-side persistent storage mechanisms (WebSQL, localStorage, Flash LSOs), opening poisoned application windows with injected malicious scripts, exploiting persistent (self-)XSS and others. 3) Discuss the consequences of resident XSS, which usually allow the attacker to get permanent access to an affected user's account and/or obtain the user's application login credentials. On sensitive domains for which users have enabled access to additional browser or plugin features (geolocation, camera/microphone), it can enable persistent snooping on the exploited user. In a large number of cases it can also enable full compromise of the user's machine by exploiting the application-user trust relationship (e.g. by requiring the user to install attacker-supplied plugins to use the affected webapp, or by hijacking file download links within the vulnerable domain). 4) Analyze the techniques for maintaining access to a once-compromised origin. In addition to backdooring persistent storage APIs, this can be achieved by exploiting self-XSS bugs, spawning same-origin pop-unders with references to the original window, and hiding in frames created by advertising networks on popular websites. In most cases, a combination of those techniques suffices to bypass a variety of the most common "cleanup" actions taken by users, and allows an on-going compromise of the affected origin. 5) Present the difficulties faced by Web application authors when trying to clean up a compromised origin. Short of wiping/re-creating a browser profile, there are currently no fully reliable methods to restore a browser's state to a secure configuration once a malicious script has run in the context of an affected domain. I will present the above with concrete examples of vulnerable applications and a demo.
Tags: xss user application artur-janc chaos-communication-congress application-authors novel-techniques

March 15, 2012
20:09
lshell 0.9.15.1
» ‎ Packet Storm Security Recent Files

lshell lets you restrict a user's shell environment to limited sets of commands, choose to enable or disable any command over SSH (e.g. SCP, SFTP, rsync, etc.), log user's commands, implement timing restrictions, and more.
Tags: user shell lshell shell-environment

20:09
lshell 0.9.15.1
» ‎ Packet Storm Security Tools

lshell lets you restrict a user's shell environment to limited sets of commands, choose to enable or disable any command over SSH (e.g. SCP, SFTP, rsync, etc.), log user's commands, implement timing restrictions, and more.
Tags: user shell lshell shell-environment

20:09
lshell 0.9.15.1
» ‎ Packet Storm Security Misc. Files

lshell lets you restrict a user's shell environment to limited sets of commands, choose to enable or disable any command over SSH (e.g. SCP, SFTP, rsync, etc.), log user's commands, implement timing restrictions, and more.
Tags: user shell lshell shell-environment

March 14, 2012
20:06
lshell 0.9.15
» ‎ Packet Storm Security Recent Files

lshell lets you restrict a user's shell environment to limited sets of commands, choose to enable or disable any command over SSH (e.g. SCP, SFTP, rsync, etc.), log user's commands, implement timing restrictions, and more.
Tags: user shell lshell shell-environment

20:06
lshell 0.9.15
» ‎ Packet Storm Security Tools

lshell lets you restrict a user's shell environment to limited sets of commands, choose to enable or disable any command over SSH (e.g. SCP, SFTP, rsync, etc.), log user's commands, implement timing restrictions, and more.
Tags: user shell lshell shell-environment

20:06
lshell 0.9.15
» ‎ Packet Storm Security Misc. Files

lshell lets you restrict a user's shell environment to limited sets of commands, choose to enable or disable any command over SSH (e.g. SCP, SFTP, rsync, etc.), log user's commands, implement timing restrictions, and more.
Tags: user shell lshell shell-environment

March 12, 2012
15:00
[linux/x86-64] - linux/x86-64 - add user with passwd (189 bytes)
» ‎ 1337day (was: Inj3ct0r, 1337db)

[linux/x86-64] - linux/x86-64 - add user with passwd (189 bytes)
Tags: user linux passwd

10:11
Add User With Password Shellcode
» ‎ Packet Storm Security Recent Files

189 bytes small add user t0r with password of Winner shellcode for Linux x86_64.
Tags: shellcode password user linux

10:11
Add User With Password Shellcode
» ‎ Packet Storm Security Misc. Files

189 bytes small add user t0r with password of Winner shellcode for Linux x86_64.
Tags: shellcode password user linux

March 11, 2012
4:11
WordPress 3.3.1 User Count Enumeration
» ‎ Packet Storm Security Exploits

WordPress version 3.3.1 suffers from a user count enumeration vulnerability.
Tags: enumeration wordpress user vulnerability

4:11
WordPress 3.3.1 User Count Enumeration
» ‎ Packet Storm Security Recent Files

WordPress version 3.3.1 suffers from a user count enumeration vulnerability.
Tags: enumeration wordpress user vulnerability

4:11
WordPress 3.3.1 User Count Enumeration
» ‎ Packet Storm Security Misc. Files

WordPress version 3.3.1 suffers from a user count enumeration vulnerability.
Tags: enumeration wordpress user vulnerability

March 08, 2012
0:00
Vuln: Samba SWAT 'user' Field Cross Site Scripting Vulnerability
» ‎ SecurityFocus Vulnerabilities

Samba SWAT 'user' Field Cross Site Scripting Vulnerability
Tags: user swat samba samba-swat cross-site-scripting vulnerability

March 06, 2012
16:00
Ubuntu Security Notice USN-1389-1
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 1389-1 - Paolo Bonzini discovered a flaw in Linux's handling of the SG_IO ioctl command. A local user, or user in a VM could exploit this flaw to bypass restrictions and gain read/write access to all data on the affected block device. Sasha Levin discovered a flaw in the permission checking for device assignments requested via the kvm ioctl in the Linux kernel. A local user could use this flaw to crash the system causing a denial of service. Various other issues were also addressed.
Tags: user ubuntu flaw paolo-bonzini linux-kernel bonzini denial-of-service

16:00
Ubuntu Security Notice USN-1389-1
» ‎ Packet Storm Security Recent Files

Ubuntu Security Notice 1389-1 - Paolo Bonzini discovered a flaw in Linux's handling of the SG_IO ioctl command. A local user, or user in a VM could exploit this flaw to bypass restrictions and gain read/write access to all data on the affected block device. Sasha Levin discovered a flaw in the permission checking for device assignments requested via the kvm ioctl in the Linux kernel. A local user could use this flaw to crash the system causing a denial of service. Various other issues were also addressed.
Tags: user ubuntu flaw paolo-bonzini linux-kernel bonzini denial-of-service

16:00
Ubuntu Security Notice USN-1389-1
» ‎ Packet Storm Security Misc. Files

Ubuntu Security Notice 1389-1 - Paolo Bonzini discovered a flaw in Linux's handling of the SG_IO ioctl command. A local user, or user in a VM could exploit this flaw to bypass restrictions and gain read/write access to all data on the affected block device. Sasha Levin discovered a flaw in the permission checking for device assignments requested via the kvm ioctl in the Linux kernel. A local user could use this flaw to crash the system causing a denial of service. Various other issues were also addressed.
Tags: user ubuntu flaw paolo-bonzini linux-kernel bonzini denial-of-service

15:58
Ubuntu Security Notice USN-1388-1
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 1388-1 - Paolo Bonzini discovered a flaw in Linux's handling of the SG_IO ioctl command. A local user, or user in a VM could exploit this flaw to bypass restrictions and gain read/write access to all data on the affected block device. A flaw was found in KVM's Programmable Interval Timer (PIT). When a virtual interrupt control is not available a local user could use this to cause a denial of service by starting a timer. Various other issues were also addressed.
Tags: user ubuntu flaw paolo-bonzini programmable-interval-timer bonzini denial-of-service

15:58
Ubuntu Security Notice USN-1388-1
» ‎ Packet Storm Security Recent Files

Ubuntu Security Notice 1388-1 - Paolo Bonzini discovered a flaw in Linux's handling of the SG_IO ioctl command. A local user, or user in a VM could exploit this flaw to bypass restrictions and gain read/write access to all data on the affected block device. A flaw was found in KVM's Programmable Interval Timer (PIT). When a virtual interrupt control is not available a local user could use this to cause a denial of service by starting a timer. Various other issues were also addressed.
Tags: user ubuntu flaw paolo-bonzini programmable-interval-timer bonzini denial-of-service

15:58
Ubuntu Security Notice USN-1388-1
» ‎ Packet Storm Security Misc. Files

Ubuntu Security Notice 1388-1 - Paolo Bonzini discovered a flaw in Linux's handling of the SG_IO ioctl command. A local user, or user in a VM could exploit this flaw to bypass restrictions and gain read/write access to all data on the affected block device. A flaw was found in KVM's Programmable Interval Timer (PIT). When a virtual interrupt control is not available a local user could use this to cause a denial of service by starting a timer. Various other issues were also addressed.
Tags: user ubuntu flaw paolo-bonzini programmable-interval-timer bonzini denial-of-service

15:58
Ubuntu Security Notice USN-1387-1
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 1387-1 - Aristide Fattori and Roberto Paleari reported a flaw in the Linux kernel's handling of IPv4 icmp packets. A remote user could exploit this to cause a denial of service. A flaw was found in the Linux Ethernet bridge's handling of IGMP (Internet Group Management Protocol) packets. An unprivileged local user could exploit this flaw to crash the system. Han-Wen Nienhuys reported a flaw in the FUSE kernel module. A local user who can mount a FUSE file system could cause a denial of service. Various other issues were also addressed.
Tags: user ubuntu flaw wen-nienhuys aristide-fattori roberto-paleari internet-group-management-protocol internet-group-management protocol-packets

15:58
Ubuntu Security Notice USN-1387-1
» ‎ Packet Storm Security Recent Files

Ubuntu Security Notice 1387-1 - Aristide Fattori and Roberto Paleari reported a flaw in the Linux kernel's handling of IPv4 icmp packets. A remote user could exploit this to cause a denial of service. A flaw was found in the Linux Ethernet bridge's handling of IGMP (Internet Group Management Protocol) packets. An unprivileged local user could exploit this flaw to crash the system. Han-Wen Nienhuys reported a flaw in the FUSE kernel module. A local user who can mount a FUSE file system could cause a denial of service. Various other issues were also addressed.
Tags: user ubuntu flaw wen-nienhuys aristide-fattori roberto-paleari internet-group-management-protocol internet-group-management protocol-packets

15:58
Ubuntu Security Notice USN-1387-1
» ‎ Packet Storm Security Misc. Files

Ubuntu Security Notice 1387-1 - Aristide Fattori and Roberto Paleari reported a flaw in the Linux kernel's handling of IPv4 icmp packets. A remote user could exploit this to cause a denial of service. A flaw was found in the Linux Ethernet bridge's handling of IGMP (Internet Group Management Protocol) packets. An unprivileged local user could exploit this flaw to crash the system. Han-Wen Nienhuys reported a flaw in the FUSE kernel module. A local user who can mount a FUSE file system could cause a denial of service. Various other issues were also addressed.
Tags: user ubuntu flaw wen-nienhuys aristide-fattori roberto-paleari internet-group-management-protocol internet-group-management protocol-packets

15:58
Ubuntu Security Notice USN-1384-1
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 1384-1 - A bug was discovered in the Linux kernel's calculation of OOM (Out of memory) scores, that would result in the wrong process being killed. A user could use this to kill the process with the highest OOM score, even if that process belongs to another user or the system. Paolo Bonzini discovered a flaw in Linux's handling of the SG_IO ioctl command. A local user, or user in a VM could exploit this flaw to bypass restrictions and gain read/write access to all data on the affected block device. Various other issues were also addressed.
Tags: user ubuntu process paolo-bonzini linux-kernel ioctl security-notice

15:58
Ubuntu Security Notice USN-1384-1
» ‎ Packet Storm Security Recent Files

Ubuntu Security Notice 1384-1 - A bug was discovered in the Linux kernel's calculation of OOM (Out of memory) scores, that would result in the wrong process being killed. A user could use this to kill the process with the highest OOM score, even if that process belongs to another user or the system. Paolo Bonzini discovered a flaw in Linux's handling of the SG_IO ioctl command. A local user, or user in a VM could exploit this flaw to bypass restrictions and gain read/write access to all data on the affected block device. Various other issues were also addressed.
Tags: user ubuntu process paolo-bonzini linux-kernel ioctl security-notice

15:58
Ubuntu Security Notice USN-1384-1
» ‎ Packet Storm Security Misc. Files

Ubuntu Security Notice 1384-1 - A bug was discovered in the Linux kernel's calculation of OOM (Out of memory) scores, that would result in the wrong process being killed. A user could use this to kill the process with the highest OOM score, even if that process belongs to another user or the system. Paolo Bonzini discovered a flaw in Linux's handling of the SG_IO ioctl command. A local user, or user in a VM could exploit this flaw to bypass restrictions and gain read/write access to all data on the affected block device. Various other issues were also addressed.
Tags: user ubuntu process paolo-bonzini linux-kernel ioctl security-notice

March 01, 2012
0:00
Vuln: Kadu SMS and User Status Message Multiple HTML Injection Vulnerabilities
» ‎ SecurityFocus Vulnerabilities

Kadu SMS and User Status Message Multiple HTML Injection Vulnerabilities
Tags: sms kadu user status-message

February 23, 2012
19:48
Red Hat Security Advisory 2012-0333-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2012-0333-01 - Updates have been made to the Linux kernel. SG_IO ioctl SCSI requests on partitions or LVM volumes could be passed to the underlying block device, allowing a privileged user to bypass restrictions and gain read and write access to the entire block device. A local, unprivileged user could use an integer overflow flaw in drm_mode_dirtyfb_ioctl() to cause a denial of service or escalate their privileges. A local, unprivileged user could use an integer overflow flaw in drm_mode_dirtyfb_ioctl() to cause a denial of service or escalate their privileges. A local, unprivileged user could use a flaw in the Performance Events implementation to cause a denial of service. Various other issues have also been addressed.
Tags: user ioctl flaw integer-overflow red-hat-security linux-kernel

19:48
Red Hat Security Advisory 2012-0333-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2012-0333-01 - Updates have been made to the Linux kernel. SG_IO ioctl SCSI requests on partitions or LVM volumes could be passed to the underlying block device, allowing a privileged user to bypass restrictions and gain read and write access to the entire block device. A local, unprivileged user could use an integer overflow flaw in drm_mode_dirtyfb_ioctl() to cause a denial of service or escalate their privileges. A local, unprivileged user could use an integer overflow flaw in drm_mode_dirtyfb_ioctl() to cause a denial of service or escalate their privileges. A local, unprivileged user could use a flaw in the Performance Events implementation to cause a denial of service. Various other issues have also been addressed.
Tags: user ioctl flaw integer-overflow red-hat-security linux-kernel

19:48
Red Hat Security Advisory 2012-0333-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2012-0333-01 - Updates have been made to the Linux kernel. SG_IO ioctl SCSI requests on partitions or LVM volumes could be passed to the underlying block device, allowing a privileged user to bypass restrictions and gain read and write access to the entire block device. A local, unprivileged user could use an integer overflow flaw in drm_mode_dirtyfb_ioctl() to cause a denial of service or escalate their privileges. A local, unprivileged user could use an integer overflow flaw in drm_mode_dirtyfb_ioctl() to cause a denial of service or escalate their privileges. A local, unprivileged user could use a flaw in the Performance Events implementation to cause a denial of service. Various other issues have also been addressed.
Tags: user ioctl flaw integer-overflow red-hat-security linux-kernel

February 22, 2012
21:22
Zero Day Initiative Advisory 12-038
» ‎ Packet Storm Security Advisories

Zero Day Initiative Advisory 12-038 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within JavaFX, a downloadable Java extension. The JavaFX Jar file is signed by Oracle and can be installed without user interaction. Once installed it is possible to invoke the main method of any trusted class with arbitrary arguments and with a trusted call stack. This can be leveraged to remote code execution under the context of the user.
Tags: day zero user oracle-java code-execution java-extension

21:22
Zero Day Initiative Advisory 12-038
» ‎ Packet Storm Security Recent Files

Zero Day Initiative Advisory 12-038 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within JavaFX, a downloadable Java extension. The JavaFX Jar file is signed by Oracle and can be installed without user interaction. Once installed it is possible to invoke the main method of any trusted class with arbitrary arguments and with a trusted call stack. This can be leveraged to remote code execution under the context of the user.
Tags: day zero user oracle-java code-execution java-extension

21:22
Zero Day Initiative Advisory 12-038
» ‎ Packet Storm Security Misc. Files

Zero Day Initiative Advisory 12-038 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within JavaFX, a downloadable Java extension. The JavaFX Jar file is signed by Oracle and can be installed without user interaction. Once installed it is possible to invoke the main method of any trusted class with arbitrary arguments and with a trusted call stack. This can be leveraged to remote code execution under the context of the user.
Tags: day zero user oracle-java code-execution java-extension

February 21, 2012
7:30
Red Hat Security Advisory 2012-0303-03
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2012-0303-03 - X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. A flaw was found in the way the X.Org server handled lock files. A local user with access to the system console could use this flaw to determine the existence of a file in a directory not accessible to the user, via a symbolic link attack.
Tags: user hat red x.org x-window open-source-implementation graphical-user-interfaces x-window-system

7:30
Red Hat Security Advisory 2012-0303-03
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2012-0303-03 - X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. A flaw was found in the way the X.Org server handled lock files. A local user with access to the system console could use this flaw to determine the existence of a file in a directory not accessible to the user, via a symbolic link attack.
Tags: user hat red x.org x-window open-source-implementation graphical-user-interfaces x-window-system

February 17, 2012
19:05
Ubuntu Security Notice USN-1369-1
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 1369-1 - Nicolas Gregoire and Aki Helin discovered that when processing a malformed embedded XSLT stylesheet, Thunderbird can crash due to memory corruption. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Thunderbird. It was discovered that memory corruption could occur during the decoding of Ogg Vorbis files. If the user were tricked into opening a specially crafted file, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Thunderbird. Various other issues were also addressed.
Tags: user ubuntu thunderbird nicolas-gregoire memory-corruption xslt-stylesheet

19:05
Ubuntu Security Notice USN-1369-1
» ‎ Packet Storm Security Recent Files

Ubuntu Security Notice 1369-1 - Nicolas Gregoire and Aki Helin discovered that when processing a malformed embedded XSLT stylesheet, Thunderbird can crash due to memory corruption. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Thunderbird. It was discovered that memory corruption could occur during the decoding of Ogg Vorbis files. If the user were tricked into opening a specially crafted file, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Thunderbird. Various other issues were also addressed.
Tags: user ubuntu thunderbird nicolas-gregoire memory-corruption xslt-stylesheet

19:05
Ubuntu Security Notice USN-1369-1
» ‎ Packet Storm Security Misc. Files

Ubuntu Security Notice 1369-1 - Nicolas Gregoire and Aki Helin discovered that when processing a malformed embedded XSLT stylesheet, Thunderbird can crash due to memory corruption. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Thunderbird. It was discovered that memory corruption could occur during the decoding of Ogg Vorbis files. If the user were tricked into opening a specially crafted file, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Thunderbird. Various other issues were also addressed.
Tags: user ubuntu thunderbird nicolas-gregoire memory-corruption xslt-stylesheet

February 13, 2012
13:10
Ubuntu Security Notice USN-1363-1
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 1363-1 - A flaw was found in KVM's Programmable Interval Timer (PIT). When a virtual interrupt control is not available a local user could use this to cause a denial of service by starting a timer. A flaw was discovered in the XFS filesystem. If a local user mounts a specially crafted XFS image it could potential execute arbitrary code on the system. Andy Whitcroft discovered a that the Overlayfs filesystem was not doing the extended permission checks needed by cgroups and Linux Security Modules (LSMs). A local user could exploit this to by-pass security policy and access files that should not be accessible. Various other issues were also addressed.
Tags: user ubuntu security andy-whitcroft programmable-interval-timer permission-checks security-modules

13:10
Ubuntu Security Notice USN-1363-1
» ‎ Packet Storm Security Recent Files

Ubuntu Security Notice 1363-1 - A flaw was found in KVM's Programmable Interval Timer (PIT). When a virtual interrupt control is not available a local user could use this to cause a denial of service by starting a timer. A flaw was discovered in the XFS filesystem. If a local user mounts a specially crafted XFS image it could potential execute arbitrary code on the system. Andy Whitcroft discovered a that the Overlayfs filesystem was not doing the extended permission checks needed by cgroups and Linux Security Modules (LSMs). A local user could exploit this to by-pass security policy and access files that should not be accessible. Various other issues were also addressed.
Tags: user ubuntu security andy-whitcroft programmable-interval-timer permission-checks security-modules

13:10
Ubuntu Security Notice USN-1363-1
» ‎ Packet Storm Security Misc. Files

Ubuntu Security Notice 1363-1 - A flaw was found in KVM's Programmable Interval Timer (PIT). When a virtual interrupt control is not available a local user could use this to cause a denial of service by starting a timer. A flaw was discovered in the XFS filesystem. If a local user mounts a specially crafted XFS image it could potential execute arbitrary code on the system. Andy Whitcroft discovered a that the Overlayfs filesystem was not doing the extended permission checks needed by cgroups and Linux Security Modules (LSMs). A local user could exploit this to by-pass security policy and access files that should not be accessible. Various other issues were also addressed.
Tags: user ubuntu security andy-whitcroft programmable-interval-timer permission-checks security-modules

13:09
Ubuntu Security Notice USN-1362-1
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 1362-1 - Han-Wen Nienhuys reported a flaw in the FUSE kernel module. A local user who can mount a FUSE file system could cause a denial of service. A flaw was found in KVM's Programmable Interval Timer (PIT). When a virtual interrupt control is not available a local user could use this to cause a denial of service by starting a timer. A flaw was discovered in the XFS filesystem. If a local user mounts a specially crafted XFS image it could potential execute arbitrary code on the system. Various other issues were also addressed.
Tags: user ubuntu flaw wen-nienhuys programmable-interval-timer kernel-module denial-of-service

13:09
Ubuntu Security Notice USN-1362-1
» ‎ Packet Storm Security Recent Files

Ubuntu Security Notice 1362-1 - Han-Wen Nienhuys reported a flaw in the FUSE kernel module. A local user who can mount a FUSE file system could cause a denial of service. A flaw was found in KVM's Programmable Interval Timer (PIT). When a virtual interrupt control is not available a local user could use this to cause a denial of service by starting a timer. A flaw was discovered in the XFS filesystem. If a local user mounts a specially crafted XFS image it could potential execute arbitrary code on the system. Various other issues were also addressed.
Tags: user ubuntu flaw wen-nienhuys programmable-interval-timer kernel-module denial-of-service

13:09
Ubuntu Security Notice USN-1362-1
» ‎ Packet Storm Security Misc. Files

Ubuntu Security Notice 1362-1 - Han-Wen Nienhuys reported a flaw in the FUSE kernel module. A local user who can mount a FUSE file system could cause a denial of service. A flaw was found in KVM's Programmable Interval Timer (PIT). When a virtual interrupt control is not available a local user could use this to cause a denial of service by starting a timer. A flaw was discovered in the XFS filesystem. If a local user mounts a specially crafted XFS image it could potential execute arbitrary code on the system. Various other issues were also addressed.
Tags: user ubuntu flaw wen-nienhuys programmable-interval-timer kernel-module denial-of-service

13:09
Ubuntu Security Notice USN-1361-1
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 1361-1 - Han-Wen Nienhuys reported a flaw in the FUSE kernel module. A local user who can mount a FUSE file system could cause a denial of service. A flaw was found in KVM's Programmable Interval Timer (PIT). When a virtual interrupt control is not available a local user could use this to cause a denial of service by starting a timer. A flaw was discovered in the XFS filesystem. If a local user mounts a specially crafted XFS image it could potential execute arbitrary code on the system. Various other issues were also addressed.
Tags: user ubuntu flaw wen-nienhuys programmable-interval-timer kernel-module denial-of-service

13:09
Ubuntu Security Notice USN-1361-1
» ‎ Packet Storm Security Recent Files

Ubuntu Security Notice 1361-1 - Han-Wen Nienhuys reported a flaw in the FUSE kernel module. A local user who can mount a FUSE file system could cause a denial of service. A flaw was found in KVM's Programmable Interval Timer (PIT). When a virtual interrupt control is not available a local user could use this to cause a denial of service by starting a timer. A flaw was discovered in the XFS filesystem. If a local user mounts a specially crafted XFS image it could potential execute arbitrary code on the system. Various other issues were also addressed.
Tags: user ubuntu flaw wen-nienhuys programmable-interval-timer kernel-module denial-of-service

13:09
Ubuntu Security Notice USN-1361-1
» ‎ Packet Storm Security Misc. Files

Ubuntu Security Notice 1361-1 - Han-Wen Nienhuys reported a flaw in the FUSE kernel module. A local user who can mount a FUSE file system could cause a denial of service. A flaw was found in KVM's Programmable Interval Timer (PIT). When a virtual interrupt control is not available a local user could use this to cause a denial of service by starting a timer. A flaw was discovered in the XFS filesystem. If a local user mounts a specially crafted XFS image it could potential execute arbitrary code on the system. Various other issues were also addressed.
Tags: user ubuntu flaw wen-nienhuys programmable-interval-timer kernel-module denial-of-service

February 08, 2012
8:15
Ubuntu Security Notice USN-1350-1
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 1350-1 - Jesse Ruderman and Bob Clary discovered memory safety issues affecting Thunderbird. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Thunderbird. It was discovered that Thunderbird did not properly handle node removal in the DOM. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Thunderbird. Various other issues were also addressed.
Tags: user ubuntu thunderbird jesse-ruderman dom bob-clary application-crash memory-safety denial-of-service

8:15
Ubuntu Security Notice USN-1350-1
» ‎ Packet Storm Security Recent Files

Ubuntu Security Notice 1350-1 - Jesse Ruderman and Bob Clary discovered memory safety issues affecting Thunderbird. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Thunderbird. It was discovered that Thunderbird did not properly handle node removal in the DOM. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Thunderbird. Various other issues were also addressed.
Tags: user ubuntu thunderbird jesse-ruderman dom bob-clary application-crash memory-safety denial-of-service

8:15
Ubuntu Security Notice USN-1350-1
» ‎ Packet Storm Security Misc. Files

Ubuntu Security Notice 1350-1 - Jesse Ruderman and Bob Clary discovered memory safety issues affecting Thunderbird. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Thunderbird. It was discovered that Thunderbird did not properly handle node removal in the DOM. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Thunderbird. Various other issues were also addressed.
Tags: user ubuntu thunderbird jesse-ruderman dom bob-clary application-crash memory-safety denial-of-service

8:15
Ubuntu Security Notice USN-1353-1
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 1353-1 - Jesse Ruderman and Bob Clary discovered memory safety issues affecting the Gecko Browser engine. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Xulrunner. It was discovered that the Gecko Browser engine did not properly handle node removal in the DOM. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Xulrunner. Various other issues were also addressed.
Tags: user ubuntu security jesse-ruderman dom bob-clary application-crash memory-safety browser-engine

8:15
Ubuntu Security Notice USN-1353-1
» ‎ Packet Storm Security Recent Files

Ubuntu Security Notice 1353-1 - Jesse Ruderman and Bob Clary discovered memory safety issues affecting the Gecko Browser engine. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Xulrunner. It was discovered that the Gecko Browser engine did not properly handle node removal in the DOM. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Xulrunner. Various other issues were also addressed.
Tags: user ubuntu security jesse-ruderman dom bob-clary application-crash memory-safety browser-engine

8:15
Ubuntu Security Notice USN-1353-1
» ‎ Packet Storm Security Misc. Files

Ubuntu Security Notice 1353-1 - Jesse Ruderman and Bob Clary discovered memory safety issues affecting the Gecko Browser engine. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Xulrunner. It was discovered that the Gecko Browser engine did not properly handle node removal in the DOM. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Xulrunner. Various other issues were also addressed.
Tags: user ubuntu security jesse-ruderman dom bob-clary application-crash memory-safety browser-engine

February 06, 2012
16:13
Red Hat Security Advisory 2012-0101-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2012-0101-01 - Red Hat Network Satellite is a systems management tool for Linux-based infrastructures. It allows for provisioning, monitoring, and remote management of multiple Linux deployments with a single, centralized tool. If a user submitted a system registration XML-RPC call to an RHN Satellite server and that call failed, their RHN user password was included in plain text in the error messages both stored in the server log and mailed to the server administrator. With this update, user passwords are excluded from these error messages to avoid the exposure of authentication credentials.
Tags: user hat red red-hat-network linux-deployments authentication-credentials

16:13
Red Hat Security Advisory 2012-0101-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2012-0101-01 - Red Hat Network Satellite is a systems management tool for Linux-based infrastructures. It allows for provisioning, monitoring, and remote management of multiple Linux deployments with a single, centralized tool. If a user submitted a system registration XML-RPC call to an RHN Satellite server and that call failed, their RHN user password was included in plain text in the error messages both stored in the server log and mailed to the server administrator. With this update, user passwords are excluded from these error messages to avoid the exposure of authentication credentials.
Tags: user hat red red-hat-network linux-deployments authentication-credentials

16:13
Red Hat Security Advisory 2012-0101-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2012-0101-01 - Red Hat Network Satellite is a systems management tool for Linux-based infrastructures. It allows for provisioning, monitoring, and remote management of multiple Linux deployments with a single, centralized tool. If a user submitted a system registration XML-RPC call to an RHN Satellite server and that call failed, their RHN user password was included in plain text in the error messages both stored in the server log and mailed to the server administrator. With this update, user passwords are excluded from these error messages to avoid the exposure of authentication credentials.
Tags: user hat red red-hat-network linux-deployments authentication-credentials

February 03, 2012
16:18
Ubuntu Security Notice USN-1355-1
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 1355-1 - It was discovered that if a user chose to export their Firefox Sync key the "Firefox Recovery Key.html" file is saved with incorrect permissions, making the file contents potentially readable by other users. Nicolas Gregoire and Aki Helin discovered that when processing a malformed embedded XSLT stylesheet, Firefox can crash due to memory corruption. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. Various other issues were also addressed.
Tags: user ubuntu firefox nicolas-gregoire memory-corruption incorrect-permissions

16:18
Ubuntu Security Notice USN-1355-1
» ‎ Packet Storm Security Recent Files

Ubuntu Security Notice 1355-1 - It was discovered that if a user chose to export their Firefox Sync key the "Firefox Recovery Key.html" file is saved with incorrect permissions, making the file contents potentially readable by other users. Nicolas Gregoire and Aki Helin discovered that when processing a malformed embedded XSLT stylesheet, Firefox can crash due to memory corruption. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. Various other issues were also addressed.
Tags: user ubuntu firefox nicolas-gregoire memory-corruption incorrect-permissions

16:18
Ubuntu Security Notice USN-1355-1
» ‎ Packet Storm Security Misc. Files

Ubuntu Security Notice 1355-1 - It was discovered that if a user chose to export their Firefox Sync key the "Firefox Recovery Key.html" file is saved with incorrect permissions, making the file contents potentially readable by other users. Nicolas Gregoire and Aki Helin discovered that when processing a malformed embedded XSLT stylesheet, Firefox can crash due to memory corruption. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. Various other issues were also addressed.
Tags: user ubuntu firefox nicolas-gregoire memory-corruption incorrect-permissions

16:17
Ubuntu Security Notice USN-1355-2
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 1355-2 - USN-1355-1 fixed vulnerabilities in Firefox. This update provides an updated Mozvoikko package for use with the latest Firefox. It was discovered that if a user chose to export their Firefox Sync key the "Firefox Recovery Key.html" file is saved with incorrect permissions, making the file contents potentially readable by other users. Nicolas Gregoire and Aki Helin discovered that when processing a malformed embedded XSLT stylesheet, Firefox can crash due to memory corruption. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. Various other issues were also addressed.
Tags: user ubuntu firefox nicolas-gregoire memory-corruption incorrect-permissions

16:17
Ubuntu Security Notice USN-1355-2
» ‎ Packet Storm Security Misc. Files

Ubuntu Security Notice 1355-2 - USN-1355-1 fixed vulnerabilities in Firefox. This update provides an updated Mozvoikko package for use with the latest Firefox. It was discovered that if a user chose to export their Firefox Sync key the "Firefox Recovery Key.html" file is saved with incorrect permissions, making the file contents potentially readable by other users. Nicolas Gregoire and Aki Helin discovered that when processing a malformed embedded XSLT stylesheet, Firefox can crash due to memory corruption. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. Various other issues were also addressed.
Tags: user ubuntu firefox nicolas-gregoire memory-corruption incorrect-permissions

16:12
Ubuntu Security Notice USN-1355-3
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 1355-3 - USN-1355-1 fixed vulnerabilities in Firefox. This update provides updated ubufox and webfav packages for use with the latest Firefox. It was discovered that if a user chose to export their Firefox Sync key the "Firefox Recovery Key.html" file is saved with incorrect permissions, making the file contents potentially readable by other users. Nicolas Gregoire and Aki Helin discovered that when processing a malformed embedded XSLT stylesheet, Firefox can crash due to memory corruption. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. Various other issues were also addressed.
Tags: user ubuntu firefox nicolas-gregoire memory-corruption incorrect-permissions

16:12
Ubuntu Security Notice USN-1355-3
» ‎ Packet Storm Security Recent Files

Ubuntu Security Notice 1355-3 - USN-1355-1 fixed vulnerabilities in Firefox. This update provides updated ubufox and webfav packages for use with the latest Firefox. It was discovered that if a user chose to export their Firefox Sync key the "Firefox Recovery Key.html" file is saved with incorrect permissions, making the file contents potentially readable by other users. Nicolas Gregoire and Aki Helin discovered that when processing a malformed embedded XSLT stylesheet, Firefox can crash due to memory corruption. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. Various other issues were also addressed.
Tags: user ubuntu firefox nicolas-gregoire memory-corruption incorrect-permissions

16:12
Ubuntu Security Notice USN-1355-3
» ‎ Packet Storm Security Misc. Files

Ubuntu Security Notice 1355-3 - USN-1355-1 fixed vulnerabilities in Firefox. This update provides updated ubufox and webfav packages for use with the latest Firefox. It was discovered that if a user chose to export their Firefox Sync key the "Firefox Recovery Key.html" file is saved with incorrect permissions, making the file contents potentially readable by other users. Nicolas Gregoire and Aki Helin discovered that when processing a malformed embedded XSLT stylesheet, Firefox can crash due to memory corruption. If the user were tricked into opening a specially crafted page, an attacker could exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. Various other issues were also addressed.
Tags: user ubuntu firefox nicolas-gregoire memory-corruption incorrect-permissions

February 01, 2012
18:00
802.1X HTC Android Credential Exposure
» ‎ Packet Storm Security Advisories

There is an issue in certain HTC builds of Android that can expose the user's 802.1X Wi-Fi credentials to any program with basic WI-FI permissions. When this is paired with the Internet access permissions, which most applications have, an application could easily send all stored Wi-Fi network credentials (user names, passwords, and SSID information) to a remote server. This exploit exposes enterprise-privileged credentials in a manner that allows targeted exploitation.
Tags: user credential android x-htc x-wi- remote-server access-permissions user-names

18:00
802.1X HTC Android Credential Exposure
» ‎ Packet Storm Security Recent Files

There is an issue in certain HTC builds of Android that can expose the user's 802.1X Wi-Fi credentials to any program with basic WI-FI permissions. When this is paired with the Internet access permissions, which most applications have, an application could easily send all stored Wi-Fi network credentials (user names, passwords, and SSID information) to a remote server. This exploit exposes enterprise-privileged credentials in a manner that allows targeted exploitation.
Tags: user credential android x-htc x-wi- remote-server access-permissions user-names

18:00
802.1X HTC Android Credential Exposure
» ‎ Packet Storm Security Misc. Files

There is an issue in certain HTC builds of Android that can expose the user's 802.1X Wi-Fi credentials to any program with basic WI-FI permissions. When this is paired with the Internet access permissions, which most applications have, an application could easily send all stored Wi-Fi network credentials (user names, passwords, and SSID information) to a remote server. This exploit exposes enterprise-privileged credentials in a manner that allows targeted exploitation.
Tags: user credential android x-htc x-wi- remote-server access-permissions user-names

January 25, 2012
15:18
Linux/x86 Add New User/Password Shellcode
» ‎ Packet Storm Security Recent Files

180 bytes small Linux/x86 add new user/password shellcode.
Tags: password user linux shellcode small-linux

15:18
Linux/x86 Add New User/Password Shellcode
» ‎ Packet Storm Security Misc. Files

180 bytes small Linux/x86 add new user/password shellcode.
Tags: password user linux shellcode small-linux

14:00
[linux/x86] - linux/x86 Add new User/Passwd - suid(0) - shellcode 180 bytes
» ‎ 1337day (was: Inj3ct0r, 1337db)

[linux/x86] - linux/x86 Add new User/Passwd - suid(0) - shellcode 180 bytes
Tags: passwd linux user x86-linux suid

January 19, 2012
15:49
Ubuntu Security Notice USN-1335-1
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 1335-1 - Jon Larimer discovered that t1lib did not properly parse AFM fonts. If a user were tricked into using a specially crafted font file, a remote attacker could cause t1lib to crash or possibly execute arbitrary code with user privileges. Jonathan Brossard discovered that t1lib did not correctly handle certain malformed font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause t1lib to crash. Various other issues were also addressed.
Tags: user font lib jonathan-brossard jon-larimer font-files brossard arbitrary-code

15:49
Ubuntu Security Notice USN-1335-1
» ‎ Packet Storm Security Recent Files

Ubuntu Security Notice 1335-1 - Jon Larimer discovered that t1lib did not properly parse AFM fonts. If a user were tricked into using a specially crafted font file, a remote attacker could cause t1lib to crash or possibly execute arbitrary code with user privileges. Jonathan Brossard discovered that t1lib did not correctly handle certain malformed font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause t1lib to crash. Various other issues were also addressed.
Tags: user font lib jonathan-brossard jon-larimer font-files brossard arbitrary-code

15:49
Ubuntu Security Notice USN-1335-1
» ‎ Packet Storm Security Misc. Files

Ubuntu Security Notice 1335-1 - Jon Larimer discovered that t1lib did not properly parse AFM fonts. If a user were tricked into using a specially crafted font file, a remote attacker could cause t1lib to crash or possibly execute arbitrary code with user privileges. Jonathan Brossard discovered that t1lib did not correctly handle certain malformed font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause t1lib to crash. Various other issues were also addressed.
Tags: user font lib jonathan-brossard jon-larimer font-files brossard arbitrary-code

January 17, 2012
16:54
Ubuntu Security Notice USN-1333-1
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 1333-1 - Steve Manzuik discovered that Libav incorrectly handled certain malformed Matroska files. If a user were tricked into opening a crafted Matroska file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 11.04. Phillip Langlois discovered that Libav incorrectly handled certain malformed QDM2 streams. If a user were tricked into opening a crafted QDM2 stream file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. Various other issues were also addressed.
Tags: user ubuntu security phillip-langlois steve-manzuik application-crash denial-of-service arbitrary-code

16:54
Ubuntu Security Notice USN-1333-1
» ‎ Packet Storm Security Recent Files

Ubuntu Security Notice 1333-1 - Steve Manzuik discovered that Libav incorrectly handled certain malformed Matroska files. If a user were tricked into opening a crafted Matroska file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 11.04. Phillip Langlois discovered that Libav incorrectly handled certain malformed QDM2 streams. If a user were tricked into opening a crafted QDM2 stream file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. Various other issues were also addressed.
Tags: user ubuntu security phillip-langlois steve-manzuik application-crash denial-of-service arbitrary-code

16:54
Ubuntu Security Notice USN-1333-1
» ‎ Packet Storm Security Misc. Files

Ubuntu Security Notice 1333-1 - Steve Manzuik discovered that Libav incorrectly handled certain malformed Matroska files. If a user were tricked into opening a crafted Matroska file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 11.04. Phillip Langlois discovered that Libav incorrectly handled certain malformed QDM2 streams. If a user were tricked into opening a crafted QDM2 stream file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. Various other issues were also addressed.
Tags: user ubuntu security phillip-langlois steve-manzuik application-crash denial-of-service arbitrary-code

January 13, 2012
9:38
"Sanitize Input"
» ‎ Carnal0wnage

When application security was still in it’s infancy, there were discussions on how to protect applications from newly discovered injection vulnerabilities. "Sanitize Input" was a popular solution that rolled off the tongue nicely and was not overly complicated to explain. It was also, a very generic solution that would (hopefully) be part of a more complete approach.

As much as "Sanitizing Input" makes sense, so does writing your code in a way which, allows you to handle failure safely. This way, when the unexpected does happen, an entire operation doesn't fall down, introduce a bug or propagate unsafe data.

Question: When does this approach fail miserably?
Answer: When it is the only approach you have.

The OWASP Top 10 categorizes XSS and SQL Injection separately. As an attacker, you are injecting data that is handled insecurely by application code. In this way, it is really just another form of injection. On that note, let’s discuss two manifestations of injection. SQL Injection and HTML Injection (XSS). I'd like to demonstrate other ways to think about or handle data beyond just "Sanitize Input". If you take away nothing more from this article, I'd like it to be that applications are unique, there is a level of complexity to design choices and solutions and there are more options than "Sanitize Input" available.

SQL Injection: "Save your one-liners for the bar". Parametrization of database queries is a classic method for handling queries safely and in many cases more efficiently. From a security standpoint, parametrized queries help to solidify the boundaries between user data and SQL statements. It ensures that data submitted by the user will be separated from the actual database query and won’t interfere with the SQL code and ultimately the database.

Example of lazy code....

http://www.example.com/example.php?user_name=gevans

$uname = $_GET['user_name']

....and this is the classic example everyone shows, nothing new here, that illustrates a SQL Injection flaw where the data ($uname) is actually included in the SQL statement.

"SELECT user_id from users where username = $uname;"

This programming flaw has destroyed the boundary between the SQL command and user-supplied input. Because the user data is now cast as a string-- it is no longer clear to the SQL server what part was supplied by the developer and what was supplied by the user. The whole query can fall apart by appending double quotes. This is not just a vulnerability, this is bad programming. Sure, it takes one line to write the query but there is no further sanity checking here. The string is formed, sent to the server, and executed as SQL. How are parametrized queries different?

Parametrized queries separate the data from the query so that we as coders don’t miscommunicate our intentions to the database server. How does it work? The majority of the query is sent to the server MINUS the actual user submitted data. So, the query is prepared (meaning sent to the server), a response comes back with a token (minus MySQL as I understand it), and THEN, the variable is sent to the server with the token and a SQL query executes. This means the expected query and actual data that we've gathered from the user are separated prior to execution.

Lets provide a visualization

// Pass in db credentials as well as the host it is located on and the database we'd like to connect to

$conn = new PDO("mysql:host=$dbhost;dbname=$dbname",$dbuser,$dbpass);

// Prepare the statement
$sql = "SELECT user_id from users where username = ?";

//Execute the query, taking in the variable data ($uname) from the user
$q = $conn->prepare($sql);
$q->execute(array($uname));
$object = $q->fetchColumn();

As you can see, the $sql statement is prepared and the server knows exactly what it should look like. Next, the SQL statement is executed, passing in the variable value in place of the "?" (shown above). By specifying that question mark, you tell the db, this is my statement but I don't know what the value will be.....I'll give you that on the next call.

Lets examine XSS. Again, something I hear a lot is "Sanitize your input". Some people even go as far as "Whitelist" versus "Blacklist". Okay, great, that is not extensible and ultimately context matters. What do I mean? It is a very one-sided approach with a lot of assumptions. Let me draw a picture for you. The understanding, as of right now, is the data comes in one place and is potentially echoed in another. So the model looks something like this:

A typical example would be a registration form. You sign up with your First Name, Last Name, etc. Upon successful authentication to the application, you notice a little message at the top right....

So....."Welcome, Ken!", I wonder where that value came from? When we registered, our information was stored in the db, later extracted after login, and shown on the page. Now, we should be safe right? Even if we had attempted to place JavaScript in the First Name value upon registration, it wouldn't have mattered.....We Sanitized!!!
Two months later, a user complains that they signed up with a misspelled username and would like the ability to change it. A new developer is assigned the task of adding the ability to edit your first and last name and does so. The new developers assumption is that we are going to safely handle that data when rendered to the user. But we aren't. We sanitized the input and didn't bother with handling the data. Our model has changed from Input/Output to......

So with one additional point of input, our model gets (very slightly) more complicated. Now imagine adding multiple points of input, multiple points of output. Now split input into data entry (processed), storage handling (stored in the db) and then do the same for output. While we are at, lets throw a web-service that consumes the data as well. It becomes very easy to see how "Sanitize Input" doesn't scale, isn't a sure-fire solution, and really oversimplifies the problem for those who are looking to either receive or give an easy answer.
In summary, please join me in the fight to stop the mindless regurgitation of old material.
Cheers,
Ken

Tags: user query sql ken security-standpoint database-queries generic-solution

January 05, 2012
16:12
Ubuntu Security Notice USN-1320-1
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 1320-1 - Steve Manzuik discovered that FFmpeg incorrectly handled certain malformed Matroska files. If a user were tricked into opening a crafted Matroska file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. Phillip Langlois discovered that FFmpeg incorrectly handled certain malformed QDM2 streams. If a user were tricked into opening a crafted QDM2 stream file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. Various other issues were also addressed.
Tags: user ubuntu security phillip-langlois steve-manzuik application-crash denial-of-service arbitrary-code

16:12
Ubuntu Security Notice USN-1320-1
» ‎ Packet Storm Security Recent Files

Ubuntu Security Notice 1320-1 - Steve Manzuik discovered that FFmpeg incorrectly handled certain malformed Matroska files. If a user were tricked into opening a crafted Matroska file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. Phillip Langlois discovered that FFmpeg incorrectly handled certain malformed QDM2 streams. If a user were tricked into opening a crafted QDM2 stream file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. Various other issues were also addressed.
Tags: user ubuntu security phillip-langlois steve-manzuik application-crash denial-of-service arbitrary-code

16:12
Ubuntu Security Notice USN-1320-1
» ‎ Packet Storm Security Misc. Files

Ubuntu Security Notice 1320-1 - Steve Manzuik discovered that FFmpeg incorrectly handled certain malformed Matroska files. If a user were tricked into opening a crafted Matroska file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. Phillip Langlois discovered that FFmpeg incorrectly handled certain malformed QDM2 streams. If a user were tricked into opening a crafted QDM2 stream file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. Various other issues were also addressed.
Tags: user ubuntu security phillip-langlois steve-manzuik application-crash denial-of-service arbitrary-code

January 04, 2012
7:48
Ubuntu Security Notice USN-1317-1
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 1317-1 - It was discovered that Ghostscript did not correctly handle memory allocation when parsing certain malformed JPEG-2000 images. If a user or automated system were tricked into opening a specially crafted image, an attacker could cause a denial of service and possibly execute arbitrary code with user privileges. It was discovered that Ghostscript did not correctly handle certain formatting operations when parsing JPEG-2000 images. If a user or automated system were tricked into opening a specially crafted image, an attacker could cause a denial of service and possibly execute arbitrary code with user privileges. Various other issues were also addressed.
Tags: user ubuntu security denial-of-service jpeg-2000 memory-allocation

7:48
Ubuntu Security Notice USN-1317-1
» ‎ Packet Storm Security Recent Files

Ubuntu Security Notice 1317-1 - It was discovered that Ghostscript did not correctly handle memory allocation when parsing certain malformed JPEG-2000 images. If a user or automated system were tricked into opening a specially crafted image, an attacker could cause a denial of service and possibly execute arbitrary code with user privileges. It was discovered that Ghostscript did not correctly handle certain formatting operations when parsing JPEG-2000 images. If a user or automated system were tricked into opening a specially crafted image, an attacker could cause a denial of service and possibly execute arbitrary code with user privileges. Various other issues were also addressed.
Tags: user ubuntu security denial-of-service jpeg-2000 memory-allocation

7:48
Ubuntu Security Notice USN-1317-1
» ‎ Packet Storm Security Misc. Files

Ubuntu Security Notice 1317-1 - It was discovered that Ghostscript did not correctly handle memory allocation when parsing certain malformed JPEG-2000 images. If a user or automated system were tricked into opening a specially crafted image, an attacker could cause a denial of service and possibly execute arbitrary code with user privileges. It was discovered that Ghostscript did not correctly handle certain formatting operations when parsing JPEG-2000 images. If a user or automated system were tricked into opening a specially crafted image, an attacker could cause a denial of service and possibly execute arbitrary code with user privileges. Various other issues were also addressed.
Tags: user ubuntu security denial-of-service jpeg-2000 memory-allocation

January 01, 2012
8:56
Polymorphic Add User Shellcode
» ‎ Packet Storm Security Recent Files

Linux/x86 polymorphic shellcode that escalates uid/gid and adds user iph to /etc/passwd without a password.
Tags: polymorphic shellcode user etc-passwd iph linux

8:56
Polymorphic Add User Shellcode
» ‎ Packet Storm Security Misc. Files

Linux/x86 polymorphic shellcode that escalates uid/gid and adds user iph to /etc/passwd without a password.
Tags: polymorphic shellcode user etc-passwd iph linux

December 20, 2011
8:01
The most evil gift ever
» ‎ Hack a Day

[form], a new user on the Hack a Day forums, was thinking, “what Christmas present i can send a friend, that would be really annoying?” We think he really hit it out of the park with this one. It’s a modified computer speaker that will play “explicit” audio until the power button is pressed 200 [...]
Tags: user form gift computer-speaker power-button hack digital audio hacks

December 19, 2011
14:57
Ubuntu Security Notice USN-1310-1
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 1310-1 - It was discovered that libarchive incorrectly handled certain ISO 9660 image files. If a user were tricked into using a specially crafted ISO 9660 image file, a remote attacker could cause libarchive to crash or possibly execute arbitrary code with user privileges. It was discovered that libarchive incorrectly handled certain tar archive files. If a user were tricked into using a specially crafted tar file, a remote attacker could cause libarchive to crash or possibly execute arbitrary code with user privileges. Various other issues were also addressed.
Tags: user ubuntu security iso-9660 archive-files tar-archive

14:57
Ubuntu Security Notice USN-1310-1
» ‎ Packet Storm Security Recent Files

Ubuntu Security Notice 1310-1 - It was discovered that libarchive incorrectly handled certain ISO 9660 image files. If a user were tricked into using a specially crafted ISO 9660 image file, a remote attacker could cause libarchive to crash or possibly execute arbitrary code with user privileges. It was discovered that libarchive incorrectly handled certain tar archive files. If a user were tricked into using a specially crafted tar file, a remote attacker could cause libarchive to crash or possibly execute arbitrary code with user privileges. Various other issues were also addressed.
Tags: user ubuntu security iso-9660 archive-files tar-archive

14:57
Ubuntu Security Notice USN-1310-1
» ‎ Packet Storm Security Misc. Files

Ubuntu Security Notice 1310-1 - It was discovered that libarchive incorrectly handled certain ISO 9660 image files. If a user were tricked into using a specially crafted ISO 9660 image file, a remote attacker could cause libarchive to crash or possibly execute arbitrary code with user privileges. It was discovered that libarchive incorrectly handled certain tar archive files. If a user were tricked into using a specially crafted tar file, a remote attacker could cause libarchive to crash or possibly execute arbitrary code with user privileges. Various other issues were also addressed.
Tags: user ubuntu security iso-9660 archive-files tar-archive

December 12, 2011
8:34
Squiz Matrix User Account Enumeration
» ‎ Packet Storm Security Exploits

Squiz Matrix suffers from a user account enumeration vulnerability. Version 4.6.0 is affected.
Tags: matrix squiz user vulnerability

8:34
Squiz Matrix User Account Enumeration
» ‎ Packet Storm Security Recent Files

Squiz Matrix suffers from a user account enumeration vulnerability. Version 4.6.0 is affected.
Tags: matrix squiz user vulnerability

8:34
Squiz Matrix User Account Enumeration
» ‎ Packet Storm Security Misc. Files

Squiz Matrix suffers from a user account enumeration vulnerability. Version 4.6.0 is affected.
Tags: matrix squiz user vulnerability

December 08, 2011
14:00
Bugtraq: [DCA-2011-0015] QuesCom Qportal User - OctoWebSvr/COM - Source Code Disclosure
» ‎ SecurityFocus Vulnerabilities

[DCA-2011-0015] QuesCom Qportal User - OctoWebSvr/COM - Source Code Disclosure
Tags: qportal quescom user source-code disclosure

November 27, 2011
14:00
[linux/mips] - linux/mips - add user(UID 0) with password - 164 bytes
» ‎ 1337day (was: Inj3ct0r, 1337db)

[linux/mips] - linux/mips - add user(UID 0) with password - 164 bytes
Tags: user linux uid linux-mips

November 18, 2011
8:44
Ubuntu Security Notice USN-1267-1
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 1267-1 - It was discovered that FreeType did not correctly handle certain malformed Type 1 font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash or possibly execute arbitrary code with user privileges. It was discovered that FreeType did not correctly handle certain malformed CID-keyed PostScript font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash or possibly execute arbitrary code with user privileges. Various other issues were also addressed.
Tags: user font freetype cid-keyed-postscript postscript-font font-files arbitrary-code

8:44
Ubuntu Security Notice USN-1267-1
» ‎ Packet Storm Security Recent Files

Ubuntu Security Notice 1267-1 - It was discovered that FreeType did not correctly handle certain malformed Type 1 font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash or possibly execute arbitrary code with user privileges. It was discovered that FreeType did not correctly handle certain malformed CID-keyed PostScript font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash or possibly execute arbitrary code with user privileges. Various other issues were also addressed.
Tags: user font freetype cid-keyed-postscript postscript-font font-files arbitrary-code

November 17, 2011
9:01
Simple telepresence hack lets remote user rotate this laptop
» ‎ Hack a Day

[Kris] wanted to make the telecommuting employees at his office feel a little more in control of their virtual presence in the office. He gave them a way to look around without needing to go into full-blown robotics. This laptop stand has a Lazy Susan connected to a servo motor to give the user control [...]
Tags: user laptop office susan virtual-presence telecommuting-employees laptop-stand arduino hacks

November 09, 2011
8:25
Ubuntu Security Notice USN-1255-1
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 1255-1 - Hossein Lotfi discovered that libmodplug did not correctly handle certain malformed media files. If a user or automated system were tricked into opening a crafted media file, an attacker could cause a denial of service or possibly execute arbitrary code with privileges of the user invoking the program. It was discovered that libmodplug did not correctly handle certain malformed media files. If a user or automated system were tricked into opening a crafted media file, an attacker could cause a denial of service or possibly execute arbitrary code with privileges of the user invoking the program. Various other issues were also addressed.
Tags: user ubuntu security denial-of-service automated-system arbitrary-code

8:25
Ubuntu Security Notice USN-1255-1
» ‎ Packet Storm Security Recent Files

Ubuntu Security Notice 1255-1 - Hossein Lotfi discovered that libmodplug did not correctly handle certain malformed media files. If a user or automated system were tricked into opening a crafted media file, an attacker could cause a denial of service or possibly execute arbitrary code with privileges of the user invoking the program. It was discovered that libmodplug did not correctly handle certain malformed media files. If a user or automated system were tricked into opening a crafted media file, an attacker could cause a denial of service or possibly execute arbitrary code with privileges of the user invoking the program. Various other issues were also addressed.
Tags: user ubuntu security denial-of-service automated-system arbitrary-code

8:25
Ubuntu Security Notice USN-1255-1
» ‎ Packet Storm Security Misc. Files

Ubuntu Security Notice 1255-1 - Hossein Lotfi discovered that libmodplug did not correctly handle certain malformed media files. If a user or automated system were tricked into opening a crafted media file, an attacker could cause a denial of service or possibly execute arbitrary code with privileges of the user invoking the program. It was discovered that libmodplug did not correctly handle certain malformed media files. If a user or automated system were tricked into opening a crafted media file, an attacker could cause a denial of service or possibly execute arbitrary code with privileges of the user invoking the program. Various other issues were also addressed.
Tags: user ubuntu security denial-of-service automated-system arbitrary-code

October 28, 2011
14:21
Debian Security Advisory 2331-1
» ‎ Packet Storm Security Advisories

Debian Linux Security Advisory 2331-1 - It has been discovered by "frosty_un" that a design flaw in Tor, an online privacy tool, allows malicious relay servers to learn certain information that they should not be able to learn. Specifically, a relay that a user connects to directly could learn which other relays that user is connected to directly. In combination with other attacks, this issue can lead to deanonymizing the user.
Tags: user debian security tor privacy-tool linux-security debian-linux

14:21
Debian Security Advisory 2331-1
» ‎ Packet Storm Security Recent Files

Debian Linux Security Advisory 2331-1 - It has been discovered by "frosty_un" that a design flaw in Tor, an online privacy tool, allows malicious relay servers to learn certain information that they should not be able to learn. Specifically, a relay that a user connects to directly could learn which other relays that user is connected to directly. In combination with other attacks, this issue can lead to deanonymizing the user.
Tags: user debian security tor privacy-tool linux-security debian-linux

14:21
Debian Security Advisory 2331-1
» ‎ Packet Storm Security Misc. Files

Debian Linux Security Advisory 2331-1 - It has been discovered by "frosty_un" that a design flaw in Tor, an online privacy tool, allows malicious relay servers to learn certain information that they should not be able to learn. Specifically, a relay that a user connects to directly could learn which other relays that user is connected to directly. In combination with other attacks, this issue can lead to deanonymizing the user.
Tags: user debian security tor privacy-tool linux-security debian-linux

October 26, 2011
16:20
Zero Day Initiative Advisory 11-307
» ‎ Packet Storm Security Recent Files

Zero Day Initiative Advisory 11-307 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists because Java does not sufficiently verify parameters certain functions. The function MixerSequencer.nAddControllerEventCallback fails to check for negative index numbers before writing user supplied data into a static array. This allows a malicious applet to write user controlled data outside the array boundaries resulting in remote code execution under the context of the current user.
Tags: day zero user static-array malicious-applet oracle-java

16:20
Zero Day Initiative Advisory 11-307
» ‎ Packet Storm Security Misc. Files

Zero Day Initiative Advisory 11-307 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists because Java does not sufficiently verify parameters certain functions. The function MixerSequencer.nAddControllerEventCallback fails to check for negative index numbers before writing user supplied data into a static array. This allows a malicious applet to write user controlled data outside the array boundaries resulting in remote code execution under the context of the current user.
Tags: day zero user static-array malicious-applet oracle-java

October 21, 2011
16:07
Oracle Database Account Management Protection Bypass
» ‎ Packet Storm Security Advisories

Team SHATTER Security Advisory - Oracle Database Vault provides additional protections from malicious privileged users. The protections include separation of duty for some tasks like user account management. Any user with SYSDBA privilege or DV_ACCTMGR role can bypass these protections and change any user's password (including Oracle Database Vault Owner user password) calling the OCIPasswordChange client API (the 'password' command in SqlPLUS uses this API).
Tags: user oracle database oracle-database-account password-command privileged-users

16:07
Oracle Database Account Management Protection Bypass
» ‎ Packet Storm Security Recent Files

Team SHATTER Security Advisory - Oracle Database Vault provides additional protections from malicious privileged users. The protections include separation of duty for some tasks like user account management. Any user with SYSDBA privilege or DV_ACCTMGR role can bypass these protections and change any user's password (including Oracle Database Vault Owner user password) calling the OCIPasswordChange client API (the 'password' command in SqlPLUS uses this API).
Tags: user oracle database oracle-database-account password-command privileged-users

16:07
Oracle Database Account Management Protection Bypass
» ‎ Packet Storm Security Misc. Files

Team SHATTER Security Advisory - Oracle Database Vault provides additional protections from malicious privileged users. The protections include separation of duty for some tasks like user account management. Any user with SYSDBA privilege or DV_ACCTMGR role can bypass these protections and change any user's password (including Oracle Database Vault Owner user password) calling the OCIPasswordChange client API (the 'password' command in SqlPLUS uses this API).
Tags: user oracle database oracle-database-account password-command privileged-users

October 19, 2011
15:30
Cisco Security Advisory 20111019-sns
» ‎ Packet Storm Security Advisories

Cisco Security Advisory - The Cisco Show and Share webcasting and video sharing application contains two vulnerabilities. The first vulnerability allows an unauthenticated user to access several administrative web pages. The second vulnerability permits an authenticated user to execute arbitrary code on the device under the privileges of the web server user account. Cisco has released free software updates that address these vulnerabilities. There are no workarounds available for these vulnerabilities.
Tags: advisory user vulnerability cisco-show cisco-security cisco-security-advisory free-software-updates web-server-user

15:30
Cisco Security Advisory 20111019-sns
» ‎ Packet Storm Security Recent Files

Cisco Security Advisory - The Cisco Show and Share webcasting and video sharing application contains two vulnerabilities. The first vulnerability allows an unauthenticated user to access several administrative web pages. The second vulnerability permits an authenticated user to execute arbitrary code on the device under the privileges of the web server user account. Cisco has released free software updates that address these vulnerabilities. There are no workarounds available for these vulnerabilities.
Tags: advisory user vulnerability cisco-show cisco-security cisco-security-advisory free-software-updates web-server-user

15:30
Cisco Security Advisory 20111019-sns
» ‎ Packet Storm Security Misc. Files

Cisco Security Advisory - The Cisco Show and Share webcasting and video sharing application contains two vulnerabilities. The first vulnerability allows an unauthenticated user to access several administrative web pages. The second vulnerability permits an authenticated user to execute arbitrary code on the device under the privileges of the web server user account. Cisco has released free software updates that address these vulnerabilities. There are no workarounds available for these vulnerabilities.
Tags: advisory user vulnerability cisco-show cisco-security cisco-security-advisory free-software-updates web-server-user

October 16, 2011
5:56
[Slides] Digital Information, User Tokens, Privacy and Forensics Investigations: The Case of Windows XP Platform
» ‎ SecDocs

Authors: Larry Leibrock
Tags: forensic
Event: Black Hat EU 2003

Tags: digital user information larry-leibrock information-user black-hat digital-information
October 10, 2011
2:23
[Slides] Digital Information, User Tokens, Privacy and Forensics Investigations
» ‎ SecDocs

Authors: Larry Leibrock
Tags: forensic
Event: Black Hat USA 2003

Tags: digital user information larry-leibrock usa information-user black-hat digital-information
October 02, 2011
23:20
[Slides] Digital Information, User Tokens, Privacy and Forensics Investigations
» ‎ SecDocs

Authors: Larry Leibrock
Tags: forensic
Event: Black Hat Federal 2003

Tags: digital user information larry-leibrock information-user black-hat digital-information

September 23, 2011
0:00
Vuln: Samba SWAT 'user' Field Cross Site Scripting Vulnerability
» ‎ SecurityFocus Vulnerabilities

Samba SWAT 'user' Field Cross Site Scripting Vulnerability
Tags: user swat samba samba-swat cross-site-scripting vulnerability
September 22, 2011
0:00
Vuln: Samba SWAT 'user' Field Cross Site Scripting Vulnerability
» ‎ SecurityFocus Vulnerabilities

Samba SWAT 'user' Field Cross Site Scripting Vulnerability
Tags: user swat samba samba-swat cross-site-scripting vulnerability

September 21, 2011
22:23
Red Hat Security Advisory 2011-1324-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2011-1324-01 - Qt 4 is a software toolkit that simplifies the task of writing and maintaining GUI applications for the X Window System. HarfBuzz is an OpenType text shaping engine. A flaw in the way Qt 4 expanded certain UTF-8 characters could be used to prevent a Qt 4 based application from properly sanitizing user input. Depending on the application, this could allow an attacker to perform directory traversal, or for web applications, a cross-site scripting attack. A buffer overflow flaw was found in the harfbuzz module in Qt 4. If a user loaded a specially-crafted font file with an application linked against Qt 4, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application.
Tags: user red application x-window x-window-system red-hat-security software-toolkit

22:23
Red Hat Security Advisory 2011-1324-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2011-1324-01 - Qt 4 is a software toolkit that simplifies the task of writing and maintaining GUI applications for the X Window System. HarfBuzz is an OpenType text shaping engine. A flaw in the way Qt 4 expanded certain UTF-8 characters could be used to prevent a Qt 4 based application from properly sanitizing user input. Depending on the application, this could allow an attacker to perform directory traversal, or for web applications, a cross-site scripting attack. A buffer overflow flaw was found in the harfbuzz module in Qt 4. If a user loaded a specially-crafted font file with an application linked against Qt 4, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application.
Tags: user red application x-window x-window-system red-hat-security software-toolkit

22:22
Red Hat Security Advisory 2011-1323-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2011-1323-01 - Qt is a software toolkit that simplifies the task of writing and maintaining GUI applications for the X Window System. HarfBuzz is an OpenType text shaping engine. A buffer overflow flaw was found in the harfbuzz module in Qt. If a user loaded a specially-crafted font file with an application linked against Qt, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. A buffer overflow flaw was found in the way Qt handled certain gray-scale image files. If a user loaded a specially-crafted gray-scale image file with an application linked against Qt, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application.
Tags: user red application x-window gray-scale-image x-window-system red-hat-security

22:22
Red Hat Security Advisory 2011-1323-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2011-1323-01 - Qt is a software toolkit that simplifies the task of writing and maintaining GUI applications for the X Window System. HarfBuzz is an OpenType text shaping engine. A buffer overflow flaw was found in the harfbuzz module in Qt. If a user loaded a specially-crafted font file with an application linked against Qt, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. A buffer overflow flaw was found in the way Qt handled certain gray-scale image files. If a user loaded a specially-crafted gray-scale image file with an application linked against Qt, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application.
Tags: user red application x-window gray-scale-image x-window-system red-hat-security

22:22
Red Hat Security Advisory 2011-1323-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2011-1323-01 - Qt is a software toolkit that simplifies the task of writing and maintaining GUI applications for the X Window System. HarfBuzz is an OpenType text shaping engine. A buffer overflow flaw was found in the harfbuzz module in Qt. If a user loaded a specially-crafted font file with an application linked against Qt, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. A buffer overflow flaw was found in the way Qt handled certain gray-scale image files. If a user loaded a specially-crafted gray-scale image file with an application linked against Qt, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application.
Tags: user red application x-window gray-scale-image x-window-system red-hat-security

September 19, 2011
16:46
Ubuntu Security Notice USN-1209-2
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 1209-2 - It was discovered that Libav incorrectly handled certain malformed ogg files. If a user were tricked into opening a crafted ogg file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. It was discovered that Libav incorrectly handled certain malformed AMV files. If a user were tricked into opening a crafted AMV file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. Various other issues were also addressed.
Tags: user ubuntu security application-crash denial-of-service ogg-files

16:46
Ubuntu Security Notice USN-1209-2
» ‎ Packet Storm Security Recent Files

Ubuntu Security Notice 1209-2 - It was discovered that Libav incorrectly handled certain malformed ogg files. If a user were tricked into opening a crafted ogg file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. It was discovered that Libav incorrectly handled certain malformed AMV files. If a user were tricked into opening a crafted AMV file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. Various other issues were also addressed.
Tags: user ubuntu security application-crash denial-of-service ogg-files

16:46
Ubuntu Security Notice USN-1209-2
» ‎ Packet Storm Security Misc. Files

Ubuntu Security Notice 1209-2 - It was discovered that Libav incorrectly handled certain malformed ogg files. If a user were tricked into opening a crafted ogg file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. It was discovered that Libav incorrectly handled certain malformed AMV files. If a user were tricked into opening a crafted AMV file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. Various other issues were also addressed.
Tags: user ubuntu security application-crash denial-of-service ogg-files

16:45
Ubuntu Security Notice USN-1209-1
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 1209-1 - It was discovered that FFmpeg incorrectly handled certain malformed ogg files. If a user were tricked into opening a crafted ogg file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 10.10. It was discovered that FFmpeg incorrectly handled certain malformed AMV files. If a user were tricked into opening a crafted AMV file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 10.10. Various other issues were also addressed.
Tags: user ubuntu security application-crash denial-of-service ogg-files

16:45
Ubuntu Security Notice USN-1209-1
» ‎ Packet Storm Security Recent Files

Ubuntu Security Notice 1209-1 - It was discovered that FFmpeg incorrectly handled certain malformed ogg files. If a user were tricked into opening a crafted ogg file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 10.10. It was discovered that FFmpeg incorrectly handled certain malformed AMV files. If a user were tricked into opening a crafted AMV file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 10.10. Various other issues were also addressed.
Tags: user ubuntu security application-crash denial-of-service ogg-files

16:45
Ubuntu Security Notice USN-1209-1
» ‎ Packet Storm Security Misc. Files

Ubuntu Security Notice 1209-1 - It was discovered that FFmpeg incorrectly handled certain malformed ogg files. If a user were tricked into opening a crafted ogg file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 10.10. It was discovered that FFmpeg incorrectly handled certain malformed AMV files. If a user were tricked into opening a crafted AMV file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 10.10. Various other issues were also addressed.
Tags: user ubuntu security application-crash denial-of-service ogg-files

September 18, 2011
21:04
KnFTP 1.0.0 USER Buffer Overflow
» ‎ Packet Storm Security Exploits

KnFTP server version 1.0.0 remote buffer overflow exploit that leverages the USER command.
Tags: user knftp buffer remote-buffer-overflow buffer-overflow-exploit remote-buffer-overflow-exploit

September 14, 2011
15:42
Red Hat Security Advisory 2011-1292-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2011-1292-01 - The jakarta-commons-daemon-jsvc package includes jsvc, a service wrapper that allows Java applications to be run as daemons. It was found that jsvc did not correctly drop capabilities after starting an application. If an administrator used jsvc to run an application, and also used the "-user" option to specify a user for it to run as, the application correctly ran as that user but did not drop its increased capabilities, allowing it access to all files and directories accessible to the root user. Note: This flaw does not affect Red Hat Enterprise Linux 5 and 6, as the jakarta-commons-daemon-jsvc packages for those products are not built with capabilities support.
Tags: user hat red jakarta-commons red-hat-security red-hat-enterprise

15:42
Red Hat Security Advisory 2011-1292-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2011-1292-01 - The jakarta-commons-daemon-jsvc package includes jsvc, a service wrapper that allows Java applications to be run as daemons. It was found that jsvc did not correctly drop capabilities after starting an application. If an administrator used jsvc to run an application, and also used the "-user" option to specify a user for it to run as, the application correctly ran as that user but did not drop its increased capabilities, allowing it access to all files and directories accessible to the root user. Note: This flaw does not affect Red Hat Enterprise Linux 5 and 6, as the jakarta-commons-daemon-jsvc packages for those products are not built with capabilities support.
Tags: user hat red jakarta-commons red-hat-security red-hat-enterprise

15:42
Red Hat Security Advisory 2011-1292-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2011-1292-01 - The jakarta-commons-daemon-jsvc package includes jsvc, a service wrapper that allows Java applications to be run as daemons. It was found that jsvc did not correctly drop capabilities after starting an application. If an administrator used jsvc to run an application, and also used the "-user" option to specify a user for it to run as, the application correctly ran as that user but did not drop its increased capabilities, allowing it access to all files and directories accessible to the root user. Note: This flaw does not affect Red Hat Enterprise Linux 5 and 6, as the jakarta-commons-daemon-jsvc packages for those products are not built with capabilities support.
Tags: user hat red jakarta-commons red-hat-security red-hat-enterprise

15:41
Red Hat Security Advisory 2011-1291-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2011-1291-01 - jsvc is a service wrapper that allows Java applications to be run as daemons. It was found that jsvc did not correctly drop capabilities after starting an application. If an administrator used jsvc to run an application, and also used the "-user" option to specify a user for it to run as, the application correctly ran as that user but did not drop its increased capabilities, allowing it access to all files and directories accessible to the root user. Note: This flaw only affected users running JBoss Enterprise Web Server 1.0.2 from jboss-ews-1.0.2-RHEL4-[arch].zip as provided from the Red Hat Customer Portal, as versions for other products are not built with capabilities support.
Tags: user hat red enterprise-web-server red-hat-security customer-portal

15:41
Red Hat Security Advisory 2011-1291-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2011-1291-01 - jsvc is a service wrapper that allows Java applications to be run as daemons. It was found that jsvc did not correctly drop capabilities after starting an application. If an administrator used jsvc to run an application, and also used the "-user" option to specify a user for it to run as, the application correctly ran as that user but did not drop its increased capabilities, allowing it access to all files and directories accessible to the root user. Note: This flaw only affected users running JBoss Enterprise Web Server 1.0.2 from jboss-ews-1.0.2-RHEL4-[arch].zip as provided from the Red Hat Customer Portal, as versions for other products are not built with capabilities support.
Tags: user hat red enterprise-web-server red-hat-security customer-portal

15:41
Red Hat Security Advisory 2011-1291-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2011-1291-01 - jsvc is a service wrapper that allows Java applications to be run as daemons. It was found that jsvc did not correctly drop capabilities after starting an application. If an administrator used jsvc to run an application, and also used the "-user" option to specify a user for it to run as, the application correctly ran as that user but did not drop its increased capabilities, allowing it access to all files and directories accessible to the root user. Note: This flaw only affected users running JBoss Enterprise Web Server 1.0.2 from jboss-ews-1.0.2-RHEL4-[arch].zip as provided from the Red Hat Customer Portal, as versions for other products are not built with capabilities support.
Tags: user hat red enterprise-web-server red-hat-security customer-portal

6:36
[Paper] Adventures in Limited User Post Exploitation
» ‎ SecDocs

Authors: Nathan Keltner Tim Elrod
Tags: Windows exploiting
Event: Black Hat USA 2010
Abstract: Just how much damage *can* be done with EIP under a non-Administrative Windows environment? Much, much more than you likely think. Through new techniques and live examples, attendees will be guided through the modern day attack surface of a restrictive corporate Windows world. Based purely on the Windows privilege model, demonstrations and new code will cover techniques related to collecting and replaying passwords and password hashes, destroying the browser trust model, attacking the network and the domain, and more, all without administrative access. Moving into a world of Windows Vista, 7, and hardened XP environments, the days of easily popping shells with Admin access are becoming less common. When a Limited User is exploited via a client side vulnerability, damage is often believed to be lessened due to the inability of attacker code to access sensitive portions of the OS, such as those containing passwords and password hashes, without an additional privilege escalation exploit. Despite conventional wisdom from vendors and security press, taking your users out of the 'Local Administrators' OU doesn't mean your environment is magically protected from privilege-agnostic attackers.
Tags: limited user windows nathan-keltner tim-elrod usa model-demonstrations conventional-wisdom trust-model

September 05, 2011
0:00
Vuln: Samba SWAT 'user' Field Cross Site Scripting Vulnerability
» ‎ SecurityFocus Vulnerabilities

Samba SWAT 'user' Field Cross Site Scripting Vulnerability
Tags: user swat samba samba-swat cross-site-scripting vulnerability

September 02, 2011
15:01
Zero Day Initiative Advisory 11-279
» ‎ Packet Storm Security Recent Files

Zero Day Initiative Advisory 11-279 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Witness Systems eQuality Suite. This application is bundled with Nortel Contact Recording and Quality Monitoring Suite. Authentication is not required to exploit this vulnerability. The flaw exists within the Unify2.exe component which listens by default on TCP port 6821. When handling a packet type the process trusts a remaining packet length value provided by the user and blindly copies user supplied data into a fixed-length buffer on the stack. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the SYSTEM user.
Tags: user zero vulnerability witness-systems exe-component packet-type

15:01
Zero Day Initiative Advisory 11-279
» ‎ Packet Storm Security Misc. Files

Zero Day Initiative Advisory 11-279 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Witness Systems eQuality Suite. This application is bundled with Nortel Contact Recording and Quality Monitoring Suite. Authentication is not required to exploit this vulnerability. The flaw exists within the Unify2.exe component which listens by default on TCP port 6821. When handling a packet type the process trusts a remaining packet length value provided by the user and blindly copies user supplied data into a fixed-length buffer on the stack. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the SYSTEM user.
Tags: user zero vulnerability witness-systems exe-component packet-type

August 29, 2011
18:59
Red Hat Security Advisory 2011-1221-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2011-1221-01 - Samba is a suite of programs used by machines to share files, printers, and other information. The cifs-utils package contains utilities for mounting and managing CIFS shares. A cross-site scripting flaw was found in the password change page of the Samba Web Administration Tool. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially-crafted URL, it would lead to arbitrary web script execution in the context of the user's SWAT session. It was found that SWAT web pages did not protect against Cross-Site Request Forgery attacks. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially-crafted URL, the attacker could perform Samba configuration changes with the privileges of the logged in user.
Tags: user swat web samba-web-administration-tool web-administration-tool samba-configuration

18:59
Red Hat Security Advisory 2011-1221-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2011-1221-01 - Samba is a suite of programs used by machines to share files, printers, and other information. The cifs-utils package contains utilities for mounting and managing CIFS shares. A cross-site scripting flaw was found in the password change page of the Samba Web Administration Tool. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially-crafted URL, it would lead to arbitrary web script execution in the context of the user's SWAT session. It was found that SWAT web pages did not protect against Cross-Site Request Forgery attacks. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially-crafted URL, the attacker could perform Samba configuration changes with the privileges of the logged in user.
Tags: user swat web samba-web-administration-tool web-administration-tool samba-configuration

18:59
Red Hat Security Advisory 2011-1221-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2011-1221-01 - Samba is a suite of programs used by machines to share files, printers, and other information. The cifs-utils package contains utilities for mounting and managing CIFS shares. A cross-site scripting flaw was found in the password change page of the Samba Web Administration Tool. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially-crafted URL, it would lead to arbitrary web script execution in the context of the user's SWAT session. It was found that SWAT web pages did not protect against Cross-Site Request Forgery attacks. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially-crafted URL, the attacker could perform Samba configuration changes with the privileges of the logged in user.
Tags: user swat web samba-web-administration-tool web-administration-tool samba-configuration

12:22
Red Hat Security Advisory 2011-1220-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2011-1220-01 - Samba is a suite of programs used by machines to share files, printers, and other information. A cross-site scripting flaw was found in the password change page of the Samba Web Administration Tool. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially-crafted URL, it would lead to arbitrary web script execution in the context of the user's SWAT session. It was found that SWAT web pages did not protect against Cross-Site Request Forgery attacks. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially-crafted URL, the attacker could perform Samba configuration changes with the privileges of the logged in user.
Tags: user swat web samba-web-administration-tool web-administration-tool samba-configuration

12:22
Red Hat Security Advisory 2011-1220-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2011-1220-01 - Samba is a suite of programs used by machines to share files, printers, and other information. A cross-site scripting flaw was found in the password change page of the Samba Web Administration Tool. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially-crafted URL, it would lead to arbitrary web script execution in the context of the user's SWAT session. It was found that SWAT web pages did not protect against Cross-Site Request Forgery attacks. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially-crafted URL, the attacker could perform Samba configuration changes with the privileges of the logged in user.
Tags: user swat web samba-web-administration-tool web-administration-tool samba-configuration

12:22
Red Hat Security Advisory 2011-1220-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2011-1220-01 - Samba is a suite of programs used by machines to share files, printers, and other information. A cross-site scripting flaw was found in the password change page of the Samba Web Administration Tool. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially-crafted URL, it would lead to arbitrary web script execution in the context of the user's SWAT session. It was found that SWAT web pages did not protect against Cross-Site Request Forgery attacks. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially-crafted URL, the attacker could perform Samba configuration changes with the privileges of the logged in user.
Tags: user swat web samba-web-administration-tool web-administration-tool samba-configuration

12:19
Red Hat Security Advisory 2011-1219-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2011-1219-01 - Samba is a suite of programs used by machines to share files, printers, and other information. A cross-site scripting flaw was found in the password change page of the Samba Web Administration Tool. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially-crafted URL, it would lead to arbitrary web script execution in the context of the user's SWAT session. It was found that SWAT web pages did not protect against Cross-Site Request Forgery attacks. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially-crafted URL, the attacker could perform Samba configuration changes with the privileges of the logged in user.
Tags: user swat web samba-web-administration-tool web-administration-tool samba-configuration

12:19
Red Hat Security Advisory 2011-1219-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2011-1219-01 - Samba is a suite of programs used by machines to share files, printers, and other information. A cross-site scripting flaw was found in the password change page of the Samba Web Administration Tool. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially-crafted URL, it would lead to arbitrary web script execution in the context of the user's SWAT session. It was found that SWAT web pages did not protect against Cross-Site Request Forgery attacks. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially-crafted URL, the attacker could perform Samba configuration changes with the privileges of the logged in user.
Tags: user swat web samba-web-administration-tool web-administration-tool samba-configuration

12:19
Red Hat Security Advisory 2011-1219-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2011-1219-01 - Samba is a suite of programs used by machines to share files, printers, and other information. A cross-site scripting flaw was found in the password change page of the Samba Web Administration Tool. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially-crafted URL, it would lead to arbitrary web script execution in the context of the user's SWAT session. It was found that SWAT web pages did not protect against Cross-Site Request Forgery attacks. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially-crafted URL, the attacker could perform Samba configuration changes with the privileges of the logged in user.
Tags: user swat web samba-web-administration-tool web-administration-tool samba-configuration

August 16, 2011
6:12
Zero Day Initiative Advisory 11-254
» ‎ Packet Storm Security Advisories

Zero Day Initiative Advisory 11-254 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple QuickTime. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the way QuickTime handles the 'trun' atom. QuickTime uses user supplied data in the 'sampleCount' field to calculate a buffer size. An integer wrap can occur that results in the allocation of a memory buffer that is smaller than intended. When QuickTime writes to this buffer it causes a memory corruption that can lead to remote code execution under the context of the current user.
Tags: zero buffer user apple-quicktime memory-corruption code-execution memory-buffer

6:12
Zero Day Initiative Advisory 11-254
» ‎ Packet Storm Security Recent Files

Zero Day Initiative Advisory 11-254 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple QuickTime. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the way QuickTime handles the 'trun' atom. QuickTime uses user supplied data in the 'sampleCount' field to calculate a buffer size. An integer wrap can occur that results in the allocation of a memory buffer that is smaller than intended. When QuickTime writes to this buffer it causes a memory corruption that can lead to remote code execution under the context of the current user.
Tags: zero buffer user apple-quicktime memory-corruption code-execution memory-buffer

6:12
Zero Day Initiative Advisory 11-254
» ‎ Packet Storm Security Misc. Files

Zero Day Initiative Advisory 11-254 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple QuickTime. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the way QuickTime handles the 'trun' atom. QuickTime uses user supplied data in the 'sampleCount' field to calculate a buffer size. An integer wrap can occur that results in the allocation of a memory buffer that is smaller than intended. When QuickTime writes to this buffer it causes a memory corruption that can lead to remote code execution under the context of the current user.
Tags: zero buffer user apple-quicktime memory-corruption code-execution memory-buffer

August 08, 2011
18:55
McAfee SaaS MyAsUtil5.2.0.603.dll Code Execution
» ‎ Packet Storm Security Advisories

A vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of McAfee Security-as-a-Service. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaws exist within the MyAsUtil5.2.0.603.dll which exposes an ActiveX control. First, XSS can be used to bypass the domain execution policy implemented in MyASUtil.SecureObjectFactory.CreateSecureObject() to create an instance of MyASUtil.InstallInfo. Then, MyASUtil.InstallInfo.RunUserProgram() can be used to execute code on the user's system. Additionally, many other objects and interfaces on the user's system can likely be abused using this general mechanism.
Tags: code myasutil user code-execution s-system saas

18:55
McAfee SaaS MyAsUtil5.2.0.603.dll Code Execution
» ‎ Packet Storm Security Recent Files

A vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of McAfee Security-as-a-Service. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaws exist within the MyAsUtil5.2.0.603.dll which exposes an ActiveX control. First, XSS can be used to bypass the domain execution policy implemented in MyASUtil.SecureObjectFactory.CreateSecureObject() to create an instance of MyASUtil.InstallInfo. Then, MyASUtil.InstallInfo.RunUserProgram() can be used to execute code on the user's system. Additionally, many other objects and interfaces on the user's system can likely be abused using this general mechanism.
Tags: code myasutil user code-execution s-system saas

18:55
McAfee SaaS MyAsUtil5.2.0.603.dll Code Execution
» ‎ Packet Storm Security Misc. Files

A vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of McAfee Security-as-a-Service. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaws exist within the MyAsUtil5.2.0.603.dll which exposes an ActiveX control. First, XSS can be used to bypass the domain execution policy implemented in MyASUtil.SecureObjectFactory.CreateSecureObject() to create an instance of MyASUtil.InstallInfo. Then, MyASUtil.InstallInfo.RunUserProgram() can be used to execute code on the user's system. Additionally, many other objects and interfaces on the user's system can likely be abused using this general mechanism.
Tags: code myasutil user code-execution s-system saas

0:00
Vuln: Samba SWAT 'user' Field Cross Site Scripting Vulnerability
» ‎ SecurityFocus Vulnerabilities

Samba SWAT 'user' Field Cross Site Scripting Vulnerability
Tags: user swat samba samba-swat cross-site-scripting vulnerability

August 02, 2011
18:43
Facebook Mobile User Enumeration
» ‎ Packet Storm Security Exploits

The Facebook mobile system suffers from a user enumeration vulnerability.
Tags: facebook enumeration user mobile-system mobile-user vulnerability

18:43
Facebook Mobile User Enumeration
» ‎ Packet Storm Security Recent Files

The Facebook mobile system suffers from a user enumeration vulnerability.
Tags: facebook enumeration user mobile-system mobile-user vulnerability

18:43
Facebook Mobile User Enumeration
» ‎ Packet Storm Security Misc. Files

The Facebook mobile system suffers from a user enumeration vulnerability.
Tags: facebook enumeration user mobile-system mobile-user vulnerability

0:00
Vuln: Samba SWAT 'user' Field Cross Site Scripting Vulnerability
» ‎ SecurityFocus Vulnerabilities

Samba SWAT 'user' Field Cross Site Scripting Vulnerability
Tags: user swat samba samba-swat cross-site-scripting vulnerability
August 01, 2011
0:00
Vuln: Samba SWAT 'user' Field Cross Site Scripting Vulnerability
» ‎ SecurityFocus Vulnerabilities

Samba SWAT 'user' Field Cross Site Scripting Vulnerability
Tags: user swat samba samba-swat cross-site-scripting vulnerability

July 11, 2011
12:29
Ubuntu Security Notice USN-1166-1
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 1166-1 - Stephane Chauveau discovered that OProfile did not properly perform input validation when processing arguments to opcontrol. A local user who is allowed to run opcontrol with privileges could exploit this to run arbitrary commands as the privileged user. Stephane Chauveau discovered a directory traversal vulnerability in OProfile when processing the --save argument to opcontrol. A local user could exploit this to overwrite arbitrary files with the privileges of the user invoking the program. Various other issues were also addressed.
Tags: user ubuntu opcontrol directory-traversal-vulnerability input-validation privileged-user

12:29
Ubuntu Security Notice USN-1166-1
» ‎ Packet Storm Security Recent Files

Ubuntu Security Notice 1166-1 - Stephane Chauveau discovered that OProfile did not properly perform input validation when processing arguments to opcontrol. A local user who is allowed to run opcontrol with privileges could exploit this to run arbitrary commands as the privileged user. Stephane Chauveau discovered a directory traversal vulnerability in OProfile when processing the --save argument to opcontrol. A local user could exploit this to overwrite arbitrary files with the privileges of the user invoking the program. Various other issues were also addressed.
Tags: user ubuntu opcontrol directory-traversal-vulnerability input-validation privileged-user

12:29
Ubuntu Security Notice USN-1166-1
» ‎ Packet Storm Security Misc. Files

Ubuntu Security Notice 1166-1 - Stephane Chauveau discovered that OProfile did not properly perform input validation when processing arguments to opcontrol. A local user who is allowed to run opcontrol with privileges could exploit this to run arbitrary commands as the privileged user. Stephane Chauveau discovered a directory traversal vulnerability in OProfile when processing the --save argument to opcontrol. A local user could exploit this to overwrite arbitrary files with the privileges of the user invoking the program. Various other issues were also addressed.
Tags: user ubuntu opcontrol directory-traversal-vulnerability input-validation privileged-user

July 08, 2011
15:23
Voice recognition system controls everything, hopefully won’t kill us.
» ‎ Hack a Day

[Aaron Bitler] and [Bud Townsend] have been working a natural user system that is, in their own words, “what android@home should have been.” The video they posted is pretty impressive. The automation system responds to voice and can control appliances, ‘throw a party’, and provide a user with their location. This is just the foundation [...]
Tags: user voice system bud-townsend aaron-bitler voice-recognition-system automation-system bitler home hacks

June 30, 2011
5:24
Asterisk 1.8.x SIP User Enumeration
» ‎ Packet Storm Security Exploits

The INVITE method in use by Asterisk version 1.8.4.4 allows for remote user enumeration.
Tags: enumeration asterisk user sip

5:24
Asterisk 1.8.x SIP User Enumeration
» ‎ Packet Storm Security Recent Files

The INVITE method in use by Asterisk version 1.8.4.4 allows for remote user enumeration.
Tags: enumeration asterisk user sip

5:24
Asterisk 1.8.x SIP User Enumeration
» ‎ Packet Storm Security Misc. Files

The INVITE method in use by Asterisk version 1.8.4.4 allows for remote user enumeration.
Tags: enumeration asterisk user sip

June 29, 2011
22:12
Zero Day Initiative Advisory 11-228
» ‎ Packet Storm Security Advisories

Zero Day Initiative Advisory 11-228 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Safari on Windows and multiple applications on OSX. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The flaw exists within the ColorSync component which is used when handling image files containing embedded ICC data. When handling the ncl2 tag the process miscalculates an integer value used in a memory allocation. This buffer is later used as a destination when copying user controlled data. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the user running the application.
Tags: zero vulnerability user apple-safari zero-day memory-allocation

22:12
Zero Day Initiative Advisory 11-228
» ‎ Packet Storm Security Recent Files

Zero Day Initiative Advisory 11-228 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Safari on Windows and multiple applications on OSX. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The flaw exists within the ColorSync component which is used when handling image files containing embedded ICC data. When handling the ncl2 tag the process miscalculates an integer value used in a memory allocation. This buffer is later used as a destination when copying user controlled data. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the user running the application.
Tags: zero vulnerability user apple-safari zero-day memory-allocation

22:12
Zero Day Initiative Advisory 11-228
» ‎ Packet Storm Security Misc. Files

Zero Day Initiative Advisory 11-228 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Safari on Windows and multiple applications on OSX. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The flaw exists within the ColorSync component which is used when handling image files containing embedded ICC data. When handling the ncl2 tag the process miscalculates an integer value used in a memory allocation. This buffer is later used as a destination when copying user controlled data. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the user running the application.
Tags: zero vulnerability user apple-safari zero-day memory-allocation

June 28, 2011
18:59
Groupon India Publishes 300,000 User Passwords
» ‎ Packet Storm Security Headlines

Groupon India Publishes 300,000 User Passwords
Tags: groupon publishes user india passwords

12:30
Trixbox 2.8.0.4 User Enumeration
» ‎ Packet Storm Security Exploits

Trixbox versions 2.8.0.4 and below suffer from a remote user enumeration vulnerability via the Flash Operator Panel.
Tags: trixbox enumeration user operator-panel vulnerability

12:30
Trixbox 2.8.0.4 User Enumeration
» ‎ Packet Storm Security Recent Files

Trixbox versions 2.8.0.4 and below suffer from a remote user enumeration vulnerability via the Flash Operator Panel.
Tags: trixbox enumeration user operator-panel vulnerability

12:30
Trixbox 2.8.0.4 User Enumeration
» ‎ Packet Storm Security Misc. Files

Trixbox versions 2.8.0.4 and below suffer from a remote user enumeration vulnerability via the Flash Operator Panel.
Tags: trixbox enumeration user operator-panel vulnerability

12:19
Apache Tomcat Information Disclosure
» ‎ Packet Storm Security Advisories

Tomcat versions 7.0.0 through 7.0.16, 6.0.0 through 6.0.32, and 5.5.0 through 5.5.33 suffer from an information disclosure vulnerability. When using the MemoryUserDatabase (based on tomcat-users.xml) and creating users via JMX, an exception during the user creation process may trigger an error message in the JMX client that includes the user's password. This error message is also written to the Tomcat logs. User passwords are visible to administrators with JMX access and/or administrators with read access to the tomcat-users.xml file. Users that do not have these permissions but are able to read log files may be able to discover a user's password.
Tags: user jmx tomcat information-disclosure-vulnerability apache-tomcat error-message

12:19
Apache Tomcat Information Disclosure
» ‎ Packet Storm Security Recent Files

Tomcat versions 7.0.0 through 7.0.16, 6.0.0 through 6.0.32, and 5.5.0 through 5.5.33 suffer from an information disclosure vulnerability. When using the MemoryUserDatabase (based on tomcat-users.xml) and creating users via JMX, an exception during the user creation process may trigger an error message in the JMX client that includes the user's password. This error message is also written to the Tomcat logs. User passwords are visible to administrators with JMX access and/or administrators with read access to the tomcat-users.xml file. Users that do not have these permissions but are able to read log files may be able to discover a user's password.
Tags: user jmx tomcat information-disclosure-vulnerability apache-tomcat error-message

12:19
Apache Tomcat Information Disclosure
» ‎ Packet Storm Security Misc. Files

Tomcat versions 7.0.0 through 7.0.16, 6.0.0 through 6.0.32, and 5.5.0 through 5.5.33 suffer from an information disclosure vulnerability. When using the MemoryUserDatabase (based on tomcat-users.xml) and creating users via JMX, an exception during the user creation process may trigger an error message in the JMX client that includes the user's password. This error message is also written to the Tomcat logs. User passwords are visible to administrators with JMX access and/or administrators with read access to the tomcat-users.xml file. Users that do not have these permissions but are able to read log files may be able to discover a user's password.
Tags: user jmx tomcat information-disclosure-vulnerability apache-tomcat error-message

June 27, 2011
16:33
Google Turns Over User Data In 94% Of US Demands
» ‎ Packet Storm Security Headlines

Google Turns Over User Data In 94% Of US Demands
Tags: google data user

16:10
Zero Day Initiative Advisory 11-226
» ‎ Packet Storm Security Advisories

Zero Day Initiative Advisory 11-226 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Citrix EdgeSight. Authentication is not required to exploit this vulnerability. The flaw exists within the LauncherService.exe component which listens by default on TCP port 18747. When handling a request the process trusts a user supplied field in the packet specifying the length of data to follow, the process then copies the user supplied data, without validation, into a fixed-length buffer on the heap. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the SYSTEM user.
Tags: user zero vulnerability exe-component zero-day arbitrary-code

16:10
Zero Day Initiative Advisory 11-226
» ‎ Packet Storm Security Recent Files

Zero Day Initiative Advisory 11-226 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Citrix EdgeSight. Authentication is not required to exploit this vulnerability. The flaw exists within the LauncherService.exe component which listens by default on TCP port 18747. When handling a request the process trusts a user supplied field in the packet specifying the length of data to follow, the process then copies the user supplied data, without validation, into a fixed-length buffer on the heap. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the SYSTEM user.
Tags: user zero vulnerability exe-component zero-day arbitrary-code

16:10
Zero Day Initiative Advisory 11-226
» ‎ Packet Storm Security Misc. Files

Zero Day Initiative Advisory 11-226 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Citrix EdgeSight. Authentication is not required to exploit this vulnerability. The flaw exists within the LauncherService.exe component which listens by default on TCP port 18747. When handling a request the process trusts a user supplied field in the packet specifying the length of data to follow, the process then copies the user supplied data, without validation, into a fixed-length buffer on the heap. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the SYSTEM user.
Tags: user zero vulnerability exe-component zero-day arbitrary-code

June 22, 2011
23:19
Ubuntu Security Notice USN-1157-2
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 1157-2 - USN-1157-1 fixed vulnerabilities in Firefox. This update provides updated packages for use with Firefox 5. Bob Clary, Kevin Brosnan, Gary Kwong, Jesse Ruderman, Christian Biesinger, Bas Schouten, Igor Bukanov, Bill McCloskey, Olli Pettay, Daniel Veditz and Marcia Knous discovered multiple memory vulnerabilities in the browser rendering engine. An attacker could possibly execute arbitrary code with the privileges of the user invoking Firefox. Martin Barbella discovered that under certain conditions, viewing a XUL document while JavaScript was disabled caused deleted memory to be accessed. An attacker could potentially use this to crash Firefox or execute arbitrary code with the privileges of the user invoking Firefox. Jordi Chancel discovered a vulnerability on multipart/x-mixed-replace images due to memory corruption. An attacker could potentially use this to crash Firefox or execute arbitrary code with the privileges of the user invoking Firefox. Chris Rohlf and Yan Ivnitskiy discovered an integer overflow vulnerability in JavaScript Arrays. An attacker could potentially use this to execute arbitrary code with the privileges of the user invoking Firefox. It was discovered that Firefox's WebGL textures did not honor same-origin policy. If a user were tricked into viewing a malicious site, an attacker could potentially view image data from a different site. Christoph Diehl discovered an out-of-bounds read vulnerability in WebGL code. An attacker could potentially read data that other processes had stored in the GPU. Christoph Diehl discovered an invalid write vulnerability in WebGL code. An attacker could potentially use this to execute arbitrary code with the privileges of the user invoking Firefox. It was discovered that an unauthorized site could trigger an installation dialog for addons and themes. If a user were tricked into viewing a malicious site, an attacker could possibly trick the user into installing a malicious addon or theme. Mario Heiderich discovered a vulnerability in displaying decoded HTML-encoded entities inside SVG elements. An attacker could utilize this to perform cross-site scripting attacks. Various other issues were also addressed.
Tags: user attacker firefox christian-biesinger igor-bukanov jordi-chancel martin-barbella kevin-brosnan jesse-ruderman christoph-diehl daniel-veditz

23:19
Ubuntu Security Notice USN-1157-2
» ‎ Packet Storm Security Recent Files

Ubuntu Security Notice 1157-2 - USN-1157-1 fixed vulnerabilities in Firefox. This update provides updated packages for use with Firefox 5. Bob Clary, Kevin Brosnan, Gary Kwong, Jesse Ruderman, Christian Biesinger, Bas Schouten, Igor Bukanov, Bill McCloskey, Olli Pettay, Daniel Veditz and Marcia Knous discovered multiple memory vulnerabilities in the browser rendering engine. An attacker could possibly execute arbitrary code with the privileges of the user invoking Firefox. Martin Barbella discovered that under certain conditions, viewing a XUL document while JavaScript was disabled caused deleted memory to be accessed. An attacker could potentially use this to crash Firefox or execute arbitrary code with the privileges of the user invoking Firefox. Jordi Chancel discovered a vulnerability on multipart/x-mixed-replace images due to memory corruption. An attacker could potentially use this to crash Firefox or execute arbitrary code with the privileges of the user invoking Firefox. Chris Rohlf and Yan Ivnitskiy discovered an integer overflow vulnerability in JavaScript Arrays. An attacker could potentially use this to execute arbitrary code with the privileges of the user invoking Firefox. It was discovered that Firefox's WebGL textures did not honor same-origin policy. If a user were tricked into viewing a malicious site, an attacker could potentially view image data from a different site. Christoph Diehl discovered an out-of-bounds read vulnerability in WebGL code. An attacker could potentially read data that other processes had stored in the GPU. Christoph Diehl discovered an invalid write vulnerability in WebGL code. An attacker could potentially use this to execute arbitrary code with the privileges of the user invoking Firefox. It was discovered that an unauthorized site could trigger an installation dialog for addons and themes. If a user were tricked into viewing a malicious site, an attacker could possibly trick the user into installing a malicious addon or theme. Mario Heiderich discovered a vulnerability in displaying decoded HTML-encoded entities inside SVG elements. An attacker could utilize this to perform cross-site scripting attacks. Various other issues were also addressed.
Tags: user attacker firefox christian-biesinger igor-bukanov jordi-chancel martin-barbella kevin-brosnan jesse-ruderman christoph-diehl daniel-veditz

23:19
Ubuntu Security Notice USN-1157-2
» ‎ Packet Storm Security Misc. Files

Ubuntu Security Notice 1157-2 - USN-1157-1 fixed vulnerabilities in Firefox. This update provides updated packages for use with Firefox 5. Bob Clary, Kevin Brosnan, Gary Kwong, Jesse Ruderman, Christian Biesinger, Bas Schouten, Igor Bukanov, Bill McCloskey, Olli Pettay, Daniel Veditz and Marcia Knous discovered multiple memory vulnerabilities in the browser rendering engine. An attacker could possibly execute arbitrary code with the privileges of the user invoking Firefox. Martin Barbella discovered that under certain conditions, viewing a XUL document while JavaScript was disabled caused deleted memory to be accessed. An attacker could potentially use this to crash Firefox or execute arbitrary code with the privileges of the user invoking Firefox. Jordi Chancel discovered a vulnerability on multipart/x-mixed-replace images due to memory corruption. An attacker could potentially use this to crash Firefox or execute arbitrary code with the privileges of the user invoking Firefox. Chris Rohlf and Yan Ivnitskiy discovered an integer overflow vulnerability in JavaScript Arrays. An attacker could potentially use this to execute arbitrary code with the privileges of the user invoking Firefox. It was discovered that Firefox's WebGL textures did not honor same-origin policy. If a user were tricked into viewing a malicious site, an attacker could potentially view image data from a different site. Christoph Diehl discovered an out-of-bounds read vulnerability in WebGL code. An attacker could potentially read data that other processes had stored in the GPU. Christoph Diehl discovered an invalid write vulnerability in WebGL code. An attacker could potentially use this to execute arbitrary code with the privileges of the user invoking Firefox. It was discovered that an unauthorized site could trigger an installation dialog for addons and themes. If a user were tricked into viewing a malicious site, an attacker could possibly trick the user into installing a malicious addon or theme. Mario Heiderich discovered a vulnerability in displaying decoded HTML-encoded entities inside SVG elements. An attacker could utilize this to perform cross-site scripting attacks. Various other issues were also addressed.
Tags: user attacker firefox christian-biesinger igor-bukanov jordi-chancel martin-barbella kevin-brosnan jesse-ruderman christoph-diehl daniel-veditz

4:05
Twitter notifier lets us know how awesome we are
» ‎ Hack a Day

Let’s admit it, you’re just a little bit vain. Heck, we’re all just a little bit vain when you really think about it. Instructables user [pdxnat] was self-absorbed enough that he constructed an LED “mood light” that alerts him each time someone mentions his user name on Twitter. The build is pretty simple, with most [...]
Tags: twitter user bit mood-light notifier heck arduino hacks

June 21, 2011
12:34
Sitemagic CMS 2010.04.17 Cross Site Scripting
» ‎ Packet Storm Security Exploits

Sitemagic CMS suffers from a XSS vulnerability when parsing user input to the 'SMExt' parameter via GET method in 'index.php'. Attackers can exploit this weakness to execute arbitrary HTML and script code in a user's browser session.
Tags: user sitemagic cms arbitrary-html script-code browser-session

12:34
Sitemagic CMS 2010.04.17 Cross Site Scripting
» ‎ Packet Storm Security Recent Files

Sitemagic CMS suffers from a XSS vulnerability when parsing user input to the 'SMExt' parameter via GET method in 'index.php'. Attackers can exploit this weakness to execute arbitrary HTML and script code in a user's browser session.
Tags: user sitemagic cms arbitrary-html script-code browser-session

12:34
Sitemagic CMS 2010.04.17 Cross Site Scripting
» ‎ Packet Storm Security Misc. Files

Sitemagic CMS suffers from a XSS vulnerability when parsing user input to the 'SMExt' parameter via GET method in 'index.php'. Attackers can exploit this weakness to execute arbitrary HTML and script code in a user's browser session.
Tags: user sitemagic cms arbitrary-html script-code browser-session

June 17, 2011
5:56
Red Hat Security Advisory 2011-0879-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2011-0879-01 - Red Hat Network Satellite provides a solution to organizations requiring absolute control over and privacy of the maintenance and package deployment of their servers. It allows organizations to utilize the benefits of the Red Hat Network without having to provide public Internet access to their servers or other client systems. It was found that RHN Satellite did not protect against Cross-Site Request Forgery attacks. If an authenticated RHN Satellite user visited a specially-crafted web page, it could lead to unauthorized command execution with the privileges of that user, for example, creating a new user account, granting administrator privileges to user accounts, disabling the account of the current user, and so on. Various other issues were also addressed.
Tags: user hat red red-hat-network public-internet-access satellite-user

5:56
Red Hat Security Advisory 2011-0879-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2011-0879-01 - Red Hat Network Satellite provides a solution to organizations requiring absolute control over and privacy of the maintenance and package deployment of their servers. It allows organizations to utilize the benefits of the Red Hat Network without having to provide public Internet access to their servers or other client systems. It was found that RHN Satellite did not protect against Cross-Site Request Forgery attacks. If an authenticated RHN Satellite user visited a specially-crafted web page, it could lead to unauthorized command execution with the privileges of that user, for example, creating a new user account, granting administrator privileges to user accounts, disabling the account of the current user, and so on. Various other issues were also addressed.
Tags: user hat red red-hat-network public-internet-access satellite-user

5:56
Red Hat Security Advisory 2011-0879-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2011-0879-01 - Red Hat Network Satellite provides a solution to organizations requiring absolute control over and privacy of the maintenance and package deployment of their servers. It allows organizations to utilize the benefits of the Red Hat Network without having to provide public Internet access to their servers or other client systems. It was found that RHN Satellite did not protect against Cross-Site Request Forgery attacks. If an authenticated RHN Satellite user visited a specially-crafted web page, it could lead to unauthorized command execution with the privileges of that user, for example, creating a new user account, granting administrator privileges to user accounts, disabling the account of the current user, and so on. Various other issues were also addressed.
Tags: user hat red red-hat-network public-internet-access satellite-user

June 14, 2011
16:00
Zero Day Initiative Advisory 11-201
» ‎ Packet Storm Security Advisories

Zero Day Initiative Advisory 11-201 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Adobe Shockwave Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the Cursor Asset.x32 module responsible for parsing cursor structures from within Director movie files (.dir). While handling a size element, the code performs an unchecked multiplication operation which can cause an integer to wrap. This results in an undersized heap allocation which can be overflowed with user data leading to arbitrary code execution under the context of the user running the browser.
Tags: zero code user arbitrary-code-execution adobe-shockwave-player multiplication-operation

16:00
Zero Day Initiative Advisory 11-201
» ‎ Packet Storm Security Recent Files

Zero Day Initiative Advisory 11-201 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Adobe Shockwave Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the Cursor Asset.x32 module responsible for parsing cursor structures from within Director movie files (.dir). While handling a size element, the code performs an unchecked multiplication operation which can cause an integer to wrap. This results in an undersized heap allocation which can be overflowed with user data leading to arbitrary code execution under the context of the user running the browser.
Tags: zero code user arbitrary-code-execution adobe-shockwave-player multiplication-operation

16:00
Zero Day Initiative Advisory 11-201
» ‎ Packet Storm Security Misc. Files

Zero Day Initiative Advisory 11-201 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Adobe Shockwave Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the Cursor Asset.x32 module responsible for parsing cursor structures from within Director movie files (.dir). While handling a size element, the code performs an unchecked multiplication operation which can cause an integer to wrap. This results in an undersized heap allocation which can be overflowed with user data leading to arbitrary code execution under the context of the user running the browser.
Tags: zero code user arbitrary-code-execution adobe-shockwave-player multiplication-operation

16:00
Zero Day Initiative Advisory 11-200
» ‎ Packet Storm Security Advisories

Zero Day Initiative Advisory 11-200 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Shockwave. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within AudioMixer.x32 module responsible for parsing mixer structures from within Director movie files (.dir). While handling a size element, the code performs an unchecked multiplication operation which can cause an integer to wrap. This results in an undersized heap allocation which can be overflowed with user data leading to arbitrary code execution under the context of the user running the browser.
Tags: zero code user arbitrary-code-execution shockwave-user multiplication-operation

16:00
Zero Day Initiative Advisory 11-200
» ‎ Packet Storm Security Recent Files

Zero Day Initiative Advisory 11-200 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Shockwave. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within AudioMixer.x32 module responsible for parsing mixer structures from within Director movie files (.dir). While handling a size element, the code performs an unchecked multiplication operation which can cause an integer to wrap. This results in an undersized heap allocation which can be overflowed with user data leading to arbitrary code execution under the context of the user running the browser.
Tags: zero code user arbitrary-code-execution shockwave-user multiplication-operation

16:00
Zero Day Initiative Advisory 11-200
» ‎ Packet Storm Security Misc. Files

Zero Day Initiative Advisory 11-200 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Shockwave. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within AudioMixer.x32 module responsible for parsing mixer structures from within Director movie files (.dir). While handling a size element, the code performs an unchecked multiplication operation which can cause an integer to wrap. This results in an undersized heap allocation which can be overflowed with user data leading to arbitrary code execution under the context of the user running the browser.
Tags: zero code user arbitrary-code-execution shockwave-user multiplication-operation

June 13, 2011
13:15
Ubuntu Security Notice USN-1148-1
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 1148-1 - It was discovered that libmodplug did not correctly handle certain malformed S3M media files. If a user or automated system were tricked into opening a crafted S3M file, an attacker could cause a denial of service or possibly execute arbitrary code with privileges of the user invoking the program. It was discovered that libmodplug did not correctly handle certain malformed ABC media files. If a user or automated system were tricked into opening a crafted ABC file, an attacker could cause a denial of service or possibly execute arbitrary code with privileges of the user invoking the program. Various other issues were also addressed.
Tags: user ubuntu security denial-of-service automated-system arbitrary-code

13:15
Ubuntu Security Notice USN-1148-1
» ‎ Packet Storm Security Recent Files

Ubuntu Security Notice 1148-1 - It was discovered that libmodplug did not correctly handle certain malformed S3M media files. If a user or automated system were tricked into opening a crafted S3M file, an attacker could cause a denial of service or possibly execute arbitrary code with privileges of the user invoking the program. It was discovered that libmodplug did not correctly handle certain malformed ABC media files. If a user or automated system were tricked into opening a crafted ABC file, an attacker could cause a denial of service or possibly execute arbitrary code with privileges of the user invoking the program. Various other issues were also addressed.
Tags: user ubuntu security denial-of-service automated-system arbitrary-code

13:15
Ubuntu Security Notice USN-1148-1
» ‎ Packet Storm Security Misc. Files

Ubuntu Security Notice 1148-1 - It was discovered that libmodplug did not correctly handle certain malformed S3M media files. If a user or automated system were tricked into opening a crafted S3M file, an attacker could cause a denial of service or possibly execute arbitrary code with privileges of the user invoking the program. It was discovered that libmodplug did not correctly handle certain malformed ABC media files. If a user or automated system were tricked into opening a crafted ABC file, an attacker could cause a denial of service or possibly execute arbitrary code with privileges of the user invoking the program. Various other issues were also addressed.
Tags: user ubuntu security denial-of-service automated-system arbitrary-code

June 09, 2011
8:12
Zero Day Initiative Advisory 11-191
» ‎ Packet Storm Security Advisories

Zero Day Initiative Advisory 11-191 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java Runtime. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the way Java handles color profiles. When parsing a color profile containing a 'scrn' tag, the process reads a user specified value describing the number of scrn objects in the file. This value is multiplied with the size of an scrn object possibly resulting in an integer overflow. This value is then used to allocate memory to hold all the scrn objects. By providing specific values it is possible to cause a memory corruption that can lead to remote code being executed under to user running the browser.
Tags: user scrn value memory-corruption integer-overflow oracle-java

8:12
Zero Day Initiative Advisory 11-191
» ‎ Packet Storm Security Recent Files

Zero Day Initiative Advisory 11-191 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java Runtime. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the way Java handles color profiles. When parsing a color profile containing a 'scrn' tag, the process reads a user specified value describing the number of scrn objects in the file. This value is multiplied with the size of an scrn object possibly resulting in an integer overflow. This value is then used to allocate memory to hold all the scrn objects. By providing specific values it is possible to cause a memory corruption that can lead to remote code being executed under to user running the browser.
Tags: user scrn value memory-corruption integer-overflow oracle-java

June 06, 2011
20:12
Zero Day Initiative Advisory 11-181
» ‎ Packet Storm Security Advisories

Zero Day Initiative Advisory 11-181 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell iPrint Client. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The flaw exists within the nipplib component which is used by both the ActiveX and Netscape compatible browser plugins. When handling the op-printer-list-all-jobs parameter from the user specified printer-url the process blindly copies user supplied data into a fixed-length buffer on the stack. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the browser.
Tags: zero vulnerability user novell-iprint zero-day target

20:12
Zero Day Initiative Advisory 11-181
» ‎ Packet Storm Security Misc. Files

Zero Day Initiative Advisory 11-181 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell iPrint Client. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The flaw exists within the nipplib component which is used by both the ActiveX and Netscape compatible browser plugins. When handling the op-printer-list-all-jobs parameter from the user specified printer-url the process blindly copies user supplied data into a fixed-length buffer on the stack. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the browser.
Tags: zero vulnerability user novell-iprint zero-day target

20:12
Zero Day Initiative Advisory 11-180
» ‎ Packet Storm Security Advisories

Zero Day Initiative Advisory 11-180 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell iPrint Client. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The flaw exists within the nipplib component which is used by both the ActiveX and Netscape compatible browser plugins. When handling the op-printer-list-all-jobs parameter from the user specified printer-url the process blindly copies user supplied data into a fixed-length buffer on the stack. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the browser.
Tags: zero vulnerability user novell-iprint zero-day target

20:12
Zero Day Initiative Advisory 11-180
» ‎ Packet Storm Security Recent Files

Zero Day Initiative Advisory 11-180 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell iPrint Client. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The flaw exists within the nipplib component which is used by both the ActiveX and Netscape compatible browser plugins. When handling the op-printer-list-all-jobs parameter from the user specified printer-url the process blindly copies user supplied data into a fixed-length buffer on the stack. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the browser.
Tags: zero vulnerability user novell-iprint zero-day target

20:12
Zero Day Initiative Advisory 11-180
» ‎ Packet Storm Security Misc. Files

Zero Day Initiative Advisory 11-180 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell iPrint Client. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The flaw exists within the nipplib component which is used by both the ActiveX and Netscape compatible browser plugins. When handling the op-printer-list-all-jobs parameter from the user specified printer-url the process blindly copies user supplied data into a fixed-length buffer on the stack. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the browser.
Tags: zero vulnerability user novell-iprint zero-day target

19:51
Zero Day Initiative Advisory 11-179
» ‎ Packet Storm Security Advisories

Zero Day Initiative Advisory 11-179 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell iPrint Client. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The flaw exists within the nipplib component which is used by both the ActiveX and Netscape compatible browser plugins. When handling the iprint-client-config-info parameter from the user specified printer-url the process blindly copies user supplied data into a fixed-length buffer on the stack. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the browser.
Tags: zero vulnerability user novell-iprint client-config zero-day

19:51
Zero Day Initiative Advisory 11-179
» ‎ Packet Storm Security Recent Files

Zero Day Initiative Advisory 11-179 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell iPrint Client. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The flaw exists within the nipplib component which is used by both the ActiveX and Netscape compatible browser plugins. When handling the iprint-client-config-info parameter from the user specified printer-url the process blindly copies user supplied data into a fixed-length buffer on the stack. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the browser.
Tags: zero vulnerability user novell-iprint client-config zero-day

19:51
Zero Day Initiative Advisory 11-179
» ‎ Packet Storm Security Misc. Files

Zero Day Initiative Advisory 11-179 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell iPrint Client. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The flaw exists within the nipplib component which is used by both the ActiveX and Netscape compatible browser plugins. When handling the iprint-client-config-info parameter from the user specified printer-url the process blindly copies user supplied data into a fixed-length buffer on the stack. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the browser.
Tags: zero vulnerability user novell-iprint client-config zero-day

19:43
Zero Day Initiative Advisory 11-178
» ‎ Packet Storm Security Advisories

Zero Day Initiative Advisory 11-178 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell iPrint Client. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The flaw exists within the nipplib component which is used by both the ActiveX and Netscape compatible browser plugins. When handling the client-file-name parameter from the user specified printer-url the process blindly copies user supplied data into a fixed-length buffer on the heap. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the browser.
Tags: zero vulnerability user novell-iprint zero-day target

19:43
Zero Day Initiative Advisory 11-178
» ‎ Packet Storm Security Recent Files

Zero Day Initiative Advisory 11-178 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell iPrint Client. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The flaw exists within the nipplib component which is used by both the ActiveX and Netscape compatible browser plugins. When handling the client-file-name parameter from the user specified printer-url the process blindly copies user supplied data into a fixed-length buffer on the heap. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the browser.
Tags: zero vulnerability user novell-iprint zero-day target

19:43
Zero Day Initiative Advisory 11-178
» ‎ Packet Storm Security Misc. Files

Zero Day Initiative Advisory 11-178 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell iPrint Client. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The flaw exists within the nipplib component which is used by both the ActiveX and Netscape compatible browser plugins. When handling the client-file-name parameter from the user specified printer-url the process blindly copies user supplied data into a fixed-length buffer on the heap. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the browser.
Tags: zero vulnerability user novell-iprint zero-day target

18:46
Zero Day Initiative Advisory 11-177
» ‎ Packet Storm Security Advisories

Zero Day Initiative Advisory 11-177 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell iPrint Client. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The flaw exists within the nipplib component which is used by both the ActiveX and Netscape compatible browser plugins. When handling the core-package parameter from the user specified printer-url the process blindly copies user supplied data into a fixed-length buffer on the heap. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the browser.
Tags: zero vulnerability user novell-iprint zero-day target

18:46
Zero Day Initiative Advisory 11-177
» ‎ Packet Storm Security Recent Files

Zero Day Initiative Advisory 11-177 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell iPrint Client. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The flaw exists within the nipplib component which is used by both the ActiveX and Netscape compatible browser plugins. When handling the core-package parameter from the user specified printer-url the process blindly copies user supplied data into a fixed-length buffer on the heap. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the browser.
Tags: zero vulnerability user novell-iprint zero-day target

18:46
Zero Day Initiative Advisory 11-177
» ‎ Packet Storm Security Misc. Files

Zero Day Initiative Advisory 11-177 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell iPrint Client. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The flaw exists within the nipplib component which is used by both the ActiveX and Netscape compatible browser plugins. When handling the core-package parameter from the user specified printer-url the process blindly copies user supplied data into a fixed-length buffer on the heap. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the browser.
Tags: zero vulnerability user novell-iprint zero-day target

18:45
Zero Day Initiative Advisory 11-176
» ‎ Packet Storm Security Advisories

Zero Day Initiative Advisory 11-176 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell iPrint Client. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The flaw exists within the nipplib component which is used by both the ActiveX and Netscape compatible browser plugins. When handling the driver-version parameter from the user specified printer-url the process blindly copies user supplied data into a fixed-length buffer on the heap. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the browser.
Tags: zero vulnerability user novell-iprint zero-day target

18:45
Zero Day Initiative Advisory 11-176
» ‎ Packet Storm Security Recent Files

Zero Day Initiative Advisory 11-176 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell iPrint Client. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The flaw exists within the nipplib component which is used by both the ActiveX and Netscape compatible browser plugins. When handling the driver-version parameter from the user specified printer-url the process blindly copies user supplied data into a fixed-length buffer on the heap. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the browser.
Tags: zero vulnerability user novell-iprint zero-day target

Skip to page: 1 2 3

TOP RSS Atom Tentatively valid XHTML1.0, CSS2.0 Last Update: Fri 25 May 2012 08:00:26 PM PDT Jetlib

jetlib.sec » Tags » user

Feeds

611 items tagged "user"

Tags: database user sql relational-database-management relational-database-management-system database-management-system

Tags: database user sql relational-database-management relational-database-management-system database-management-system

Tags: database user sql relational-database-management relational-database-management-system database-management-system

Tags: user ubuntu firefox julian-seward hilary-hall gary-kwong christian-holler jesse-ruderman brian-hackett bob-clary memory-safety

Tags: user ubuntu firefox julian-seward hilary-hall gary-kwong christian-holler jesse-ruderman brian-hackett bob-clary memory-safety

Tags: imagemagick user ubuntu denial-of-service joonas automated-system

Tags: imagemagick user ubuntu denial-of-service joonas automated-system

Tags: imagemagick user ubuntu denial-of-service joonas automated-system

Tags: user ubuntu firefox julian-seward hilary-hall gary-kwong christian-holler jesse-ruderman brian-hackett bob-clary memory-safety

Tags: user ubuntu firefox julian-seward hilary-hall gary-kwong christian-holler jesse-ruderman brian-hackett bob-clary memory-safety

Tags: user ubuntu firefox julian-seward hilary-hall gary-kwong christian-holler jesse-ruderman brian-hackett bob-clary memory-safety

Tags: user security asterisk manager-interface shell-commands project-security

Tags: user security asterisk manager-interface shell-commands project-security

Tags: user security asterisk manager-interface shell-commands project-security

Tags: manager asterisk user unauthorized-shell bugtraq ast

Tags: day zero user heap-memory curve-data memory-corruption

Tags: day zero user heap-memory curve-data memory-corruption

Tags: user hadoop apache impersonation cve vulnerability

Tags: hadoop apache user impersonation vulnerability

Tags: hadoop apache user impersonation vulnerability

Tags: user ubuntu security alexander-gavrun tiff tiff-library tiff-image denial-of-service

Tags: ricoh user ftp dc-dl- based-buffer-overflow code-execution

Tags: ricoh user ftp dc-dl- based-buffer-overflow code-execution

Tags: ricoh user ftp dc-dl- based-buffer-overflow code-execution

Tags: user attacker svg dalili bob-clary willem-pinckaers svg-animations application-crash memory-safety

Tags: user attacker svg dalili bob-clary willem-pinckaers svg-animations application-crash memory-safety

Tags: user attacker svg dalili bob-clary willem-pinckaers svg-animations application-crash memory-safety

Tags: user font freetype mateusz-jurczyk truetype-font-files bdf-font mateusz

Tags: user font freetype mateusz-jurczyk truetype-font-files bdf-font mateusz

Tags: user font freetype mateusz-jurczyk truetype-font-files bdf-font mateusz

Tags: user attacker svg svg-animations application-crash denial-of-service

Tags: user attacker svg svg-animations application-crash denial-of-service

Tags: user attacker svg svg-animations application-crash denial-of-service

Tags: xss user application artur-janc chaos-communication-congress application-authors novel-techniques

Tags: user shell lshell shell-environment

Tags: user shell lshell shell-environment

Tags: user shell lshell shell-environment

Tags: user shell lshell shell-environment

Tags: user shell lshell shell-environment

Tags: user shell lshell shell-environment

Tags: user linux passwd

Tags: shellcode password user linux

Tags: shellcode password user linux

Tags: enumeration wordpress user vulnerability

Tags: enumeration wordpress user vulnerability

Tags: enumeration wordpress user vulnerability

Tags: user swat samba samba-swat cross-site-scripting vulnerability

Tags: user ubuntu flaw paolo-bonzini linux-kernel bonzini denial-of-service

Tags: user ubuntu flaw paolo-bonzini linux-kernel bonzini denial-of-service

Tags: user ubuntu flaw paolo-bonzini linux-kernel bonzini denial-of-service

Tags: user ubuntu flaw paolo-bonzini programmable-interval-timer bonzini denial-of-service

Tags: user ubuntu flaw paolo-bonzini programmable-interval-timer bonzini denial-of-service

Tags: user ubuntu flaw paolo-bonzini programmable-interval-timer bonzini denial-of-service

Tags: user ubuntu flaw wen-nienhuys aristide-fattori roberto-paleari internet-group-management-protocol internet-group-management protocol-packets

Tags: user ubuntu flaw wen-nienhuys aristide-fattori roberto-paleari internet-group-management-protocol internet-group-management protocol-packets

Tags: user ubuntu flaw wen-nienhuys aristide-fattori roberto-paleari internet-group-management-protocol internet-group-management protocol-packets

Tags: user ubuntu process paolo-bonzini linux-kernel ioctl security-notice

Tags: user ubuntu process paolo-bonzini linux-kernel ioctl security-notice

Tags: user ubuntu process paolo-bonzini linux-kernel ioctl security-notice

Tags: sms kadu user status-message

Tags: user ioctl flaw integer-overflow red-hat-security linux-kernel

Tags: user ioctl flaw integer-overflow red-hat-security linux-kernel

Tags: user ioctl flaw integer-overflow red-hat-security linux-kernel

Tags: day zero user oracle-java code-execution java-extension

Tags: day zero user oracle-java code-execution java-extension

Tags: day zero user oracle-java code-execution java-extension

Tags: user hat red x.org x-window open-source-implementation graphical-user-interfaces x-window-system

Tags: user hat red x.org x-window open-source-implementation graphical-user-interfaces x-window-system

Tags: user ubuntu thunderbird nicolas-gregoire memory-corruption xslt-stylesheet

Tags: user ubuntu thunderbird nicolas-gregoire memory-corruption xslt-stylesheet

Tags: user ubuntu thunderbird nicolas-gregoire memory-corruption xslt-stylesheet

Tags: user ubuntu security andy-whitcroft programmable-interval-timer permission-checks security-modules

Tags: user ubuntu security andy-whitcroft programmable-interval-timer permission-checks security-modules