«
Expand/Collapse
1989 items tagged "memory corruption"
Related tags:
player [+],
multiple [+],
microsoft office [+],
memory safety [+],
mandriva linux [+],
flash [+],
apple security [+],
advisory [+],
ubuntu [+],
reader [+],
mandriva [+],
linux [+],
excel [+],
windows [+],
realplayer [+],
perl [+],
internet [+],
denial of service [+],
firefox [+],
mozilla firefox [+],
mozilla [+],
symantec products [+],
symantec [+],
security advisory [+],
remote [+],
heap [+],
explorer [+],
dos [+],
david bloom [+],
dalili [+],
cab files [+],
asn [+],
adobe reader version [+],
abhishek arya [+],
thunderbird [+],
memory [+],
wrf [+],
torrent [+],
service vulnerability [+],
openssl [+],
konqueror [+],
jordi chancel [+],
jesse ruderman [+],
internet explorer [+],
henrik skupin [+],
heap memory [+],
encoded [+],
cisco webex [+],
christian holler [+],
cab [+],
picture [+],
perl 5 [+],
oracle [+],
microsoft publisher [+],
microsoft paint [+],
exploits [+],
code execution [+],
vulnerability [+],
free memory [+],
zero [+],
website [+],
vulnerability research [+],
version [+],
user [+],
security technologies [+],
quicktime [+],
publisher [+],
protocol implementation [+],
program memory [+],
paint version [+],
paint [+],
onenote [+],
notice [+],
microsoft office onenote [+],
malicious website [+],
location object [+],
local memory [+],
loading [+],
javascript [+],
java [+],
internet explorer user [+],
homecare [+],
flash player version [+],
datagram sockets [+],
critical vulnerability [+],
corruption issues [+],
client versions [+],
client [+],
cisco [+],
chen haogang [+],
buffer overflows [+],
browser engine [+],
bogofilter [+],
attacker [+],
arctic [+],
arbitrary code execution [+],
apple tv [+],
allscripts [+],
addresses issues [+],
3g2 files [+],
microsoft [+],
corruption [+],
seamonkey [+],
xpath [+],
webex [+],
web [+],
version search [+],
unicode [+],
suite [+],
set [+],
samba [+],
pool [+],
opera web browser [+],
opera [+],
libxml [+],
kernel windows [+],
kernel [+],
invalid [+],
international components [+],
international [+],
ghost [+],
generic kernel [+],
galaxy [+],
fsamsung [+],
components [+],
browser [+],
backup file [+],
proof of concept [+],
webkit [+],
web browser [+],
vlc media player [+],
visio [+],
unspecified [+],
symantec ghost [+],
sumatra pdf [+],
sumatra [+],
stale [+],
solution [+],
shockwave [+],
server memory [+],
server [+],
security research [+],
retired [+],
research [+],
proxy logs [+],
playlist files [+],
pdf [+],
overflow [+],
oracle java [+],
nis [+],
new black authors [+],
nbsp [+],
microsoft windows [+],
microsoft office professional [+],
microsoft excel [+],
mfsa [+],
media [+],
manager [+],
libtasn [+],
libavcodec [+],
krzysztof kowalczyk [+],
kowalczyk [+],
ida [+],
html [+],
heap corruption [+],
gnupg [+],
gnu [+],
giovanni gola [+],
gif [+],
get [+],
fuzzers [+],
free [+],
format [+],
file format [+],
file [+],
ffmpeg [+],
ezserver [+],
ezhometech [+],
extract [+],
exploit [+],
download [+],
chunk [+],
blazevideo [+],
asn1 [+],
application crash [+],
application [+],
apple itunes [+],
anomaly detection [+],
analysis [+],
adobe shockwave player [+],
adobe reader [+],
adobe adobe [+],
acdsee [+],
able2extract [+],
able [+],
poc [+],
adobe [+],
security [+],
office [+],
office excel [+],
adobe flash player [+],
zsl,
zip internet,
zip,
zero day,
zdi,
xslt stylesheet,
xpdf,
xpath expressions,
xnview,
xmlhttp,
xml rpc,
xml file,
xml core,
xml,
xls file,
xls,
xdec,
x.org,
x. i,
x server,
x quicktime,
x mixed replace,
x lite,
x event,
x coretext,
x atsserver,
x 509,
wordpad,
word record,
word html,
word document,
word,
wopt,
wireshark,
wins,
winlicense,
windows xp sp3,
windows fax,
winamp,
win,
width,
wellintech,
webm,
webcore,
web workers,
web browser version,
wavesurfer,
wav file,
wav,
vupen,
vulnerability sun,
vulnerabilities,
vsprintf,
volker lendecke,
voc,
vmware,
vml,
vlc,
virtual function,
viewer,
videolan,
video samples,
video player,
video,
vba,
value,
validation error,
use,
usa,
uninitialized pointer,
uninitialized,
type font,
type conversion,
type,
txt,
tsac,
truetype,
tpti,
touch,
totvs,
tom sawyer software,
tom sawyer,
tls,
tkadv,
timed interactive multimedia extensions,
time implementation,
tiff image,
tiff file,
tiff,
thumbnail,
tgz,
text converter,
text,
termination,
terminal,
telnet,
technical,
tcp implementations,
target service,
taglib,
tag,
tabular,
t interactive,
t during,
systemtap,
system management tasks,
system,
sxview,
svg,
surface,
sun,
sumatrapdf,
subtitle,
substr,
style tag,
style,
stunnel,
striptags,
string,
stack overflow,
stack data,
stack buffer,
stack,
ssl,
srose,
src,
sr6,
sql,
spreadsheet files,
speedcommander,
speed commander,
sp3,
sound,
sorenson 3,
sorenson,
soffice,
smtp server,
smtp,
smb,
slimpdf,
slim,
sketchup,
size values,
size,
sip version,
sip,
silverlight,
signalsec,
sign,
shockwave director,
shockwave 3d,
setoutertext,
session,
service,
server versions,
server list,
server authentication,
seq,
semiconductor,
security extension,
secunia,
sctp,
scrn,
script kiddies,
scada system,
scada,
sasl,
sanctuary,
sample,
samba project,
safer use,
safari browser,
safari,
rv10,
ruby,
rtf document,
rtf,
rtd,
rsa public keys,
rpm,
rose protocol,
rose,
root privileges,
response handling,
response,
repro,
render,
regular expression,
red hat security,
red,
record,
realplayer user,
realnetworks inc,
realnetworks,
reaktor,
reader acrobat,
read,
rdesktop,
rcsl,
raw,
rar,
ralf philipp,
quicktime player,
quicktime pict,
quicktime media player,
quicklook,
qtextengine,
qdm,
qdca,
python,
pubconv,
pseudo,
psd,
psaux,
protocol,
property,
project strings,
project origin,
progressive mesh,
proficy,
professional,
procyon,
processor,
process,
privilege escalation vulnerability,
preview,
powerhmi,
postscript,
postfix,
poppler,
policy,
png,
pmp,
player versions,
plant applications,
php,
photoshop,
peamp,
pdf parser,
pct,
pcap,
pc to,
patch,
passport,
parsing,
parser,
parent,
packet,
pac designer,
overflow vulnerability,
oss,
org,
oreans,
oracle database,
option element,
option,
opiereadrec,
opie,
operation,
opera browser,
openstack,
openoffice,
open source solutions,
ogg vorbis files,
officeimport,
office publisher,
ocx versions,
object pointer,
object memory,
object initialization,
object element,
object,
numeric character references,
numeric,
null pointer,
nsfocus,
novell groupwise,
novell,
nova cve ,
nova,
notification,
nicolas gregoire,
ngs,
network node manager,
netbsd,
ndr,
ncss,
native instruments,
native,
name,
mxf,
multiple products,
multipart,
msxml2,
msxml,
msexcel,
ms10,
mp3 file,
mp3 center,
movie file,
movie,
movicon,
morris worm,
moonlight,
month,
module,
mod,
mobile devices,
moaub,
mkv,
mit kerberos,
mit,
misc,
mime type,
mime,
midi synth,
midi interface,
midi,
microsoft xml,
microsoft wordpad,
microsoft word,
microsoft windows media player,
microsoft windows media,
microsoft visio,
microsoft sql server,
microsoft silverlight,
microsoft office word,
microsoft office document,
microsoft office 2007,
microsoft gdi,
microsiga,
messenger,
message,
memory registers,
memory memory,
memory leak,
memory heap,
memory copy,
memory buffer,
memory analysis,
memory allocation,
memory accesses,
mdvsa,
mateusz kocielski,
martin barbella,
manager. authentication,
macos x,
macos systems,
mac realplayer,
mac os x,
mac os,
mac,
lumension,
lotus notes client,
lotus inotes,
lotus,
loop iterations,
loop condition,
loop,
log,
lithtech engine,
lithtech,
lite,
listener,
linux security,
linux kernels,
linux kernel,
libvpx,
libtiff,
libreoffice,
library,
libpng,
lib,
left,
layoutdata,
lattice semiconductor,
lattice,
lack of sanity,
kingview,
keyview,
key exchange,
kernel memory,
kernel internals,
kernel extensions,
kerberos,
kdc,
kaspersky,
jpeg,
jonathan brossard,
jon oberheide,
javascript event handler,
javascript engine,
java system,
java runtime environment,
java applet tag,
isapi,
irfanview,
ipswitch,
ipp,
ipod,
iphone,
ipcomp,
ios,
invalid pointer,
invalid addresses,
internetexploiter,
internet explorer object,
internet explorer link,
internet explorer 8,
internet exploiter,
integer overflow,
integer,
instruments,
inspircd,
input validation,
initiative,
informix dynamic server,
information store,
information disclosure,
infinite loop,
infinite,
index structure,
index,
incredimail,
incorrect permissions,
imshextu,
import,
implementation,
imail server,
imail,
imageio,
image element,
image decompression,
image converter,
image,
illustrator,
idefense security advisory,
idefense,
icoolplayer,
ica,
htmldlghelper,
html object,
html image,
html iframe,
html engine,
html elements,
html element,
htc,
host memory,
host,
holdem,
history,
high profile companies,
hfpicture,
heap allocation,
hat,
handling,
handler,
hacker folklore,
gsm,
groupwise,
graphical,
gpu,
google sketchup,
google,
gnutls,
glibc,
ghostscript,
geolocation,
gdtoa,
gdi,
gateprotectcc,
function pointers,
function,
ftp server,
ftp,
ftagent,
freetype,
freebsd,
framework,
frameset,
fpx,
fortinet,
fortiguard,
formula,
format validation,
format string,
format specifiers,
focus events,
fm synthesizer,
flow data,
flock,
floats,
flaw,
flashpix,
flash player 10,
fixed,
filter,
file descriptor,
fg vd,
fax services,
fax cover page,
fax,
factory,
fabian yamaguchi,
f.e.a.r,
extension,
extended,
expression,
expoits,
exploiter,
exploitation techniques,
exploitation,
exchange,
excelrtd,
excel formula,
eviews,
event,
escalation,
erp,
engine,
encoding,
encapsulation,
emf,
emc,
elements,
element,
edrawsoft,
editing,
e. quicktime,
dynamic libraries,
driver ghostscript,
dos vulnerability,
dominic chell,
dom event,
dom,
doc,
dns,
dllmain,
dll module,
dll,
distribution,
displayed,
display,
disclosure issues,
directory traversal,
directory services,
directory server,
directory,
director file,
director dirapi,
dirapi,
dino dai zovi,
dimensional vector,
device,
desktop memory,
design,
dep,
denial,
del,
default media player,
decoder,
decode,
debian,
day,
database server,
database,
data execution prevention,
dan rosenburg,
dan rosenberg,
dae,
d remote,
d parsing,
d object,
d memory,
cyrus sasl library,
cyrus sasl,
cyrus,
cve,
curve data,
cups,
cswv,
css format,
css clip,
css,
cryptographic message syntax,
cryptographic,
cpp,
could allow remote code execution,
corruption bug,
correct memory,
corelan,
core,
cooltype,
converter,
control microsoft,
control,
compat,
communication,
commands,
commander,
color profiles,
codec,
code,
clod,
clayout,
class memory,
class,
clamav,
citrix systems inc,
citrix ica client,
citrix,
chrome,
chris evans,
chm,
chell,
checkpoint,
charstrings,
charlie miller,
character,
chaos communication congress,
chancel,
cfnetwork,
cascading style sheets,
canon camera,
camera,
bytecode,
bypass,
buzz,
bugtraq,
bugs microsoft,
bug hunters,
bug,
buffer overflow vulnerability,
buffer overflow,
buffer memory,
buffer,
bsd distributions,
brute force attack,
browser memory,
browser applications,
boston,
bmp,
blog entry,
biff,
bibtex,
bib,
beta,
based buffer overflow,
baseband,
base,
barbella,
avi file,
avi,
avast antivirus,
avast,
autovue,
autostart,
autonomy,
authentication mechanisms,
aurora,
audition,
audioop,
audio content,
attribute,
attackers,
atom type,
asfheader,
array index,
array data,
array,
arithmetic operations,
arithmetic operation,
argv,
archive,
arbitrary execution,
arbitrary code,
arbitrary,
apsb,
apple xnu,
apple webkit,
apple sandbox,
apple safari,
apple quicktime player,
apple quicktime,
apple preview,
apple os x,
apple os,
apple officeimport,
apple mobile,
apple macos,
apple mac os x,
apple mac os,
apple lossless,
apple iphone,
apple ios,
apple directory,
apple coregraphics,
apple coregraphics,
apple,
appendchild,
apache,
amv,
altova,
alpha specific,
alloca,
advanced audio coding,
adobeshockwave,
adobe systems inc,
adobe photoshop elements,
adobe photoshop,
adobe pdf,
adobe illustrator,
adobe director,
adobe audition,
adobe acrobat reader,
adobe acrobat,
address,
activex control,
activex,
active x,
active,
acrobat,
access,
abysssec,
able2doc,
aavmker,
Support,
Software,
Skype,
Bugs
Skip to page:
1
2
3
...
8
-
-
16:00
»
SecuriTeam
Able2Extract and Able2Extract Server v 6.0 suffers from memory corruption vulnerability
-
-
7:41
»
Packet Storm Security Advisories
Zero Day Initiative Advisory 12-193 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the way Internet Explorer handles repeated calls to insertAdjacentText. When the size of the element reaches a certain threshold Internet Explorer fails to correctly relocate key elements. An initialized variable in one of the function can cause memory corruption. This can lead to remote code execution under the context of the program.
-
7:41
»
Packet Storm Security Recent Files
Zero Day Initiative Advisory 12-193 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the way Internet Explorer handles repeated calls to insertAdjacentText. When the size of the element reaches a certain threshold Internet Explorer fails to correctly relocate key elements. An initialized variable in one of the function can cause memory corruption. This can lead to remote code execution under the context of the program.
-
7:41
»
Packet Storm Security Misc. Files
Zero Day Initiative Advisory 12-193 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the way Internet Explorer handles repeated calls to insertAdjacentText. When the size of the element reaches a certain threshold Internet Explorer fails to correctly relocate key elements. An initialized variable in one of the function can cause memory corruption. This can lead to remote code execution under the context of the program.
-
-
16:00
»
SecuriTeam
Adobe Flash Player and AIR are prone to a remote memory-corruption vulnerability.
-
16:00
»
SecuriTeam
Opera Web Browser is prone to a remote memory-corruption vulnerability.
-
-
16:00
»
SecuriTeam
Perl is prone to a heap-based memory-corruption vulnerability.
-
-
16:00
»
SecuriTeam
Mozilla Firefox, SeaMonkey, and Thunderbird are prone to a heap-based memory-corruption vulnerability.
-
16:00
»
SecuriTeam
Microsoft Office Picture Manager is prone to a remote memory-corruption vulnerability.
-
-
16:00
»
SecuriTeam
Adobe Reader is prone to a remote memory-corruption vulnerability.
-
16:00
»
SecuriTeam
Mozilla Firefox, SeaMonkey, and Thunderbird are prone to a heap-based memory-corruption vulnerability.
-
-
16:00
»
SecuriTeam
Adobe Shockwave Player is prone to an unspecified memory-corruption vulnerability.
-
16:00
»
SecuriTeam
Mozilla Firefox, SeaMonkey, and Thunderbird are prone to a memory-corruption vulnerability.
-
-
16:00
»
SecuriTeam
Mozilla Firefox, SeaMonkey, and Thunderbird are prone to a heap-based memory-corruption vulnerability.
-
-
16:00
»
SecuriTeam
Mozilla Firefox, SeaMonkey, and Thunderbird are prone to a memory-corruption vulnerability.
-
-
16:00
»
SecuriTeam
Mozilla Firefox, SeaMonkey, and Thunderbird are prone to a heap-based memory-corruption vulnerability.
-
16:00
»
SecuriTeam
Mozilla Firefox, Thunderbird, and SeaMonkey are prone to a remote memory-corruption vulnerability due to a use-after-free condition.
-
-
16:00
»
SecuriTeam
Microsoft Excel is prone to a remote code-execution vulnerability.
-
-
15:46
»
Packet Storm Security Advisories
Apple Security Advisory 2012-11-07-1 - QuickTime version 7.7.3 is now available and addresses multiple buffer overflows, memory corruption, and use after free vulnerabilities.
-
15:46
»
Packet Storm Security Recent Files
Apple Security Advisory 2012-11-07-1 - QuickTime version 7.7.3 is now available and addresses multiple buffer overflows, memory corruption, and use after free vulnerabilities.
-
15:46
»
Packet Storm Security Misc. Files
Apple Security Advisory 2012-11-07-1 - QuickTime version 7.7.3 is now available and addresses multiple buffer overflows, memory corruption, and use after free vulnerabilities.
-
-
16:00
»
SecuriTeam
The Konqueror web browser is vulnerable to a number of memory corruption vulnerabilities.
-
13:32
»
Carnal0wnage
People tend to focus on various areas as being important for computer security such as memory corruption vulnerabilities, malware, anomaly detection, etc. However the lurking and most critical issue in my opinion is staffing. The truth is, there is no pool of candidates out there to draw from at a certain level in computer security. As an example, we do a lot of consulting, especially in the area of incident response, for oil & gas, avionics, finance, etc. When we go on site we find that we have to have the following skills:
1. Soft skills. (often most important) The ability to talk to customers, dress appropriately, give presentations or speak publicly, assess the customer staff, culture and politics, and determine the real goals. I can't stress enough how important this is. It's not the 90s anymore, showing up with a blue mohawk, a spike in the forehead and leather pants, not a team player, cussing and surfing porn on the customers system doesn't cut it no matter how good you are technically. If you are that guy then you get to stay in the lab and I guarantee you will make far less money. Even if you can write ASLR bypass exploits and kernel rootkits.
2. Document. This ties with the above for number 1. If you didn't document it, you didn't do it. I don't care how awesome an 0day you discovered, or what race condition in the kernel you found. If you cant clearly document it, the customer doesn't care and sees no value in what you did. The documentation has to be clean, clear, layed out so that an executive can understand it and so that the other security firm the customer hires to validate your results doesn't make fun of you.
3.) The ability to mine disparate sets of data. This means taking in apache logs, windows Event logs, proxy logs, full packet captures. Handling, splitting and moving terabytes of data. Writing data mining code in sed/awk/bash/perl/python/ruby. Correlating events, cutting out desired fields, reassembling binary files from packets, etc. Using graphics visualization packages to map out an intruders connections on a network based on netflow data.
4.) Reverse Engineering. This means disassembling binaries in IDA, running binaries in a debugger such as Ollydbg, WinDBG, IDA, memory forensics, and especially de-obfuscation. Can you unpack a binary? How about if the packer is multi-stage and does memory page check summing? What if the packer carries its own virtual machine? Do you know what breakpoints to set, when to change the Z flag, or how to hot patch a binary in memory?
5.) Understanding programming. To be good at this stuff you need to know C, C++, .NET, VB, HTML, ASP, PHP, x86 assembly and another dozen languages, at least well enough to look up APIs, understand standard libraries, discover which imports are important.
6.) Operating systems. You should know the ins and outs including file systems, memory management, kernel, library system and key command line tools of at least half a dozen OS's, especially as they are used in enterprise environments. Domains, NFS, NIS, kerberos, LDAP. So not only windows, linux and OS X, but also solaris, AIX and some embedded or mobile systems.
7.) Exploit development. Often on engagements you run across an exploit or even an 0day that you must reverse engineer, replicate safely and test on the customers particular environment. You have to be able to take it apart, analyse the shellcode, understand everything its doing and re-write your own version of it.
8.) Versatility with a wide variety of tools, many of which are not easy to access outside of the enterprise. At a minimum enough technical base knowledge to use whatever tool is put in front of you. Examples include wireshark, splunk, fireeye, netwitness, arcsight, tippingpoint, snort / sourcefire, bluecoat, websense, TMI, Encase.
All of the members of your team whether you are a consulting shop or an internal incident response team need to be able to do these things and overlap with each other. Some can be stronger in RE than network forensics but everyone has to be able to do all of it to some extent, especially 1 and 2.
The problem with this? These people don't exist, they are unicorns. Those who can do this are either already employed, well payed and tackling more interesting problems than you can offer, or they are running/partners in their own company that you could (and should) outsource to. </shameless self promotion>. But even small boutiques that can do the above are rare, heavily booked, and are charging close to high powered lawyer hourly rates. (when people question rates I point out that big name IR shops are around $400/hr and even the BestBuy geek squad charges $120/hr to reload your OS).
A lot of big contractors are trying to approach security like they did IT in the 90s and 00's. Bid low, win a huge contract, then put out job ads for anyone who knows how to use a computer. The problem is, while you can come up to speed for a help desk or to admin a windows server relatively quickly, the above list of skills takes a decade + to master. So big contractors are failing, badly, and trying to buy up the small guys. But there is another problem there as well.
People who are able to do the above 1.) Value freedom highly and don't want to work 9 to 5 in a cube farm and 2.) Don't want to live or work long periods of time onsite where you are. They don't want to live in Houston or in Cleaveland or in Indianapolis or probably even in the DC area. They want to live in La Jolla and San Francisco and New York and someone, somewhere is willing to pay them a lot to do it, and probably do it remotely most of the time, so you are going to lose there.
In response, many companies try to follow the old plan of recruiting at colleges. In a lot of cases these students come out knowing some Office and probably some Java and that's about it. You might luck out and get a good RIT, Georgia Tech, New Mexico Tech student who knows more but most likely these have already been recruited to the government or somewhere else. And the learning curve time is long enough that by the time they are really good, they have already moved on. This kind of work is PRIME for remote. Let people come in for a week every other month. If you require internal security people to be on site all the time in some crappy city you will fail.
On the security company side you have the same problem, no one to hire. So many security companies, in order to grow (because the way you make money in services is via higher staffing levels) hire whatever they can find and field them. This continues the trend in mediocre security, companies getting owned, PCI, etc. Boutiques cannot grow to the size necessary to win the bigger contracts because there is no one to hire.
The solution many companies have been trying out is to focus on buying appliances and contracting pro services to set them up and hope that automation can solve the problem. It cannot. Here is a perfect example. A customer has a box that detects malware in email attachments. It flagged a PDF as highly malicious. We decided to check it out and at first glance it looked very bad. It had all the classic signs of an exploit, heap spray, etc. You couldn't tell the difference between it and another verified malicious PDF. However, upon further inspection we discovered that a popular autocad type program generated legitimate PDFs that looked this way. This is something that is not automatible. You must have an experienced and skilled analyst to do this. No amount of rack mount, fancy logo appliances will help you. And the bigger your enterprise the more you need. Every enterprise block of 30 - 50k IPs needs a team of 5 - 10 people.
Which leads me to the next issue. How you perceive your staffing resources. Example: One company I saw told they had a staff of 12 analysts to deal with security detection and response. I thought wow pretty good! Lets break the team down:
- A manager, full time in meetings, paperwork, etc.
- An assistant to the manager, secretarial work, etc.
- 3 senior advisers, i.e. guys about to retire, smart guys who give great advice and hold institutional knowledge, but not analysts
- 5 people involved in tool testing, stand up and maintenance (all those boxes I mentioned before). Great guys, not analysts or really involved in analysis
- 1 Developer mostly focused on designing queries and interfaces for the tools.
- 1 Actual analyst.
While management believes they have 12 people and doesn't understand why things take so long they actually have 1 person. This situation is very common in big companies. 1 good analyst for an enterprise is not NEARLY enough. And you can't be reliant on a specific person unless you want to set yourself up for a disaster (while at the same time you must cultivate and care for those star players).
That's my case for why staffing is the most important issue we face in computer security. What is the solution? Some would say training, but lets be honest, were you back home writing rootkits for work after taking Hoglund and Butler's class at Blackhat? Probably not. Have you found piles of valuable 0day after completing Halvar's most excellent course in Vegas? I doubt it. A 2 day - 1 week course isn't doing it. Going through the entire SANS curriculum isn't doing it and CISSP sure as hell isn't doing it.
You have to spend around 6hrs a day, after work, highly focused on coding, reversing, etc. for a minimum of 2 years to be decent. That is how the adversary does it. That's how the big name researchers and best staff does it, and unfortunately you only need a couple of attackers for every 10 defenders out there.
V.
-
-
17:00
»
SecuriTeam
FFmpeg is prone to a heap-based memory-corruption vulnerability because it fails to properly validate user-supplied data.
-
-
17:00
»
SecuriTeam
Cisco WebEx is prone to multiple remote memory-corruption vulnerabilities.
-
17:00
»
SecuriTeam
Ezhometech EzServer is prone to a remote heap-based memory-corruption vulnerability.
-
-
17:00
»
SecuriTeam
Samba is prone to a memory-corruption vulnerability.
-
17:00
»
SecuriTeam
Symantec Ghost Solutions Suite is prone to a remote memory-corruption vulnerability.
-
15:46
»
Packet Storm Security Advisories
The Perl 5 interpreter is vulnerable to a memory corruption vulnerability which results in memory disclosure and potentially arbitrary code execution when large values are supplied to the x operator.
-
15:46
»
Packet Storm Security Recent Files
The Perl 5 interpreter is vulnerable to a memory corruption vulnerability which results in memory disclosure and potentially arbitrary code execution when large values are supplied to the x operator.
-
15:46
»
Packet Storm Security Misc. Files
The Perl 5 interpreter is vulnerable to a memory corruption vulnerability which results in memory disclosure and potentially arbitrary code execution when large values are supplied to the x operator.
-
-
8:44
»
Packet Storm Security Advisories
The VUPEN Vulnerability Research Team has discovered a critical vulnerability in Oracle Java. Versions JRE / JDK 7u7 and below are affected. The vulnerability is caused by a memory corruption error within the "t2k.dll" component when processing certain glyph elements within a Font file, which could be exploited by remote attackers to compromise a vulnerable system via a specially crafted web page.
-
8:44
»
Packet Storm Security Recent Files
The VUPEN Vulnerability Research Team has discovered a critical vulnerability in Oracle Java. Versions JRE / JDK 7u7 and below are affected. The vulnerability is caused by a memory corruption error within the "t2k.dll" component when processing certain glyph elements within a Font file, which could be exploited by remote attackers to compromise a vulnerable system via a specially crafted web page.
-
8:44
»
Packet Storm Security Misc. Files
The VUPEN Vulnerability Research Team has discovered a critical vulnerability in Oracle Java. Versions JRE / JDK 7u7 and below are affected. The vulnerability is caused by a memory corruption error within the "t2k.dll" component when processing certain glyph elements within a Font file, which could be exploited by remote attackers to compromise a vulnerable system via a specially crafted web page.
-
-
17:00
»
SecuriTeam
This allows remote attackers to execute arbitrary code via a crafted PDF document.
-
-
17:00
»
SecuriTeam
This allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than other Flash Player memory corruption CVEs listed in APSB12-22.
-
-
17:00
»
SecuriTeam
This allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
-
-
4:51
»
SecDocs
Authors:
Tarjei Mandt Tags:
kernel Windows 7 Event:
Black Hat DC 2011 Abstract: In Windows 7, Microsoft introduced safe unlinking to the kernel pool to address the growing number of vulnerabilities affecting the Windows kernel. Prior to removing an entry from a doubly-linked list, safe unlinking aims to detect memory corruption by validating the pointers to adjacent list entries. Hence, an attacker cannot easily leverage generic "write 4" techniques in exploiting pool overflows or other pool corruption vulnerabilities. In this talk, we show that in spite of the efforts made to remove generic exploit vectors, Windows 7 is still susceptible to generic kernel pool attacks. In particular, we show that the pool allocator may under certain conditions fail to safely unlink free list entries, thus allowing an attacker to corrupt arbitrary memory. In order to thwart the presented attacks, we conclusively propose ways to further harden and enhance the security of the kernel pool.
-
4:51
»
SecDocs
Authors:
Tarjei Mandt Tags:
kernel Windows 7 Event:
Black Hat DC 2011 Abstract: In Windows 7, Microsoft introduced safe unlinking to the kernel pool to address the growing number of vulnerabilities affecting the Windows kernel. Prior to removing an entry from a doubly-linked list, safe unlinking aims to detect memory corruption by validating the pointers to adjacent list entries. Hence, an attacker cannot easily leverage generic "write 4" techniques in exploiting pool overflows or other pool corruption vulnerabilities. In this talk, we show that in spite of the efforts made to remove generic exploit vectors, Windows 7 is still susceptible to generic kernel pool attacks. In particular, we show that the pool allocator may under certain conditions fail to safely unlink free list entries, thus allowing an attacker to corrupt arbitrary memory. In order to thwart the presented attacks, we conclusively propose ways to further harden and enhance the security of the kernel pool.
-
-
21:28
»
SecDocs
Authors:
Giovanni Gola Vincenzo Iozzo Tags:
reverse engineering vulnerability static analysis Event:
Black Hat DC 2011 Abstract: Memory corruption bugs such as dangling pointers, double frees and uninitialized memory are some of the open issues in application security. Finding dangling pointers and similar vulnerabilities in large code bases it's arguably more difficult than overflows because of the complexity and heterogeneity of applications memory management. Fuzzing has been proved to be an effective method for finding such bugs in browsers and other similar COTS applications, nonetheless it's not uncommon to see bugs found by fuzzers burned after a short period of time because of multiple rediscovery of the same vulnerabilities. In this talk the challenges of finding such bugs with static analysis and the results we got will be discussed, specifically we will explore the algorithms and techniques borrowed from program analysis and graph theory that can be employed to achieve our goal. We will also discuss what improvements can be made in order to increase precision and reduce the number of false positives.
-
17:01
»
Packet Storm Security Advisories
Core Security Technologies Advisory - A vulnerability exists in atas32.dll affecting Cisco WebEx Player version 3.26 that allows an attacker to corrupt memory, which may lead to code execution in the context of the currently logged on user.
-
17:01
»
Packet Storm Security Recent Files
Core Security Technologies Advisory - A vulnerability exists in atas32.dll affecting Cisco WebEx Player version 3.26 that allows an attacker to corrupt memory, which may lead to code execution in the context of the currently logged on user.
-
17:01
»
Packet Storm Security Misc. Files
Core Security Technologies Advisory - A vulnerability exists in atas32.dll affecting Cisco WebEx Player version 3.26 that allows an attacker to corrupt memory, which may lead to code execution in the context of the currently logged on user.
-
16:38
»
Packet Storm Security Advisories
Ubuntu Security Notice 1611-1 - Henrik Skupin, Jesse Ruderman, Christian Holler, Soroush Dalili and others discovered several memory corruption flaws in Thunderbird. If a user were tricked into opening a malicious website and had JavaScript enabled, an attacker could exploit these to execute arbitrary JavaScript code within the context of another website or arbitrary code as the user invoking the program. CVE-2012-4191) David Bloom and Jordi Chancel discovered that Thunderbird did not always properly handle the element. If a user were tricked into opening a malicious website and had JavaScript enabled, a remote attacker could exploit this to conduct URL spoofing and clickjacking attacks. Various other issues were also addressed.
-
16:38
»
Packet Storm Security Recent Files
Ubuntu Security Notice 1611-1 - Henrik Skupin, Jesse Ruderman, Christian Holler, Soroush Dalili and others discovered several memory corruption flaws in Thunderbird. If a user were tricked into opening a malicious website and had JavaScript enabled, an attacker could exploit these to execute arbitrary JavaScript code within the context of another website or arbitrary code as the user invoking the program. CVE-2012-4191) David Bloom and Jordi Chancel discovered that Thunderbird did not always properly handle the element. If a user were tricked into opening a malicious website and had JavaScript enabled, a remote attacker could exploit this to conduct URL spoofing and clickjacking attacks. Various other issues were also addressed.
-
16:38
»
Packet Storm Security Misc. Files
Ubuntu Security Notice 1611-1 - Henrik Skupin, Jesse Ruderman, Christian Holler, Soroush Dalili and others discovered several memory corruption flaws in Thunderbird. If a user were tricked into opening a malicious website and had JavaScript enabled, an attacker could exploit these to execute arbitrary JavaScript code within the context of another website or arbitrary code as the user invoking the program. CVE-2012-4191) David Bloom and Jordi Chancel discovered that Thunderbird did not always properly handle the element. If a user were tricked into opening a malicious website and had JavaScript enabled, a remote attacker could exploit this to conduct URL spoofing and clickjacking attacks. Various other issues were also addressed.
-
-
23:08
»
Packet Storm Security Advisories
Ubuntu Security Notice 1608-1 - It was discovered that the browser engine used in Firefox contained a memory corruption flaw. If a user were tricked into opening a specially crafted web page, a remote attacker could cause Firefox to crash or potentially execute arbitrary code as the user invoking the program. It was discovered that Firefox allowed improper access to the Location object. An attacker could exploit this to obtain sensitive information. Various other issues were also addressed.
-
23:08
»
Packet Storm Security Recent Files
Ubuntu Security Notice 1608-1 - It was discovered that the browser engine used in Firefox contained a memory corruption flaw. If a user were tricked into opening a specially crafted web page, a remote attacker could cause Firefox to crash or potentially execute arbitrary code as the user invoking the program. It was discovered that Firefox allowed improper access to the Location object. An attacker could exploit this to obtain sensitive information. Various other issues were also addressed.
-
23:08
»
Packet Storm Security Misc. Files
Ubuntu Security Notice 1608-1 - It was discovered that the browser engine used in Firefox contained a memory corruption flaw. If a user were tricked into opening a specially crafted web page, a remote attacker could cause Firefox to crash or potentially execute arbitrary code as the user invoking the program. It was discovered that Firefox allowed improper access to the Location object. An attacker could exploit this to obtain sensitive information. Various other issues were also addressed.
-
8:05
»
Packet Storm Security Advisories
Mandriva Linux Security Advisory 2012-163 - Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and it is presumed that with enough effort at least some of these could be exploited to run arbitrary code. Various other issues have been addressed. The mozilla firefox packages has been upgraded to the latest version which is unaffected by these security flaws.
-
8:05
»
Packet Storm Security Recent Files
Mandriva Linux Security Advisory 2012-163 - Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and it is presumed that with enough effort at least some of these could be exploited to run arbitrary code. Various other issues have been addressed. The mozilla firefox packages has been upgraded to the latest version which is unaffected by these security flaws.
-
8:05
»
Packet Storm Security Misc. Files
Mandriva Linux Security Advisory 2012-163 - Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and it is presumed that with enough effort at least some of these could be exploited to run arbitrary code. Various other issues have been addressed. The mozilla firefox packages has been upgraded to the latest version which is unaffected by these security flaws.
-
-
16:55
»
Packet Storm Security Advisories
Ubuntu Security Notice 1600-1 - Henrik Skupin, Jesse Ruderman, Christian Holler, Soroush Dalili and others discovered several memory corruption flaws in Firefox. If a user were tricked into opening a specially crafted web page, a remote attacker could cause Firefox to crash or potentially execute arbitrary code as the user invoking the program. David Bloom and Jordi Chancel discovered that Firefox did not always properly handle the select element. A remote attacker could exploit this to conduct URL spoofing and clickjacking attacks. Various other issues were also addressed.
-
16:55
»
Packet Storm Security Recent Files
Ubuntu Security Notice 1600-1 - Henrik Skupin, Jesse Ruderman, Christian Holler, Soroush Dalili and others discovered several memory corruption flaws in Firefox. If a user were tricked into opening a specially crafted web page, a remote attacker could cause Firefox to crash or potentially execute arbitrary code as the user invoking the program. David Bloom and Jordi Chancel discovered that Firefox did not always properly handle the select element. A remote attacker could exploit this to conduct URL spoofing and clickjacking attacks. Various other issues were also addressed.
-
16:55
»
Packet Storm Security Misc. Files
Ubuntu Security Notice 1600-1 - Henrik Skupin, Jesse Ruderman, Christian Holler, Soroush Dalili and others discovered several memory corruption flaws in Firefox. If a user were tricked into opening a specially crafted web page, a remote attacker could cause Firefox to crash or potentially execute arbitrary code as the user invoking the program. David Bloom and Jordi Chancel discovered that Firefox did not always properly handle the select element. A remote attacker could exploit this to conduct URL spoofing and clickjacking attacks. Various other issues were also addressed.
-
-
23:55
»
Packet Storm Security Advisories
Apple Security Advisory 2012-09-24-1 - Apple TV 5.1 is now available and addresses issues relating to malicious media loading, memory corruption, and more.
-
23:55
»
Packet Storm Security Recent Files
Apple Security Advisory 2012-09-24-1 - Apple TV 5.1 is now available and addresses issues relating to malicious media loading, memory corruption, and more.
-
23:55
»
Packet Storm Security Misc. Files
Apple Security Advisory 2012-09-24-1 - Apple TV 5.1 is now available and addresses issues relating to malicious media loading, memory corruption, and more.
-
-
14:27
»
Packet Storm Security Advisories
Ubuntu Security Notice 1555-1 - Chen Haogang discovered an integer overflow that could result in memory corruption. A local unprivileged user could use this to crash the system. A flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) protocol implementation. A local, unprivileged user could use this flaw to cause a denial of service.
-
14:27
»
Packet Storm Security Recent Files
Ubuntu Security Notice 1555-1 - Chen Haogang discovered an integer overflow that could result in memory corruption. A local unprivileged user could use this to crash the system. A flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) protocol implementation. A local, unprivileged user could use this flaw to cause a denial of service.
-
14:27
»
Packet Storm Security Misc. Files
Ubuntu Security Notice 1555-1 - Chen Haogang discovered an integer overflow that could result in memory corruption. A local unprivileged user could use this to crash the system. A flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) protocol implementation. A local, unprivileged user could use this flaw to cause a denial of service.
-
-
7:22
»
Packet Storm Security Advisories
Mandriva Linux Security Advisory 2012-147 - Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled, but are potentially a risk in browser or browser-like contexts in those products. Security researcher Abhishek Arya of Google Chrome Security Team discovered a series of use-after-free issues using the Address Sanitizer tool. Many of these issues are potentially exploitable, allowing for remote code execution. Security researcher Mariusz Mlynski reported that it is possible to shadow the location object using Object.defineProperty. This could be used to confuse the current location to plugins, allowing for possible cross-site scripting attacks. Various other vulnerabilities were also addressed.
-
7:22
»
Packet Storm Security Recent Files
Mandriva Linux Security Advisory 2012-147 - Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled, but are potentially a risk in browser or browser-like contexts in those products. Security researcher Abhishek Arya of Google Chrome Security Team discovered a series of use-after-free issues using the Address Sanitizer tool. Many of these issues are potentially exploitable, allowing for remote code execution. Security researcher Mariusz Mlynski reported that it is possible to shadow the location object using Object.defineProperty. This could be used to confuse the current location to plugins, allowing for possible cross-site scripting attacks. Various other vulnerabilities were also addressed.
-
7:22
»
Packet Storm Security Misc. Files
Mandriva Linux Security Advisory 2012-147 - Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled, but are potentially a risk in browser or browser-like contexts in those products. Security researcher Abhishek Arya of Google Chrome Security Team discovered a series of use-after-free issues using the Address Sanitizer tool. Many of these issues are potentially exploitable, allowing for remote code execution. Security researcher Mariusz Mlynski reported that it is possible to shadow the location object using Object.defineProperty. This could be used to confuse the current location to plugins, allowing for possible cross-site scripting attacks. Various other vulnerabilities were also addressed.
-
7:15
»
Packet Storm Security Advisories
Mandriva Linux Security Advisory 2012-146 - Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. Security researcher Abhishek Arya of Google Chrome Security Team discovered a series of use-after-free issues using the Address Sanitizer tool. Many of these issues are potentially exploitable, allowing for remote code execution. Various other issues have also been addressed.
-
7:15
»
Packet Storm Security Recent Files
Mandriva Linux Security Advisory 2012-146 - Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. Security researcher Abhishek Arya of Google Chrome Security Team discovered a series of use-after-free issues using the Address Sanitizer tool. Many of these issues are potentially exploitable, allowing for remote code execution. Various other issues have also been addressed.
-
7:15
»
Packet Storm Security Misc. Files
Mandriva Linux Security Advisory 2012-146 - Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. Security researcher Abhishek Arya of Google Chrome Security Team discovered a series of use-after-free issues using the Address Sanitizer tool. Many of these issues are potentially exploitable, allowing for remote code execution. Various other issues have also been addressed.
Skip to page:
1
2
3
...
8