what you don't know can hurt you
Showing 1 - 25 of 27 RSS Feed

Files from Derek Soeder

Email addressds.adv.pub at gmail.com
First Active2004-05-13
Last Active2012-09-07
Internet Explorer Script Interjection Code Execution
Posted Sep 7, 2012
Authored by Derek Soeder

The vulnerability described in this document can be exploited by a malicious Web page to execute arbitrary code with low integrity. Active scripting must be enabled, and the present exploitation techniques require that font downloading be set to "Enable" or "Prompt" and that the "mailto:" protocol be present. (These requirements are satisfied by default on Windows XP, Windows Vista, and Windows 7.) The user is presented with a message box which must be dismissed before code execution can occur.

tags | advisory, web, arbitrary, code execution, protocol
systems | windows, xp, vista, 7
MD5 | 29f0774b1970da1d137c7138635a612d
Internet Explorer Script Interjection Code Execution
Posted Aug 17, 2012
Authored by Derek Soeder

The vulnerability described in this document can be exploited by a malicious Web page to execute arbitrary code with low integrity. Active scripting must be enabled, and the present exploitation techniques require that font downloading be set to "Enable" or "Prompt" and that the "mailto:" protocol be present. (These requirements are satisfied by default on Windows XP, Windows Vista, and Windows 7.) The user is presented with a message box which must be dismissed before code execution can occur.

tags | advisory, web, arbitrary, code execution, protocol
systems | windows, xp, vista, 7
MD5 | 2bb799fb1562340d2c8f75004b44d362
VMware Backdoor ghi.guest.trashFolder.state Uninitialized Memory
Posted May 8, 2012
Authored by Derek Soeder

The vulnerability described in this document could hypothetically be exploited by unprivileged code running in a VMware virtual machine (guest) in order to execute code in the host VMX process, thereby breaking out of the virtual machine; however, such exploitation has not been proven.

tags | advisory
advisories | CVE-2012-1517
MD5 | 23a15e8e5f4e8c749191a128067b6a74
VMware Backdoor Response Uninitialized Memory Potential VM Break
Posted May 6, 2012
Authored by Derek Soeder

The vulnerability described in this document could hypothetically be exploited by unprivileged code running in a VMware virtual machine (guest) in order to execute code in the host VMX process, thereby breaking out of the virtual machine; however, such exploitation has not been proven. In the event that arbitrary code execution in the VMX process is possible, kernel privileges can be obtained on a Windows host by abusing the VMX process's special access to a VMware driver, meaning the maximum possible impact of this vulnerability is elevation from unprivileged guest code execution to host kernel code execution.

tags | exploit, arbitrary, kernel, code execution
systems | windows
advisories | CVE-2012-1516
MD5 | 2ef8f66ab0e238a9620ce20fe03c5f8f
VMware High-Bandwidth Backdoor ROM Overwrite Privilege Elevation
Posted Mar 30, 2012
Authored by Derek Soeder

VMware suffers from a backdoor ROM overwrite privilege escalation vulnerability.

tags | exploit
advisories | CVE-2012-1515
MD5 | ac9c357fb3ec066762da9b1543eb0f6d
Intuit Help System Protocol File Retrieval
Posted Mar 30, 2012
Authored by Derek Soeder

Intuit Help System suffers from protocol file retrieval vulnerability.

tags | exploit, protocol
MD5 | a0b26fa201e834e79aa35a5e5bec4c88
Intuit Help System Heap Corruption / Memory Leak
Posted Mar 30, 2012
Authored by Derek Soeder

Intuit Help System suffers from protocol URL heap corruption and memory leak vulnerabilities.

tags | exploit, vulnerability, protocol, memory leak
MD5 | c4a7ca65d102d5fbddb0b26479033d43
createEventObject Pointer Vulnerability Mitigation
Posted Jan 19, 2010
Authored by Derek Soeder

This is another dirty mitigation for another Internet Explorer zero-day vulnerability. This mitigation works by registering as a Browser Helper Object, then modifying MSHTML.DLL in memory to break createEventObject.

MD5 | fb9425e15540fe8651595cb514b0d39a
Microsoft IIS Semi-Colon Mitigation Code
Posted Dec 30, 2009
Authored by Derek Soeder

This code was released to mitigate the Microsoft IIS semi-colon vulnerability. It's intended for IIS 4.0, 5.x, and 6.0.

MD5 | db33583aeba8b7ee1bfde1461d772560
Internet Explorer MSHTML.DLL Modifier
Posted Nov 23, 2009
Authored by Derek Soeder

This code is for a DLL that loads into Internet Explorer as a BHO and modifies MSHTML.DLL in memory to mitigate attempts by the getElementsByTagName Body Style vulnerability.

MD5 | 33c5b8d8cbd660aa00712ba7d659b926
vmware-guestescalate.txt
Posted Nov 8, 2008
Authored by Derek Soeder

By exploiting either of the VMware flaws described in this document, user-mode code executing in a virtual machine may gain kernel privileges within the virtual machine, dependent upon the guest operating system. The flaws have been proven exploitable on x64 versions of Windows, and they have produced potentially exploitable crashes on x64 versions of *BSD. The Linux kernel does not allow exploitation of these flaws on x64 versions of Linux.

tags | advisory, kernel
systems | linux, windows, bsd
advisories | CVE-2008-4279, CVE-2008-4915, CVE-2008-3890
MD5 | 27b8c7a5be29107cda604fa31f5e5ec5
vmware-emulation.txt
Posted Oct 6, 2008
Authored by Derek Soeder

By exploiting the VMware flaw described in this document, user-mode code executing in a virtual machine may gain kernel privileges within the virtual machine, dependent upon the guest operating system. The flaw has been proven exploitable on x64 versions of Windows, and it has produced potentially exploitable crashes on x64 versions of *BSD. The Linux kernel does not allow exploitation of the flaws on x64 versions of Linux.

tags | advisory, kernel
systems | linux, windows, bsd
advisories | CVE-2008-4279, CVE-2008-3890
MD5 | 9d308b99f74f10aaccfde19943b9cbc4
EEYE-VGX.txt
Posted Aug 15, 2007
Authored by Derek Soeder, Ben Nagy | Site eeye.com

eEye Digital Security has discovered a heap overflow vulnerability in VGX.DLL's processing of compressed content referenced from VML. VGX.DLL is the Microsoft component responsible for rendering VML (Vector Markup Language) within Internet Explorer.

tags | advisory, overflow
MD5 | fea740cde6f8973d252aea667a630098
EEYE-csrss.txt
Posted Apr 11, 2007
Authored by Derek Soeder | Site eeye.com

eEye Digital Security has discovered a local privilege escalation vulnerability in Windows Vista that allows a program executing without privileges to fully compromise an affected system. A malicious user or malware program could exploit this vulnerability to execute arbitrary code with SYSTEM privileges within the CSRSS process, permitting the bypass of Vista's vaunted user privilege limitations and administrator approval mode. By establishing and closing multiple connections to CSRSS's "ApiPort", an application may cause a private data structure within CSRSS that describes its process to be used after it has been freed, creating an exploitable "dangling pointer" condition. This vulnerability is entirely separate from the CSRSS NtRaiseHardError message box flaw publicly disclosed in December 2006, although both affect code within the CSRSS process. It is interesting to note that this vulnerability only affects Windows Vista, due to new, flawed code added to CSRSRV.DLL in support of functionality introduced in Vista.

tags | advisory, arbitrary, local
systems | windows, vista
MD5 | 142455a90333b87b5d6c76789dddf56e
EEYE-vdmzero.txt
Posted Apr 11, 2007
Authored by Derek Soeder | Site eeye.com

eEye Digital Security has discovered a local privilege escalation vulnerability in the Windows kernel that allows an unprivileged user with the ability to execute a program to fully compromise an affected system. All x86 versions of Windows up to and including Windows Server 2003 SP2 are vulnerable. The Windows kernel's Virtual DOS Machine (VDM) implementation features a race condition through which a malicious program can modify the first 4KB page of physical memory (also known as the "zero page"). The data in this region of memory is trusted and may be subsequently used by other Virtual DOS Machines, including a VDM instantiated by the Windows kernel as part of hibernating or effecting a blue-screen crash. Exploitation of this vulnerability therefore allows arbitrary code to run within other users' VDM processes, and even within the kernel if hibernation or a blue-screen can be provoked by any available means.

tags | advisory, arbitrary, x86, kernel, local
systems | windows
MD5 | ec84677a8c896473eceed1a620424060
EEYE-Intel.txt
Posted Dec 8, 2006
Authored by Derek Soeder | Site eeye.com

eEye Digital Security has discovered a vulnerability in all Intel network adapter drivers ("NDIS miniport drivers") that could allow unprivileged code executing on an affected system to gain unfettered, kernel-level access. For instance, a malicious user, malware, or exploit payload taking advantage of an unrelated vulnerability could additionally exploit this vulnerability in order to completely compromise a system at the kernel level.

tags | advisory, kernel
MD5 | 8f5fd83e20858675b49c76f16aaa3256
EEYE-adm21x.txt
Posted Dec 7, 2006
Authored by Derek Soeder | Site research.eeye.com

eEye Digital Security has discovered a stack buffer overflow in Adobe Download Manager, a utility typically installed for the purpose of downloading Adobe software such as Adobe (Acrobat) Reader. By opening a malicious AOM file, a user's system may be compromised by arbitrary code within the file, which executes with the privileges of that user. Adobe Download Manager versions 2.1.x and below are affected.

tags | advisory, overflow, arbitrary
MD5 | d9b53512b194efb4f36118fbce747de6
EEYE-MSWS.txt
Posted Nov 16, 2006
Authored by Derek Soeder, JeongWook Matt Oh | Site research.eeye.com

A flaw exists in a default Windows component called the "Workstation Service" that when exploited allows for remote code execution in SYSTEM context, allowing an attacker to take complete control of affected systems. Systems affected include Windows 2000 (Remote Code Execution), Windows XP SP1 (Local Privilege Escalation).

tags | advisory, remote, local, code execution
systems | windows, 2k, xp
MD5 | ab5e44c09d742521217e98290229c887
EEYEB-20080824.txt
Posted Sep 13, 2006
Authored by Derek Soeder | Site research.eeye.com

eEye Digital Security has discovered a second heap overflow vulnerability in the MS06-042 cumulative Internet Explorer update that would allow an attacker to execute arbitrary code on the system of a victim who attempts to access a malicious URL. Windows 2000, Windows XP SP1, and Windows 2003 SP0 systems running Internet Explorer 5 SP4 or Internet Explorer 6 SP1, with the MS06-042 patch applied, are vulnerable; unpatched and more recent versions of Internet Explorer are not affected.

tags | advisory, overflow, arbitrary
systems | windows, 2k, xp
MD5 | cde17359bf4c467d199b4a6c7253525b
EEYE-MS06-042-2.txt
Posted Aug 28, 2006
Authored by Derek Soeder | Site eeye.com

eEye Digital Security has discovered a heap overflow vulnerability in the MS06-042 cumulative Internet Explorer update that would allow an attacker to execute arbitrary code on the system of a victim who attempts to access a malicious URL. Only Windows 2000 and Windows XP SP1 systems running Internet Explorer 6 SP1 with the MS06-042 patch applied are vulnerable.

tags | advisory, overflow, arbitrary
systems | windows, 2k, xp
MD5 | b710d1b8ded5db4cbade77bb1cc43d44
EEYE-MS06-042.txt
Posted Aug 27, 2006
Authored by Derek Soeder | Site eeye.com

eEye has confirmed that the Internet Explorer crash vulnerability as described in MS06-042 is indeed exploitable.

tags | advisory
MD5 | 9ef47386e4e24ffcfa4cb0702d3629b0
EEYE-ePolicy.txt
Posted Jul 15, 2006
Authored by Barnaby Jack, Derek Soeder | Site eeye.com

eEye Digital Security has discovered a serious flaw within the Framework Service component of the McAfee EPO management console. The Framework service is enabled and running by default on all servers and agents. The framework service listens by default on port 8081 and accepts requests over the HTTP protocol. The framework service allows for remotely submitting configuration and update changes. Each request is encrypted, SHA-1 hashed and DSA signed, and written to a file on disk. Due to a directory traversal attack, it is possible to write any file with any contents to anywhere on the remote system. This flaw allows a remote attacker to anonymously compromise an affected system and execute code within the SYSTEM context. Systems affected are McAfee Common Management (EPO) Agent versions below version 3.5.5.438.

tags | advisory, remote, web, protocol
MD5 | d601cca62a4d30e9a464a4829ca235f6
AD20060509a.txt
Posted May 21, 2006
Authored by Derek Soeder | Site eeye.com

eEye Digital Security has discovered a second vulnerability in the Microsoft Distributed Transaction Coordinator that could allow an attacker to take complete control over a vulnerable system to which he has network or local access. The vulnerable MSDTC component is an RPC server which is network accessible by default on Windows NT 4.0 Server and Windows 2000 Server systems, over a dynamic high TCP port.

tags | advisory, local, tcp
systems | windows, 2k, nt
MD5 | 0cacde8e729b39afddc354aea2ed008a
EEYEB-20050523.txt
Posted Dec 14, 2005
Authored by Derek Soeder | Site eeye.com

eEye Security Advisory - eEye Digital Security has discovered a local privilege escalation vulnerability in the Windows kernel that could allow any code executing on a Windows NT 4.0 or Windows 2000 system to elevate itself to the highest possible local privilege level (kernel).

tags | advisory, kernel, local
systems | windows, 2k, nt
advisories | CVE-2005-2827
MD5 | 204c949d2587d64927b34183a6cb0b46
eEye.WindowsSMB.txt
Posted Feb 23, 2005
Authored by Yuji Ukai, Derek Soeder | Site eeye.com

eEye Security Advisory - eEye Digital Security has discovered a vulnerability in Windows SMB client's handling of SMB responses. An attacker who can cause an affected system to connect to the SMB service on a malicious host may exploit this vulnerability in order to execute code on the victim's machine.

tags | advisory
systems | windows
MD5 | 5802abff2b4ff6bc0a7e2bb1b81fb5e5
Page 1 of 2
Back12Next

File Archive:

July 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    2 Files
  • 2
    Jul 2nd
    3 Files
  • 3
    Jul 3rd
    15 Files
  • 4
    Jul 4th
    4 Files
  • 5
    Jul 5th
    15 Files
  • 6
    Jul 6th
    15 Files
  • 7
    Jul 7th
    10 Files
  • 8
    Jul 8th
    2 Files
  • 9
    Jul 9th
    10 Files
  • 10
    Jul 10th
    15 Files
  • 11
    Jul 11th
    15 Files
  • 12
    Jul 12th
    19 Files
  • 13
    Jul 13th
    16 Files
  • 14
    Jul 14th
    15 Files
  • 15
    Jul 15th
    3 Files
  • 16
    Jul 16th
    2 Files
  • 17
    Jul 17th
    8 Files
  • 18
    Jul 18th
    11 Files
  • 19
    Jul 19th
    15 Files
  • 20
    Jul 20th
    15 Files
  • 21
    Jul 21st
    15 Files
  • 22
    Jul 22nd
    1 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close