Showing 126 - 132 of 132

Files from Ian Beer

OS X Regex Engine Stack Buffer Overflow: Posted Sep 23, 2015; Authored by Google Security Research, Ian Beer; OS X Regex Engine (TRE) suffers from a stack buffer overflow vulnerability.; tags | advisory, overflow; systems | linux, apple, osx; advisories | CVE-2015-3796; SHA-256 | 5ad1dbca55084a0bde0fa1fbe2614f5806fada2f7a3afbc24bc91426dba68011; Download | Favorite | View

OS X Regex Engine Bad Alloca: Posted Sep 22, 2015; Authored by Google Security Research, Ian Beer; The OS X regex engine (TRE) uses the alloca function in a few places, sometimes where an attacker can partially control the size.; tags | exploit; systems | linux, apple, osx; advisories | CVE-2015-3797; SHA-256 | 4892e0cd6b0f4549272861144a2d62b719c14ab2eeb90564785bc88c25656d6e; Download | Favorite | View

OS X IOKit Kernel Memory Corruption: Posted Sep 18, 2015; Authored by Google Security Research, Ian Beer; An OS X IOKit kernel memory corruption issue occurs due to a bad bzero in IOBluetoothDevice.; tags | exploit, kernel; systems | linux, apple, osx; advisories | CVE-2014-8836; SHA-256 | f3d2f3b8051f90b86f0cfd263f09f98a7e0e04c1e1fcff20c13e3ca8f318052c; Download | Favorite | View

OS X Suid Privilege Escalation: Posted Sep 14, 2015; Authored by Google Security Research, Ian Beer; The Install.framework runner suid root binary does not correctly account for the fact that Distributed Objects can be connected to by multiple clients at the same time. By connecting two proxy objects to an IFInstallRunner and calling [IFInstallRunner makeReceiptDirAt:asRoot:] in the first and passing a custom object as the directory name we can get a callback to our code just after the makeReceiptDirAt code has called seteuid(0);setguid(0) to regain privs. Since BSD priviledges are per-process this means that our other proxy object will now have euid 0 without having to provide an authorization reference. In this second proxy we can then just call runTaskSecurely and get a root shell before returning from the first proxy's callback function which will then drop privs.; tags | exploit, shell, root; systems | linux, bsd; advisories | CVE-2015-5754; SHA-256 | 1fd4f2bf985f7460d71d17680841dc5c059fe7c05b9a7ac1a776291868ff74e3; Download | Favorite | View

OS X Privilege Escalation: Posted Sep 14, 2015; Authored by Google Security Research, Ian Beer; The private Install.framework has a few helper executables in /System/Library/PrivateFrameworks/Install.framework/Resources, one of which is suid root and exploitable.; tags | exploit, root; systems | linux; advisories | CVE-2015-3704; SHA-256 | a34aa2485110ffeff9b63cf7063d71e3ac6548549f001e7517073b7f1ffaa5ca; Download | Favorite | View

OS X Install.framework Suid Root Binary: Posted Sep 14, 2015; Authored by Google Security Research, Ian Beer; Install.framework has a suid root binary at /System/Library/PrivateFrameworks/Install.framework/Resources/runner that allows for arbitrary mkdir, unlink, and chown.; tags | exploit, arbitrary, root; systems | linux; advisories | CVE-2015-5784; SHA-256 | 4b9ea14e8540ddbdec18fe305074224119369e420b4ed663a1f2bac393fa7f15; Download | Favorite | View

Mac OS X IOKit Keyboard Driver Root Privilege Escalation: Posted Dec 2, 2014; Authored by joev, Ian Beer | Site metasploit.com; A heap overflow in IOHIKeyboardMapper::parseKeyMapping allows kernel memory corruption in Mac OS X before 10.10. By abusing a bug in the IORegistry, kernel pointers can also be leaked, allowing a full kASLR bypass. Tested on Mavericks 10.9.5, and should work on previous versions. The issue has been patched silently in Yosemite.; tags | exploit, overflow, kernel; systems | apple, osx; advisories | CVE-2014-4404; SHA-256 | 11133f34a345562636b3137fbe3bb6e9f2ec2aa4045b1360d1b0885244f3d580; Download | Favorite | View

Page 6 of 6 Back 2 3 4 5 6 Next

Top Authors In Last 30 Days