seeing is believing
Showing 1 - 25 of 60 RSS Feed

Files Date: 2012-01-18

Malware Reverse Engineering Part 1 - Static Analysis
Posted Jan 18, 2012
Authored by Rick Flores

This malware report is part 1 of 2. This report is an effort to track, categorize, contain, understand root cause and infection vector of said user account/s, networked equipment or computer/s. This report pertains to all incidents reported by TIER II help desk, TIER III engineers, customer complaints or random IT Security audit/finding/pen test.

tags | paper, root, virus
MD5 | 69bc5bbf5b19339b58ee550bfdd3e451
SoftHSM 1.3.1
Posted Jan 18, 2012
Authored by Rickard Bellgrim | Site wiki.opendnssec.org

SoftHSM is an implementation of a cryptographic store accessible through a PKCS#11 interface. You can use it to explore PKCS#11 without having a Hardware Security Module. It is being developed as a part of the OpenDNSSEC project. SoftHSM uses Botan for its cryptographic operations.

Changes: The library is now installed in $libdir/softhsm/. This release does not give a warning about the schema version if the token has not been initialized yet. The tools now return the correct exit code.
tags | library
systems | unix
MD5 | 1eadb2821accffde2e9404807d4ae3dd
Reflection Scan Proof Of Concept
Posted Jan 18, 2012
Authored by Jan Wrobel

This proof of concept demonstrates how traffic load of a shared packet queue can be exploited as a side channel through which protected information leaks to an off-path attacker.

tags | exploit, proof of concept
MD5 | 64bc671666fc26d1a6fbcfea2dbc73f5
Reflection Scan: An Off-Path Attack On TCP
Posted Jan 18, 2012
Authored by Jan Wrobel

The paper demonstrates how traffic load of a shared packet queue can be exploited as a side channel through which protected information leaks to an off-path attacker. The attacker sends to a victim a sequence of identical spoofed segments. The victim responds to each segment in the sequence (the sequence is reflected by the victim) if the segments satisfy a certain condition tested by the attacker. The responses do not reach the attacker directly, but induce extra load on a routing queue shared between the victim and the attacker. Increased processing time of packets traversing the queue reveal that the tested condition was true. The paper concentrates on the TCP, but the approach is generic and can be effective against other protocols that allow to construct requests which are conditionally answered by the victim.

tags | paper, spoof, tcp, protocol, proof of concept
MD5 | 3f661f7510db6f7555090f64d98e634e
Drupal CKEditor 3.6.2 Cross Site Scripting
Posted Jan 18, 2012
Authored by MaXe

Drupal CKEditor versions 3.0 through 3.6.2 suffer from a persistent cross site scripting vulnerability that can be triggered by the addition of an event handler.

tags | exploit, xss
MD5 | bf64a6d53127c46165196faeec57a725
Red Hat Security Advisory 2012-0040-01
Posted Jan 18, 2012
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2012-0040-01 - Part of the Native components for JBoss Enterprise Web Platform is mod_cluster, an Apache HTTP Server based load balancer. Like mod_jk, it uses a communication channel to forward requests from httpd to an application server node. It was found that mod_cluster allowed worker nodes to register on any virtual host, regardless of the security constraints applied to other vhosts. In a typical environment, there will be one vhost configured internally for worker nodes, and another configured externally for serving content. A remote attacker could use this flaw to register an attacker-controlled worker node via an external vhost that is not configured to apply security constraints, then use that worker node to serve malicious content, intercept credentials, and hijack user sessions.

tags | advisory, remote, web
systems | linux, redhat
advisories | CVE-2011-4608
MD5 | 2148987a3dde726dc8e17283675218c4
Red Hat Security Advisory 2012-0039-01
Posted Jan 18, 2012
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2012-0039-01 - mod_cluster-native provides a native build of mod_cluster for the Apache HTTP Server. mod_cluster is an httpd-based load balancer. Like mod_jk, it uses a communication channel to forward requests from httpd to an application server node. It was found that mod_cluster allowed worker nodes to register on any virtual host, regardless of the security constraints applied to other vhosts. In a typical environment, there will be one vhost configured internally for worker nodes, and another configured externally for serving content. A remote attacker could use this flaw to register an attacker-controlled worker node via an external vhost that is not configured to apply security constraints, then use that worker node to serve malicious content, intercept credentials, and hijack user sessions.

tags | advisory, remote, web
systems | linux, redhat
advisories | CVE-2011-4608
MD5 | 38add862fd5790fe42189e2cc4258648
Red Hat Security Advisory 2012-0038-01
Posted Jan 18, 2012
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2012-0038-01 - Part of the Native components for JBoss Enterprise Application Platform is mod_cluster, an Apache HTTP Server based load balancer. Like mod_jk, it uses a communication channel to forward requests from httpd to an application server node. It was found that mod_cluster allowed worker nodes to register on any virtual host, regardless of the security constraints applied to other vhosts. In a typical environment, there will be one vhost configured internally for worker nodes, and another configured externally for serving content. A remote attacker could use this flaw to register an attacker-controlled worker node via an external vhost that is not configured to apply security constraints, then use that worker node to serve malicious content, intercept credentials, and hijack user sessions.

tags | advisory, remote, web
systems | linux, redhat
advisories | CVE-2011-4608
MD5 | 6e144acc711ff16fc64f7bd5133e426d
Red Hat Security Advisory 2012-0037-01
Posted Jan 18, 2012
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2012-0037-01 - mod_cluster-native provides a native build of mod_cluster for the Apache HTTP Server. mod_cluster is an httpd-based load balancer. Like mod_jk, it uses a communication channel to forward requests from httpd to an application server node. It was found that mod_cluster allowed worker nodes to register on any virtual host, regardless of the security constraints applied to other vhosts. In a typical environment, there will be one vhost configured internally for worker nodes, and another configured externally for serving content. A remote attacker could use this flaw to register an attacker-controlled worker node via an external vhost that is not configured to apply security constraints, then use that worker node to serve malicious content, intercept credentials, and hijack user sessions.

tags | advisory, remote, web
systems | linux, redhat
advisories | CVE-2011-4608
MD5 | aebe6579efa3d543a287749b0be0319b
Red Hat Security Advisory 2012-0036-01
Posted Jan 18, 2012
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2012-0036-01 - The mod_cluster native component provides a native build of mod_cluster for the Apache HTTP Server. mod_cluster is an httpd-based load balancer. Like mod_jk, it uses a communication channel to forward requests from httpd to an application server node. It was found that mod_cluster allowed worker nodes to register on any virtual host, regardless of the security constraints applied to other vhosts. In a typical environment, there will be one vhost configured internally for worker nodes, and another configured externally for serving content. A remote attacker could use this flaw to register an attacker-controlled worker node via an external vhost that is not configured to apply security constraints, then use that worker node to serve malicious content, intercept credentials, and hijack user sessions.

tags | advisory, remote, web
systems | linux, redhat
advisories | CVE-2011-4608
MD5 | 4aee89f1f79db4dfbae5e47b6daeca01
Red Hat Security Advisory 2012-0035-01
Posted Jan 18, 2012
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2012-0035-01 - mod_cluster-native provides a native build of mod_cluster for the Apache HTTP Server. mod_cluster is an httpd-based load balancer. Like mod_jk, it uses a communication channel to forward requests from httpd to an application server node. It was found that mod_cluster allowed worker nodes to register on any virtual host, regardless of the security constraints applied to other vhosts. In a typical environment, there will be one vhost configured internally for worker nodes, and another configured externally for serving content. A remote attacker could use this flaw to register an attacker-controlled worker node via an external vhost that is not configured to apply security constraints, then use that worker node to serve malicious content, intercept credentials, and hijack user sessions.

tags | advisory, remote, web
systems | linux, redhat
advisories | CVE-2011-4608
MD5 | 0d274317d6d230989e5e21ace3db8deb
Red Hat Security Advisory 2012-0034-01
Posted Jan 18, 2012
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2012-0034-01 - The IBM Java SE version 6 release includes the IBM Java 6 Runtime Environment and the IBM Java 6 Software Development Kit. This update fixes several vulnerabilities in the IBM Java 6 Runtime Environment and the IBM Java 6 Software Development Kit.

tags | advisory, java, vulnerability
systems | linux, redhat
advisories | CVE-2011-3389, CVE-2011-3516, CVE-2011-3521, CVE-2011-3544, CVE-2011-3545, CVE-2011-3546, CVE-2011-3547, CVE-2011-3548, CVE-2011-3549, CVE-2011-3550, CVE-2011-3551, CVE-2011-3552, CVE-2011-3553, CVE-2011-3554, CVE-2011-3556, CVE-2011-3557, CVE-2011-3560, CVE-2011-3561
MD5 | 1b026dedbc3bd9794d57b3324a32b848
Red Hat Security Advisory 2012-0033-01
Posted Jan 18, 2012
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2012-0033-01 - PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large amount of CPU time would be consumed. This flaw has been mitigated by adding a new configuration directive, max_input_vars, that limits the maximum number of parameters processed per request. By default, max_input_vars is set to 1000.

tags | advisory, web, php
systems | linux, redhat
advisories | CVE-2011-0708, CVE-2011-1148, CVE-2011-1466, CVE-2011-1469, CVE-2011-2202, CVE-2011-4566, CVE-2011-4885
MD5 | 8c48d27f32502fac614393fbf3389424
Cisco Security Advisory 20120118-dmm
Posted Jan 18, 2012
Authored by Cisco Systems | Site cisco.com

Cisco Security Advisory - Cisco Digital Media Manager contains a vulnerability that may allow a remote, authenticated attacker to elevate privileges and obtain full access to the affected system. Cisco Show and Share is not directly affected by this vulnerability. However, because Cisco Show and Share relies on Cisco Digital Media Manager for authentication services, attackers who compromise the Cisco Digital Media Manager may gain full access to Cisco Show and Share. Cisco has released free software updates that address this vulnerability. There are no workarounds that mitigate this vulnerability.

tags | advisory, remote
systems | cisco
advisories | CVE-2012-0329
MD5 | e3b4940713f1d20fef12427238f09f82
Cisco Security Advisory 20120118-te
Posted Jan 18, 2012
Authored by Cisco Systems | Site cisco.com

Cisco Security Advisory - Cisco TelePresence Software version TE 4.1.0 contains a default account vulnerability that could allow an unauthenticated, remote attacker to take complete control of the affected device. The vulnerability is due to an architectural change that was made in the way the system maintains administrative accounts. During the process of upgrading a Cisco IP Video Phone E20 device to TE 4.1.0, an unsecured default account may be introduced. An attacker who is able to take advantage of this vulnerability could log in to the device as the root user and perform arbitrary actions with elevated privileges. Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available.

tags | advisory, remote, arbitrary, root
systems | cisco
advisories | CVE-2011-4659
MD5 | 3982a2948e20272cae7945424175dea5
OneOrZero AIMS 2.8.0 Trial Build 231211 Cross Site Scripting
Posted Jan 18, 2012
Authored by High-Tech Bridge SA | Site htbridge.com

OneOrZero AIMS version 2.8.0 Trial build 231211 suffers from a cross site scripting vulnerability.

tags | exploit, xss
MD5 | d30c30b2bd3d66d69d60e3c152062d7c
Distributed Access Control System 1.4.27
Posted Jan 18, 2012
Site dacs.dss.ca

DACS is a light-weight single sign-on and role-based access control system providing flexible, modular authentication methods and powerful, transparent rule-based authorization checking for Web services, CGI programs, or virtually any program.

Changes: This minor bugfix release upgrades third-party support packages, includes upgrades/fixes for Mac OS X 10.7.2, and fixes and extends the HTTP_AUTH directive and the dacsauth(1) command.
tags | tool, web, cgi
systems | linux, unix
MD5 | 72899c20059569317f6efe66baf888bf
deV!L`z Clanportal 1.5.5 Moviebase SQL Injection
Posted Jan 18, 2012
Authored by Easy Laster

The deV!L`z Clanportal version 1.5.5 Moviebase add-on suffers from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
MD5 | 048df4c991369b3f0ac064079aa4218d
deV!L`z Clanportal Gamebase SQL Injection
Posted Jan 18, 2012
Authored by Easy Laster

The deV!L`z Clanportal Gamebase add-on suffers from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
MD5 | 1b2e7363173b2a979075855994e564d6
pGB 2.12 SQL Injection
Posted Jan 18, 2012
Authored by 3spi0n

pGB version 2.12 suffers from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
MD5 | a834d4306d041b4be2062d45d756fcab
Mandriva Linux Security Advisory 2012-009
Posted Jan 18, 2012
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2012-009 - Eval injection in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via the new constructor. The updated packages have been patched to correct this issue.

tags | advisory, arbitrary, perl
systems | linux, mandriva
advisories | CVE-2011-3597
MD5 | c849ab54ce59462229aa52aaa99c3ad3
EasyPage SQL Injection
Posted Jan 18, 2012
Authored by Red Security TEAM

EasyPage suffers from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
MD5 | 424d557f403b75e7d069b280c413f606
Mandriva Linux Security Advisory 2012-008
Posted Jan 18, 2012
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2012-008 - Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service via a crafted Unicode string, which triggers a heap-based buffer overflow. Eval injection in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via the new constructor. The updated packages have been patched to correct these issues.

tags | advisory, denial of service, overflow, arbitrary, perl
systems | linux, mandriva
advisories | CVE-2011-2939, CVE-2011-3597
MD5 | d1fb236f11b1ab66bf96322ffdb0a380
Azp Design SQL Injection
Posted Jan 18, 2012
Authored by 3spi0n

Azp Design suffers from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
MD5 | 9003d1f879034d76ccafca74d51c96a5
Art And Soul Design SQL Injection
Posted Jan 18, 2012
Authored by 3spi0n

Art and Soul Design suffers from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
MD5 | dd7e69e58984d190505409e45e00162d
Page 1 of 3
Back123Next

File Archive:

July 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    2 Files
  • 2
    Jul 2nd
    3 Files
  • 3
    Jul 3rd
    15 Files
  • 4
    Jul 4th
    4 Files
  • 5
    Jul 5th
    15 Files
  • 6
    Jul 6th
    15 Files
  • 7
    Jul 7th
    10 Files
  • 8
    Jul 8th
    2 Files
  • 9
    Jul 9th
    10 Files
  • 10
    Jul 10th
    15 Files
  • 11
    Jul 11th
    15 Files
  • 12
    Jul 12th
    19 Files
  • 13
    Jul 13th
    16 Files
  • 14
    Jul 14th
    15 Files
  • 15
    Jul 15th
    3 Files
  • 16
    Jul 16th
    2 Files
  • 17
    Jul 17th
    8 Files
  • 18
    Jul 18th
    11 Files
  • 19
    Jul 19th
    15 Files
  • 20
    Jul 20th
    15 Files
  • 21
    Jul 21st
    15 Files
  • 22
    Jul 22nd
    7 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close