WiFi Camera Roll version 1.2 suffers from local file inclusion and remote arbitrary file upload vulnerabilities.
3c3e22dfc6db82838915c2af74c60ae29e40e2e7c6afa63e749fdd5bea9ab9b5Red Hat Security Advisory 2011-0833-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. A flaw in the dccp_rcv_state_process() function could allow a remote attacker to cause a denial of service, even when the socket was already closed. Multiple buffer overflow flaws were found in the Linux kernel's Management Module Support for Message Passing Technology based controllers. A local, unprivileged user could use these flaws to cause a denial of service, an information leak, or escalate their privileges. Various other issues were also addressed.
6c8017bb07a6916f0d7d7287b1de37c93f29942577ec63e233b807942ce1a0c5Secunia Security Advisory - A vulnerability has been reported in Intel Ethernet 10 Gigabit Ethernet Controllers, which can be exploited by malicious people to cause a DoS (Denial of Service).
f87a66d6a5ea226e2b18b702e4fd6690f49e829c57c691edad661afa9aced69dZero Day Initiative Advisory 11-167 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Windows Internet Name Service (WINS). Authentication is not required to exploit this vulnerability. The specific flaw exists within the wins.exe service distributed with Microsoft Windows 2003 Server. This service is designed to resolve NetBIOS requests and accepts connections on port 42. Due to a logic error when handling a socket send exception, certain user-supplied values remain within a stack frame and are re-used in another context. A remote attacker can abuse this flaw to cause a call to LeaveCriticalSection to operate upon a controlled location in memory. Such a condition could lead to remote code execution under the context of the SYSTEM user.
8be80069f255351a71cf8ca5ebe064fff7d59fc464797d42b25bb2ed516ff43bShackleton Rollin suffers from a remote file disclosure vulnerability.
8a4b30a459bf89489b49464052951aba45564c8d22f8d0c574a62823ada4d336Secunia Security Advisory - A vulnerability has been reported in Cisco Wireless LAN Controllers, which can be exploited by malicious people to cause a DoS (Denial of Service).
fc76d3a2b3812b7948b05e1e973b2d9314e2dfc4088e8ed83b0e1372a88c01ceCisco Security Advisory - The Cisco Wireless LAN Controller (WLC) product family is affected by a denial of service (DoS) vulnerability where an unauthenticated attacker could cause a device reload by sending a series of ICMP packets. Cisco has released free software updates that address this vulnerability. There are no available workarounds to mitigate this vulnerability.
f1171ae62fcebf64d01ab32293a5cd794085fd1c13b7396770885fccba181b11Zero Day Initiative Advisory 11-126 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of CA Total Defense Endpoint. Authentication is not required to exploit this vulnerability. The specific flaw exists within CA.Itm.Server.ManagementWS.dll. Due to a failure to properly sanitize user-controlled input, it is possible for a remote unauthenticated attacker to upload and subsequently execute arbitrary code under the context of the CA Total Defense Heartbeat Web service. Requests delivered to FileUploadHandler.ashx are subject to arbitrary file writes, including directory traversal attacks, in the GUID parameter. The Heartbeat Web service listens for HTTP requests on port 8008 and 44344 for HTTPS.
dad5be5eb24d551c6fb279d2bc92a6b4dd9214d0faf839139e13b499c4cdcdccMicrosoft Reader versions 2.1.1.3143 and below and versions 2.6.1.7169 and below suffer from an integer overflow caused by a controlled memmove. Proof of concept code included.
7c6ea2755683e12a4fe9202acbacb9ffec7e8f8694e803f4dd036882fd369d6bThe Cisco ACS 1121 OEM IBM xSeries Baseboard Management Controller comes with default credentials.
177af022f60b56ee92d4c199897e9800bfbc74123270d90407d25e4cb10234a2This Metasploit module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53 prior to NNM_01203. By specifying a long 'arg' parameter when executing the 'jovgraph.exe' CGI program, an attacker can cause a stack-based buffer overflow and execute arbitrary code. The vulnerable code is within the option parsing function within "ovwebsnmpsrv.exe" with a timestamp prior to April 7th, 2010. Reaching the vulnerable code requires a 'POST' request with an 'arg' parameter that, when combined with a some static text, exceeds 10240 bytes. The parameter must begin with a dash. It is important to note that this vulnerability must be exploited by overwriting SEH. This is since overflowing the buffer with controllable data always triggers an access violation when attempting to write static text beyond the end of the stack. Exploiting this issue is a bit tricky due to a restrictive character set. In order to accomplish arbitrary code execution, a double-backward jump is used in combination with the Alpha2 encoder.
776b4fe0d9851d0c1cbfd43336360be9b50d1f85d6ab691a9d9e621ecb22aa34Zero Day Initiative Advisory 11-110 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Lotus Domino Server Controller. Authentication is not required to exploit this vulnerability. The flaw exists within the remote console functionality which listens by default on TCP port 2050. When handling A user authentication the server uses a user supplied COOKIEFILE path to retrieve stored credentials. The application then compares this data against the user provided username and cookie. The path to the COOKIEFILE can be a UNC path allowing the attacker to control both the known good credentials and the challenge credentials. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the SYSTEM user.
c60ce5be38ddd1364df0e59214769dec234a68a8836d951b19333cf79651efbdThe VUPEN Vulnerability Research Team discovered a critical vulnerability in Apple Safari. The vulnerability is caused by a use-after-free error in the WebKit library when handling certain scroll events, which could be exploited by remote attackers to compromise a vulnerable system by tricking a user into visiting a specially crafted web page. Versions 5.0.3 and below are affected.
3eac3c011875096426021de4ca49199e1fcbfae351d58fd4ff58b13456d57a6cUbuntu Security Notice 1073-1 - Multiple vulnerabilities have been discovered and addressed in the Linux kernel. Gleb Napatov discovered that KVM did not correctly check certain privileged operations. Dan Jacobson discovered that ThinkPad video output was not correctly access controlled. Vasiliy Kulikov discovered that the Linux kernel X.25 implementation did not correctly clear kernel memory. Nelson Elhage discovered that the Linux kernel IPv4 implementation did not properly audit certain bytecodes in netlink messages. Dan Rosenberg discovered that the USB subsystem did not correctly initialize certain structures. Various other issues have also been addressed.
6ba8f6c6dc8aeeea6fd8953752f7beab7c32ebb9e112702d7ac851c16c79263aUbuntu Security Notice 1072-1 - Multiple vulnerabilities have been discovered and addressed in the Linux kernel. Gleb Napatov discovered that KVM did not correctly check certain privileged operations. Dave Chinner discovered that the XFS filesystem did not correctly order inode lookups when exported by NFS. Dan Rosenberg discovered that several network ioctls did not clear kernel memory correctly. Dan Jacobson discovered that ThinkPad video output was not correctly access controlled. Various other issues have also been addressed.
812b3e28ec2f6132fd1f95415c8a0227bd33b2de0533cab3591015f15aead3cbMandriva Linux Security Advisory 2011-029 - Multiple vulnerabilities have been discovered and fixed in the Linux 2.6 kernel. The X.25 implementation does not properly parse facilities, which allows remote attackers to cause a denial of service (heap memory corruption and panic) or possibly have unspecified other impact via malformed data, a different vulnerability than CVE-2010-4164. The bcm_connect function Broadcast Manager in the Controller Area Network implementation in the Linux creates a publicly accessible file with a filename containing a kernel memory address, which allows local users to obtain potentially sensitive information about kernel memory use by listing this filename. The install_special_mapping function in mm/mmap.c does not make an expected security_file_mmap function call, which allows local users to bypass intended mmap_min_addr restrictions and possibly conduct NULL pointer dereference attacks via a crafted assembly-language application. Various other issues have also been addressed.
65f216d797172b0ef5fb798cc0c6bfad2e1a9bea20f92874be16068901dbc644Zero Day Initiative Advisory 11-088 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Cisco Security Agent Management Console. Authentication is not required to exploit this vulnerability. The flaw exists within the webagent.exe component which is handed requests by an Apache instance that listens by default on TCP port 443. When handling an st_upload request the process does not properly validate POST parameters used for a file creation. The contents of this newly created file are controllable via another POST variable. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the SYSTEM user.
afbe55b3e564da923681dad32e0726e55ac683aee2d12b50ef9cf2d3abb1b9a3A vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Adobe Shockwave Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the IML32 module distributed with the player. While parsing GIF files within a director movie (.dir or .dcr) the code trusts the specified size of the global color table and uses it to determine an offset to image data. The process subsequently attempts to write two NULL bytes to the calculated address. A remote attacker can abuse this logic to corrupt memory at a controlled location and subsequently execute arbitrary code under the context of the user running the application.
9665e8d242dba1521f1087c1dfbf723d6e69c1a95471fff6082b1b23f8090e7bZero Day Initiative Advisory 11-073 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The flaw exists within the ICC parsing component of ACE.dll. It is possible to cause an integer overflow due to several multiplications of controlled byte values. This leads to the allocation of a small buffer which can subsequently be overflowed. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the user running Reader.
5377eaefd1b16bdd7c45ed58a3f1023c146fc042640043e07d743d13564d3b84Secunia Security Advisory - Two vulnerabilities have been reported in Aruba Mobility Controller, which can be exploited by malicious people to cause a DoS (Denial of Service) and bypass certain security restrictions.
24ee0d187ee4df77e3eb722a3d05cc79c9ab69cd7e839b473972e870a41c3261Zero Day Initiative Advisory 11-029 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec Alert Management System. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HDNLRSVC.EXE service while processing data sent from the msgsys.exe process which listens by default on TCP port 38292. This process passes user-supplied data directly to a CreateProcessA call. By supplying a UNC path to a controlled binary a remote attacker can execute arbitrary code under the context of the vulnerable daemon.
7374c4395937828b4c9608b5274a8438294d68ae60ae99dea9195de9b79871b6Zero Day Initiative Advisory 10-301 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trent Micro Control Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within how the mrf.exe component composes a string used to display an error message. The application will build the string using a buffer located on the stack using a sprintf call. As attacker controlled data is used to construct the string, this can lead to code execution under the context of the application.
cfd0a2fa84cd87ea72f29406f7fd6f81cba279579eaebc2090e64c5dd51f4f27Mandriva Linux Security Advisory 2011-012 - Multiple vulnerabilities has been found and corrected in mysql. storage/innobase/dict/dict0crea.c in mysqld in MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service innodb_file_per_table configuration parameters for the InnoDB storage engine, then executing a DDL statement. MySQL 5.1 before 5.1.49 and 5.0 before 5.0.92 allows remote authenticated users to cause a denial of service (mysqld daemon crash) via a join query that uses a table with a unique SET column. MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service CASE operations with NULL arguments that are explicitly specified or indirectly provided by the WITH ROLLUP modifier. Various other issues have also been addressed.
5431cb0aff4efc32b29260be3f43eab188d9caed0153f7f875cab833616ce1eaHitNote E-Zine 0x04 - This issue has topics like Trolls, Reversing alternatives, The proximity to visible and more. Written in Italian.
ae1c1fa3287bace19361f966628abd27096489cc6ee1f6347723f3ea1326e426Network Security Policy Compiler (NetSPoC) is a tool for security management of large networks with different security domains. It generates configuration files for packet filters controlling the borders of security domains. It provides its own language for describing security policy and the topology of a network. The security policy is a set of rules that state which packets are allowed to pass the network and which are not. NetSPoC is topology aware - a rule for traffic from A to B is automatically applied to all managed packet filters on the path from A to B.
ea053436cd1ab9bb0cc729820cfbddf3c683e8b3d78baca678b30f73156d22c7This Metasploit module exploits an arbitrary command execution vulnerability in the Redmine repository controller. The flaw is triggered when a rev parameter is passed to the command line of the SCM tool without adequate filtering.
b07063132a30d982b8374ebb512a724b5c8499987169c5fc9e3ffb5ff0057e46
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed