RedKernel-Softwares.com > SecuriTeam.com NEWS

RedKernel-Softwares > SecuriTeam.com NEWS

SecuriTeam.com NEWS

Apple Mac OS X Mach Port Inheritance Privilege Escalation Vulnerability
Mach ports are used to provide inter-process communication (IPC) facilities on Mac OS X.

OmniPCX Enterprise VoIP Phone Audio Stream Rerouting Vulnerability
A vulnerability in Alcatel's OmniPCX allows remote attackers to cause the product to no longer be able to receive audio by sending it a malformed TFTP request.

Live555 RTSP Server Denial of Service
LIVE555 Media Server is an open source Real Time Streaming Protocol (RTSP) server application released under LGPL.

QuickTime Panorama Sample Atom Heap Overflow (Technical Details)
QuickTime is prone to a heap overflow vulnerability when parsing malformed Panorama Sample Atoms, which are used in QuickTime Virtual Reality Movies. This Vulnerability allows attackers to execute code on vulnerable installations. Successful exploitation via Web Browser requires that the attacker should trick the user into visiting a specially crafted webpage.

Oracle 10g R2 PITRIG_DROPMETADATA Buffer Overflow Vulnerability
Oracle Database Server is "a family of database products that range from personal databases to enterprise solutions". Remote exploitation of a buffer overflow in the XDB.XDB_PITRIG_PKG.PITRIG_DROPMETADATA procedure in Oracle Corp.'s Database 10gR2 could allow a user with an authenticated session to execute arbitrary code in the context of the database account.

Multiple Apple Mac OS X AppleTalk
AppleTalk, "a set of networking protocols developed by Apple, was originally implemented on early Mac operating systems. Although it is a legacy protocol, it is still supported on the latest version of Mac OS X. AppleTalk is compiled into the default kernel, but must be turned on in order to be used".

IBM Informix Dynamic Server DBLANG Directory Traversal Vulnerability
IBM Corp.'s Informix Dynamic Server is an online transaction processing data server. It contains several set-uid root binaries.

Link Grammar "separate_sentence()" Buffer Overflow
The Link Grammar Parser is "a syntactic parser of English, based on link grammar, an original theory of English syntax. Given a sentence, the system assigns to it a syntactic structure, which consists of a set of labeled links connecting pairs of words. The parser also produces a "constituent" representation of a sentence (showing noun phrases, verb phrases, etc.)" Secunia Research has discovered a vulnerability in Link Grammar, which can be exploited by malicious people to compromise an application using the affected code.

AbiWord Link Grammar separate_sentence() Buffer Overflow
The Link Grammar Parser is "a syntactic parser of English, based on link grammar, an original theory of English syntax. Given a sentence, the system assigns to it a syntactic structure, which consists of a set of labeled links connecting pairs of words. The parser also produces a "constituent" representation of a sentence (showing noun phrases, verb phrases, etc.)." Secunia Research has discovered a vulnerability in AbiWord Link Grammar, which can be exploited by malicious people to compromise an application using the library.

Xpdf Stream.cc Multiple Vulnerabilities
Xpdf is "an open source viewer for Portable Document Format (PDF) files. (These are also sometimes also called 'Acrobat' files, from the name of Adobe's PDF software.) The Xpdf project also includes a PDF text extractor, PDF-to-PostScript converter, and various other utilities." Secunia Research has discovered some vulnerabilities in Xpdf, which can be exploited by malicious people to compromise a user's system.

Apple Quicktime Movie Stack Overflow Vulnerability
A vulnerability allows attackers to execute arbitrary code on vulnerable installations of Apple Quicktime. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

Predictable DNS Transaction IDs in Microsoft DNS Server
Microsoft DNS server generates predictable DNS transaction IDs. If the server is configured to allow recursive queries it is possible to insert fake records in the DNS cache (DNS cache poisoning) by guessing the next transaction ID that the server will use and sending a spoofed DNS reply to the server. To observe the transaction IDs an attacker needs to control a DNS server that is authoritative for some domain and to be able to send a recursive queries to the caching Microsoft DNS server

Vulnerability in Windows URI Handling Could Allow Remote Code Execution (MS07-061)
A remote code execution vulnerability exists in the way that the Windows shell handles specially crafted URIs that are passed to it. An attacker could exploit this vulnerability by including a specially crafted URI in an application or attachment, which could potentially allow remote code execution.

Vulnerability in DNS Allows Spoofing (MS07-062)
A spoofing vulnerability exists in Windows DNS Servers. The vulnerability could allow non-privileged users to send malicious responses to DNS requests, thereby spoofing or redirecting Internet traffic from legitimate locations.

Novell NetWare Client Local Privilege Escalation Vulnerability
The Novell Client software provides "a workstation with access to Novell NetWare networks as well as Novell Open Enterprise Server (OES) services. Novell Clients can access the full range of Novell services such as authentication via Novell eDirectory, network browsing and service resolution, and secure and reliable file system access". Local exploitation of an input validation error vulnerability within Novell NetWare Client could allow an unprivileged attacker to execute arbitrary code within the kernel.

Stack-Based Buffer Overflow Vulnerability in OpenBSD's DHCP Server (Exploit)
Stack-based buffer overflow in the cons_options function in options.c in dhcpd in OpenBSD 4.0 through 4.2, and some other dhcpd implementations based on ISC dhcp-2, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a DHCP request specifying a maximum message size smaller than the minimum IP MTU. The following exploit code can be used to test your DHCP server for the mentioned MMS issue (maximum message size).

Apache Tomcat File Disclosure (Exploit)
A vulnerability in Apache Tomcat allows remote attackers to disclose the content of files stored on the remote server by exploiting a vulnerability in the way the WebDAV LOCK function handles requests.

IA32 System Call Emulation Vulnerability (Exploit)
Insufficient validation of general-purpose register in IA32 system call emulation code may lead to local system compromise on x86_64 platform.

Airsensor M520 HTTPD Preauth DoS and Buffer Overflow (Exploit)
A vulnerability in Airsensor M520 is caused due to an unspecified error in the CGIs files filter used for configure proprieties. This can be exploited by sending a specially crafted HTTPS request (necessary authentication), which will cause the HTTPS service on the system to crash.

Diskeeper Remote Memory Disclosure
A vulnerability in Diskeeper allows remote users to access memory segments via the Diskeeper service (which runs at SYSTEM privileges).

Cryptanalysis of the Random Number Generator of the Windows Operating System
The pseudo-random number generator (PRNG) used by the Windows operating system is the most commonly used PRNG. The pseudo-randomness of the output of this generator is crucial for the security of almost any application running in Windows. Nevertheless, its exact algorithm was never published.

Windows Personal Firewall Analysis
During Matousek security analyses of personal firewalls and other security-related software that uses SSDT hooking, Matousek found out that many vendors simply do not implement the hooks in a proper way. This allows local Denial of Service by unprivileged users or even privilege escalations exploits to be created. 100% of tested personal firewalls that implement SSDT hooks do or did suffer from this vulnerability! This article reviews the results of our testing and describes how a proper SSDT hook handler should be implemented. Matousek also introduced BSODhook - a handy tool for every developer that deals with SSDT hooks and a possible cure for the plague in today's Windows drivers world.

Biologger - A Biometric Keylogger
In the paper linked in the end IRM realized a proof-of-concept implementation of a biometric keylogger, or "Biologger". While conventional keyloggers are typically used to obtain passwords or encryption keys to circumvent specific security measures, IRM's Biologger will aim to capture biometric-related data between a biometric device and other processing units, to be used and exploited in a number potential attack vectors against the biometric system, such as manipulation of biometric data and control signals, as per traditional man-in-the middle attacks.

Tactical Exploitation and Response Over Solaris Sparc 5.8 and 5.9 Systems
The linked paper provides a good guide and checklist to secure Sun Microsystems' Solaris Sparc Systems (5.8 and 5.9).

Anti Forensics: Making Computer Forensics Hard
The linked paper explains how Anti Forensics are currently being conducted by hackers, what methods they have of hiding information and what the future holds in this field.

Contact: Email or

ICQ 97265485
Copyright IDDN Certification

RedKernel-Softwares
Hosted By RedKernel-Hosting

FREEWARES

RedKernel Referer Tracker

Sources/Functions...

ONLINE TOOLS

Small Tools

USEFUL NEWS

Misc/Secu

SOFTWARES

Commercial Scripts ?

RedKernel-Softwares > SecuriTeam.com NEWS

SecuriTeam.com NEWS

SEARCH

MISCELLANEOUS