headers
Mario Alejandro Vilas Jerez | 1 Dec 2009 04:47
Picon
Gravatar

WinAppDbg 1.3 is out!

What is WinAppDbg?

==================

The WinAppDbg python module allows developers to quickly code instrumentation

scripts in Python under a Windows environment.

It uses ctypes to wrap many Win32 API calls related to debugging, and provides

an object-oriented abstraction layer to manipulate threads, libraries and

processes, attach your script as a debugger, trace execution, hook API calls,

handle events in your debugee and set breakpoints of different kinds (code,

hardware and memory). Additionally it has no native code at all, making it

easier to maintain or modify than other debuggers on Windows.

The intended audience are QA engineers and software security auditors wishing to

test / fuzz Windows applications with quickly coded Python scripts. Several

ready to use utilities are shipped and can be used for this purposes.

Current features also include disassembling x86 native code (using the open

source diStorm project, see http://ragestorm.net/distorm/), debugging multiple
(Continue reading)

Permalink | Reply | 0 comments |
headers
FreeBSD Security Officer | 1 Dec 2009 02:20
Picon
Favicon

Upcoming FreeBSD Security Advisory


Hi all,

A short time ago a "local root" exploit was posted to the full-disclosure
mailing list; as the name suggests, this allows a local user to execute
arbitrary code as root.

Normally it is the policy of the FreeBSD Security Team to not publicly
discuss security issues until an advisory is ready, but in this case
since exploit code is already widely available I want to make a patch
available ASAP.  Due to the short timeline, it is possible that this
patch will not be the final version which is provided when an advisory
is sent out; it is even possible (although highly doubtful) that this
patch does not fully fix the issue or introduces new issues -- in short,
use at your own risk (even more than usual).

The patch is at
  http://people.freebsd.org/~cperciva/rtld.patch
and has SHA256 hash
  ffcba0c20335dd83e9ac0d0e920faf5b4aedf366ee5a41f548b95027e3b770c1

I expect a full security advisory concerning this issue will go out on
Wednesday December 2nd.
Permalink | Reply | 0 comments |
headers
c0dy | 1 Dec 2009 17:14

Theeta CMS (Cross Site Scripting,SQL Injection) Multiple Vulnerabilities

##################################################################
##################################################################
#          ___   ___  _   _____        __                   _    #
#         / _ \ / _ \| | |  __ \      / _|                 | |   #
#    _ __| | | | | | | |_| |  | | ___| |_ __ _  ___ ___  __| |   #
#   | '__| | | | | | | __| |  | |/ _ \  _/ _` |/ __/ _ \/ _` |   #
#   | |  | |_| | |_| | |_| |__| |  __/ || (_| | (_|  __/ (_| |   #
#   |_|   \___/ \___/ \__|_____/ \___|_| \__,_|\___\___|\__,_|   #
#                                                                #
#                                                                #
#                                             +-+-+-+-+          #
#                                             |C|r|e|w|          #
#                                             +-+-+-+-+          #
##################################################################
##################################################################
# [#] Theeta CMS (Cross Site Scripting,SQL Injection) Multiple Vulnerabilities  #
# [#] Discovered By c0dy                                         #
# [#] http://r00tDefaced.net                                     #
# [#] Greetz: sHoKeD-bYte, syst0x1c & r00tDefaced Members        #
##################################################################
#
# [1]-Cross Site Scripting
#
# Vulnerability Description:
#               Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web
applications which allow code #injection by malicious web users into the web pages viewed by other users.
#
# Affected items:
#          http://127.0.0.1/community/thread.php?start=[XSS] 
#          http://127.0.0.1/community/thread.php?forum=[XSS]
(Continue reading)

Permalink | Reply | 0 comments |
headers
Secunia Research | 2 Dec 2009 13:27
Favicon

Secunia Research: Roxio Creator Image Rendering Integer Overflow Vulnerability

====================================================================== 

                     Secunia Research 02/12/2009

   - Roxio Creator Image Rendering Integer Overflow Vulnerability -

====================================================================== 
Table of Contents

Affected Software....................................................1
Severity.............................................................2
Vendor's Description of Software.....................................3
Description of Vulnerability.........................................4
Solution.............................................................5
Time Table...........................................................6
Credits..............................................................7
References...........................................................8
About Secunia........................................................9
Verification........................................................10

====================================================================== 
1) Affected Software 

* Roxio Easy Media Creator 9.0.136
* Roxio Creator 2010

NOTE: Other versions may also be affected.

====================================================================== 
2) Severity
(Continue reading)

Permalink | Reply | 0 comments |
headers
smf2.review | 2 Dec 2009 04:37
Picon

40 vulnerabilities in SMF 1.1.10/SMF 2.0RC2 by elhacker.net (Simple Audit)

This is the first batch of vulnerabilities found by the SimpleAudit team from elhacker.net
http://labs.elhacker.net/simpleaudit

Our goal is to evaluate the security of SMF 2.0 before using it on our own server, and we have found several
security vulnerabilities.

The vulnerabilities that also apply to SMF 1.1.10 were fixed by the SMF team today, on SMF 1.1.11 visit
simplemachines.org for details.

You can review the list of the published vulnerabilities in:
http://code.google.com/p/smf2-review/issues/list

 

  CSRF, RCE   PHP Remote Code Execution SMF2 www.kernel32   
  CSRF   CSRF theme change SMF2, SMF1 www.kernel32   
  CSRF   Subforum Category Collapse CSRF SMF2, SMF1 www.kernel32   
  CSRF   CSRF en el gestor de servidores de paquetes SMF2, SMF1 www.kernel32   
  XSS   XSS in package server manager SMF2, SMF1 www.kernel32   
  CSRF   CSRF package deletion and installed package disclosure SMF2 www.kernel32   
  CSRF, XSS   Attached files configuration CSRF SMF2 www.kernel32   
  XSS   XSS in "Enable basic HTML in posts" SMF2 sirdarckcat   
  RFD   Remote File Disclosure (solo en logs, y similares) SMF2 sirdarckcat   
  CSRF   CSRF en Moderation Preferences SMF2 sirdarckcat   
  XSS   XSS en el censurador de palabras SMF2, SMF1 sirdarckcat   
  CSRF   CSRF in Polls SMF2, SMF1 sirdarckcat   
  XSS   installer XSS SMF2 brlvldvlsmrtnz   
  XSS   XSS in the installer (install.php) SMF2 cicatriz.r00t   
  CSRF   CSRF in the message rule manager SMF2 cicatriz.r00t   
  XSS   XSS in smileys manager SMF2 cicatriz.r00t
(Continue reading)

Permalink | Reply | 0 comments |
headers
Andrew Farmer | 1 Dec 2009 18:00
Picon

Re: [Full-disclosure] Remote Command Execution in dotDefender Site Management

On 30 Nov 2009, at 07:48, John Dos wrote:
> After passing the Basic Auth login you can create/delete applications.

If Basic auth is the only protection, isn't dotDefender also vulnerable to XSRF?
Permalink | Reply | 0 comments |
headers
Robert BARABAS | 1 Dec 2009 21:01
Picon

Re: ** FreeBSD local r00t zeroday

> FreeBSD 7.1-RELEASE *** VULNERABLE
7.2 also proved to be vulnerable.
Regards,

DC
--

-- 
GnuPG / PGP-Key: A44B63B0
Fingerprint: AADB C589 5397 CADB 56DA 051C C5C6 DEE9 A44B 63B0
Permalink | Reply | 1 comment |
headers
Juha-Matti Laurio | 2 Dec 2009 12:51
Picon
Favicon

Same-origin policy bypass vulnerabilities in several VPN products reported

Vulnerabilities in several clientless SSL VPN products have been reported.

Gathering authentication cookies etc. is reportedly possible.
At time of writing US-CERT's advisory lists the status of about 90 vendors.

US-CERT Vulnerability Note VU#261869:
http://www.kb.cert.org/vuls/id/261869
Severity metric is remarkable high: 45,00.

This issue is CVE-2009-2631.

Juha-Matti
Permalink | Reply | 0 comments |
headers
Secunia Research | 2 Dec 2009 12:53
Favicon

Secunia Research: Lateral Arts Photobox uploader ActiveX Control Buffer Overflow

====================================================================== 

                     Secunia Research 02/12/2009

      - Lateral Arts uploader ActiveX Control Buffer Overflow -

====================================================================== 
Table of Contents

Affected Software....................................................1
Severity.............................................................2
Description of Vulnerability.........................................3
Solution.............................................................4
Time Table...........................................................5
Credits..............................................................6
References...........................................................7
About Secunia........................................................8
Verification.........................................................9

====================================================================== 
1) Affected Software 

* Lateral Arts Photobox uploader ActiveX Control 2.2.0.6

NOTE: Other versions may also be affected.

====================================================================== 
2) Severity 

Rating: Highly critical
(Continue reading)

Permalink | Reply | 0 comments |
headers
Barkın KILIÇ | 2 Dec 2009 17:44
Favicon

Re: ** FreeBSD local r00t zeroday

On Tue, 1 Dec 2009 15:01:13 -0500
Robert BARABAS <dc <at> ktk.bme.hu> wrote:

> > FreeBSD 7.1-RELEASE *** VULNERABLE
> 7.2 also proved to be vulnerable.
> Regards,
> 
> DC

7.0 is also vulnerable
Permalink | Reply | 0 comments |

Gmane