Plash (the Principle of Least Authority Shell) is a Unix shell that lets you run Unix programs with access only to the files and directories they need to run. In order to implement this, the filesystem is virtualized. Each process can have its own namespace, which can contain a subset of your files. Plash is implemented by modifying GNU libc and replacing the system calls that use filenames. For example, open() is changed so that it sends a message to a file server via a socket. If the request is successful, the server sends the client a file descriptor. Processes are run in a chroot jail under dynamically-allocated user IDs. No kernel modifications are required. Existing Linux binaries work unchanged.
ebf55af4f80c9b05f149d2190bc78c549b4f6d7b2e01743c9a27bf456abca202Snort2Pf is a small Perl daemon which greps Snort's alertfile and blocks the bad hosts for a given amount of time using pfctl.
308149e0fcd8bf054c406a330a2f2b9c78a536d24b8a64593e8a8b68667a9a2dVuurmuur is a middle-end and front-end for netfilter and iptables that is aimed at system administrators who need a decent firewall, but do not have netfilter specific knowledge. It converts human-readable rules into an iptables ruleset (or optional a bash script), makes netfilter logs readable, and includes an ncurses GUI.
cdda552fdbe0dd68dfb2ade2a4c35a47e042bb3bec1f1360778efb78921782f4Utility for limiting background processes on a per user basis on BSD platforms.
87efdec9a8c8dc19cc2e6a8efa2f03d19a8c4748eaee2b3c1d798bb7c86f4153MyBB is prone to a SQL injection attack within the uid parameter of member.php. The flaw allows for retrieval of the admin password hash. Sample exploit provided.
e0f95937d8f77265e2b0b8c030cda85b05c5e4fa90eae6f11ff489097bbc33d0Gentoo Linux Security Advisory GLSA 200501-02 - The fixps and psmandup scripts in the a2ps package are vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files. Versions below 4.13c-r2 are affected.
0c018799e71caf9c189afdf3a29bff2781eed17a7d14807a8bc5c8d8b67158bdQWikiwiki 1.4.1 is susceptible to a directory traversal vulnerability. Detailed exploitation provided.
f121585069294006535400bd7a8b1c2c83396b02c0c3208da56c9250f1e05e40Russian word list that has 296790 words.
17d4e1188997605a75cf6baf301d1ae02602e41f7ef1fadd91f8a41bda597664Remote proof of concept exploit for Soldner that demonstrates a socket termination when an oversized UDP packet is sent to the server.
010a24a60fd04ac41eb59c4fa05887a18229b63421b910d2dfbc141d3974c964Soldner, the tactical military game by Wings Simulations, is susceptible to silent socket termination, format string, and cross site scripting flaws.
d406a8086d751f07a524645aa489a9fcac21dea5d48bad84de3263bb19a1b224KDE Security Advisory: KDE applications which use the ftp kioslave, e.g. Konqueror, allow remote attackers to execute arbitrary FTP commands via an ftp:// URL that contains an URL-encoded newline ( %0a ) before the ftp command, which causes the commands to be inserted into the resulting FTP session. Due to similarities between the ftp and the SMTP protocol, this vulnerability allows to misuse the ftp slave to connect to a SMTP server and issue arbitrary commands, like sending an email. Systems affected: All KDE releases up to including KDE 3.3.2.
4429ce691dd6dfc1eb15fafba3e0a37e86e5eae8b2d37f239250facce7ba3781Secunia Security Advisory - Michael Krax has reported a vulnerability in Bugzilla, which can be exploited by malicious people to conduct cross-site scripting attacks.
4aa1aadc34709e8c5049c54376259a699706a316c04b66fc21f2b89f51c65e0bMicrosoft Windows NetDDE scanner that makes use of a remote code execution vulnerability due to an unchecked buffer.
05061a5691b6dcee7bd018fd1278d6d1f5d0071c7f2ffe6dd1da4a5631e0de163Com's 3CDaemon 2.0 revision 10 is susceptible to multiple vulnerabilities ranging from various format string and denial of service flaws.
8382b93ecb919ccbd6085f76b1982ab43b8657f3df0a3c470c35458dc4ee778fiWebNegar version 1.1 remote configuration nullification denial of service exploit.
0e91bdce0b0968f8e3ac0ed16e3e026aa3db29b4307b18844c908554d10e9f01pptp-bruter is a brute force program that works against pptp vpn endpoints (tcp port 1723). It is fully standalone and supports the latest MSChapV2 authentication. It exploits a weakness in Microsoft's anti-brute force implementation which makes it possible to try 300 passwords the second. Tested against Microsoft Windows and Cisco gateways.
df789676b97406214d3f18c744dabd3769182428365ecdcc8a0a6ddcde3b6f2dTHC-Hydra is a high quality parallelized login hacker for Samba, Smbnt, Cisco AAA, FTP, POP3, IMAP, Telnet, HTTP Auth, LDAP, NNTP, MySQL, VNC, ICQ, Socks5, PCNFS, Cisco and more. Includes SSL support, parallel scans, and is part of Nessus.
8ebac6b886c91caa907297938c4beac3622a1f94088fbfa5908106d64013edf1Secunia Research has discovered a vulnerability in Mozilla / Mozilla Firefox, which can be exploited to spoof the source displayed in the Download Dialog box. The problem is that long sub-domains and paths are not displayed correctly, which therefore can be exploited to obfuscate what is being displayed in the source field of the Download Dialog box. The vulnerability has been confirmed in Mozilla 1.7.3 for Linux and Mozilla Firefox 1.0.
a34b640f70ddc606dfd05747def65a8fcb3787cf889e9e3a01a9b0f7515e55b9Proof of concept exploit for an old format string vulnerability in setuid versions of top. This vulnerability has popped back up in the Solaris 10 Companion CD.
9842f1e35ea800234ee1ff28c9db6a44ab8417bc36c0166992291eab98417bdfAn old format string vulnerability in setuid versions of top has popped back up in the Solaris 10 Companion CD.
e5eb6c2c021c50cbd277e4a3bf9be9224e71d84c31ce80d8354b58ec76e4fc1cGulfTech Security Research - PhotoPost PHP versions 4.8.6 and below suffer from cross site scripting and SQL injection flaws. Sample exploitation given.
9164a527e96037d4f91e6259533d1963896e29011c65db9f5aa50c5115976686GulfTech Security Research - ReviewPost PHP Pro versions below 2.84 suffer from cross site scripting and SQL injection attacks. Sample exploitation given.
1685976453b7ca1ae8a01d59a18c0a465312052235bf84006810e857c2489436A generic problem of common personal firewall products is the allowance of shortcuts or interfaces for controlling traffic. Manipulation of these functions can allow for firewall bypass altogether. Various proof of concepts are included for products such as Zone Alarm, Kerio, Agnitium Outpost firewall, Kaspersky Anti-Hacker, Symantec's Norton Personal Firewall, and more.
0bde1ec221ee4623942f39bb82396353f8ecad9ef14dee23da7885e1887610c6
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed