Software

Critical Microsoft Vista/2008/Windows 7 Zero-day Remote BSOD Found

On 09.08.09, In Corporate, Security, Software, By Kyle

Remember back in the days of Windows 95 when someone could use the OOB attack to remotely BSOD a PC? Well now you can relive your youth with a classic throwback from Microsoft! Windows Vista, 2008, and 2007 of all variants all have a similar vulnerability that allows a remote attacker take your machine down with a simple ampersand. Leave it up to Microsoft to do it all again more than a decade later.

The SMB 2.0 driver in x86 and x64 versions of Windows Vista, Server 2008, and Windows 7 are all one in the same. When sent the “&” character in the “Process ID High” SMB header, the process pagefaults and brings us the beloved Blue Screen of Death we’ve all come to know and love.

Credit goes to Laurent Gaffié and you can find the Proof-of-Concept on his blog.

Share

Tagged with: ampersand • attack • attacker • blue screen of death • BSOD • Laurent Gaffié • microsoft • microsoft vista • microsoft windows vista • OOB • process id • proof of concept • SMB • throwback • versions of windows vista • vulnerability • zero day

OpenSSH exploit might or might not be out there

On 07.07.09, In Cryptography, Firewalls, Hacking, Net Issues, Software, By Kyle

SANS has posted that they’ve heard grumblings on the Internets of a new OpenSSH exploit in the wild. They haven’t gotten their hands on it yet, but they’ve had several reports and a console log of the supposed exploit in action.

More info after the jump. SANS Diary on the Exploit

Share

Tagged with: exploit • explot • Internets • isc • OpenSSH • SANS

Microsoft DirectShow ActiveX Buffer Overflow exploit in the wild

On 07.06.09, In Software, By Kyle

Be sure to check for patches and network security appliance definitions/signatures today, Microsoft has been reminded again of why people hate ActiveX; Secunia is reporting a nasty new DirectShow Buffer Overflow attack is in the wild. This one is very dangerous, as it exploits the built-in DirectShow control in Internet Explorer (msvidctl.dll) by using specially-crafted image content to create a boundary error and subsequently cause a stack-based buffer overflow allowing the attacker to execute arbitrary code on the compromised machine.

The worst part? It’s already being actively used by bad people. Although Secunia’s site currently shows Windows XP as the only OS vulnerable, I wouldn’t be surprised to see more versions of Windows tacked on in the near future.

More information can be found here.

Share

Tagged with: ActiveX • activex buffer overflow • Advisory • attack • based buffer overflow • boundary • Buffer • buffer overflow attack • code • DirectShow • dll • image content • internet explorer • microsoft • microsoft directshow • msvidctl • network security appliance • Overflow • secunia • stack overflow

When security software becomes the malware itself

On 05.02.09, In Security, Software, By Kyle

“Be careful when you fight the monsters, lest you become one.” -Friedrich Nietzsche

The developers of popular Mozilla extension AdBlock Plus had been receiving bug reports of “issues” with another popular extension, NoScript, after an update was issued by the developer of the script-blocking software. The AdBlock Plus developers decided to take a look into what was wrong and found something extremely disturbing. The 1.9.2 update of NoScript had incorporated an obfuscated piece of code that actually made changes to AdBlock Plus to allow for ads on the NoScipt and related sites to be shown. In otherwords, it does what a viruses and other malware does to antivirus software only in reverse; instead of blocking access to update sites, it forced AdBlock Plus to allow ads to be shown for the developer’s site explicitly. This most likely would have flown under the radar had it not completely broken Adblock Plus and get caught doing unethical things to other software for self-interest. The issue snowballed when the issue made it to Reddit and caused an outrage amongst faithful users of both extensions. To make things worse, the developer only slightly backtracked; allowing the user to allow or disallow the code modification upon installation of NoScript. The developer eventually removed the code completely in version 1.9.2.6, but not without severely impacting user opinion of the software and spurring discussion of a policy change regarding Mozilla Extensions.

More after the jump.

http://adblockplus.org/blog/attention-noscript-users