CVE-2016-4484: - Cryptsetup Initrd root Shell

lso possible to remotely exploit this vulnerability without having "physical access." Full description: - http://hmarco.org/bugs/CVE-2016-4484/CVE-2016-4484_cryptsetup_initrd_shell.html Regards, Hector Marco & Ismael Ripoll. signature.asc Description: OpenPGP digital signature

Back to 28: Grub2 Authentication Bypass 0-Day [CVE-2015-8370]

). And so, the attacker may take control of the computer. More details at: http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html Regards, Hector Marco & Ismael Ripoll. -- Dr. Hector Marco-Gisbert @ http://hmarco.org/ Cyber Security Researcher @ http://cybersecurity.up

AMD Bulldozer Linux ASLR weakness: Reducing entropy by 87.5%

-by-eight.html We sent a patch, and Linux 4.1 Will Improve AMD Bulldozer's ASLR Entropy Issue: http://www.spinics.net/lists/linux-tip-commits/msg27373.html -- Hector Marco-Gisbert @ http://hmarco.org/ Cyber Security Researcher @ http://cybersecurity.upv.es Universitat Politècnica de València

Linux ASLR mmap weakness: Reducing entropy by half

). Advisory details at: http://hmarco.org/bugs/linux-ASLR-reducing-mmap-by-half.html -- Hector Marco-Gisbert @ http://hmarco.org/ Cyber Security Researcher @ http://cybersecurity.upv.es Universitat Politècnica de València (Spain)

CVE-2015-1593 - Linux ASLR integer overflow: Reducing stack entropy by four

at: http://hmarco.org/bugs/linux-ASLR-integer-overflow.html Regards, Hector Marco. http://hmarco.org

CVE-2015-1574 - Google Email App 4.2.2 remote denial of service

, Hector Marco. http://hmarco.org

Offset2lib: bypassing full ASLR on 64bit Linux

exploit, recommendations and a demonstrative video has been publish at: http://cybersecurity.upv.es/attacks/offset2lib/offset2lib.html Hector Marco. http://cybersecurity.upv.es

CVE-2014-5439 - Root shell on Sniffit [with exploit]

Space Layout Randomisation ASLR And execute arbitrary code with root privileges. Exploit, fix and discussion in: http://hmarco.org/bugs/CVE-2014-5439-sniffit_0.3.7-stack-buffer-overflow.html Regards, Hector Marco. http://hmarco.org Cybersecurity researcher at: http://cybersecurity.upv.es/

Re: Bug in bash = 4.3 [security feature bypassed]

On 05/06/14 12:02, Daryl Tester wrote: On 03/06/14 23:46, Hector Marco wrote: Recently we discovered a bug in bash. After some time after reporting it to bash developers, it has not been fixed. ... Any comments about this issue are welcomed. Details at: http://hmarco.org/bugs/bash_4.3

Re: [FD] [oss-security] Bug in bash = 4.3 [security feature bypassed]

more sense nowadays than when was initially coded. 2014-06-03 16:16 GMT+02:00 Hector Marco hecma...@upv.es: Hi everyone, Recently we discovered a bug in bash. After some time after reporting it to bash developers, it has not been fixed. We think that this is a security issue because in some

CVE-2013-6876 s3dvt Root shell

at: http://hmarco.org/bugs/s3dvt_0.2.2-root-shell.html Because we found a bug in bash = 4.3 this vulnerability can be successfully exploited. Bash bug details at: http://hmarco.org/bugs/bash_4.3-setuid-bug.html Hector Marco http://hmarco.org

CVE-2013-6825 DCMTK Root Privilege escalation

are: - dcmpsrcv - dcmprscp - movescu - storescp - dcmqrscp - wlmscpfs - dcmrecv Details, patches, discussion and strategy to exploit at: http://hmarco.org/bugs/dcmtk-3.6.1-privilege-escalation.html Hector Marco http://hmarco.org

CVE-2014-1226 s3dvt Root shell (still)

this vulnerability can be successfully exploited. Bash bug details at: http://hmarco.org/bugs/bash_4.3-setuid-bug.html Hector Marco http://hmarco.org

Bug in bash = 4.3 [security feature bypassed]

in an attack. We strongly recommend to patch your bash code. Why don't fix this bug by simple adding mandatory if clause ? Any comments about this issue are welcomed. Details at: http://hmarco.org/bugs/bash_4.3-setuid-bug.html Thanks you, Hector Marco http://hmarco.org

[FD] CVE-2013-6876 s3dvt Root shell

at: http://hmarco.org/bugs/s3dvt_0.2.2-root-shell.html Because we found a bug in bash = 4.3 this vulnerability can be successfully exploited. Bash bug details at: http://hmarco.org/bugs/bash_4.3-setuid-bug.html Hector Marco http://hmarco.org

CVE-2014-1226 s3dvt Root shell (still)

this vulnerability can be successfully exploited. Bash bug details at: http://hmarco.org/bugs/bash_4.3-setuid-bug.html Hector Marco http://hmarco.org

CVE-2013-6825 DCMTK Root Privilege escalation

are: - dcmpsrcv - dcmprscp - movescu - storescp - dcmqrscp - wlmscpfs - dcmrecv Details, patches, discussion and strategy to exploit at: http://hmarco.org/bugs/dcmtk-3.6.1-privilege-escalation.html Hector Marco http://hmarco.org

CVE-2013-4788 - Eglibc PTR MANGLE bug

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi guys, The following is a bug that we found while we were working around stack smashing protection techniques. Title: CVE-2013-4788 - Eglibc PTR MANGLE bug 0.- Description This bug was discovered in March 2013 while we were developing the RAF