Microsoft Windows SMB/CIFS privilege escalation updated since 13.06.2006
Published:		16.06.2006
Source:		BUGTRAQ
SecurityVulns ID:		6258
Type:		local
Level:		6/10
Description:		MRxSmbCscIoctlOpenForCopyChunk buffer overflow. In additions, there are DoS vulnerabilities not covered by MS06-30.

Affected:		MICROSOFT : Windows 2000 Server
		MICROSOFT : Windows 2000 Professional
		MICROSOFT : Windows XP
		MICROSOFT : Windows 2003 Server

Original document		Reversemode, Regarding "SMB Invalid Handle Value" - MS06-030. Vulnerability not fixed. (16.06.2006)
		ruben_(at)_reversemode.com, REVERSING MRXSMB.SYS CHAPTER I “Getting Ring0” (14.06.2006)
		ruben_(at)_reversemode.com, REVERSING MRXSMB.SYS CHAPTER II “NtClose DeadLock” (14.06.2006)
		IDEFENSE, iDefense Security Advisory 06.13.06: Windows MRXSMB.SYS MrxSmbCscIoctlCloseForCopyChunk DoS (14.06.2006)
		IDEFENSE, iDefense Security Advisory 06.13.06: Windows MRXSMB.SYS MRxSmbCscIoctlOpenForCopyChunk Overflow (14.06.2006)
		MICROSOFT, Microsoft Security Bulletin MS06-030 Vulnerability in Server Message Block Could Allow Elevation of Privilege (914389) (13.06.2006)

Files:		Exploit for the Mrxsmb.sys privilege escalation(MS06-030), which allows to execute ring0 shellcode. "Fast-Food" coding style, nasty but works. C source code.
		Exploit for the NtClose DeadLock vulnerability (MS06-030). C source code.
		http://www.microsoft.com/technet/security/Bulletin/MS06-030.mspx
Discuss:		Read or add your comments to this news (0 comments)

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
Published:		16.06.2006
Source:
SecurityVulns ID:		6269
Type:		remote
Level:		5/10
Description:		PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.

Affected:		ZEROBOARD : Zeroboard 4.1
		ANDYSCHAT : Andys Chat 4.5
		HOTPLUGCMS : HotPlugCMS 1.0
		APBOARD : APBoard 2.2
		MP3SEARCHARCHIVE : MP3 Search/Archive 1.2

Original document		SpC-x, Andys Chat 4.5 (action) Remote File Inclusion (16.06.2006)
		luny_(at)_youfucktard.com, MP3 Search/Archive v1.2 - XSS (16.06.2006)
		666_(at)_hell.de.tk, APBoard 2.2-r3 <= SQL Injections (16.06.2006)
		luny_(at)_youfucktard.com, ePrayver v.Alpha - XSS (16.06.2006)
		guest01_(at)_gmail.com, HotPlugCMS_1.0 - SQL Injection Vulnerability (16.06.2006)

Discuss:

Read or add your comments to this news (0 comments)

Microsoft Office code execution updated since 16.06.2006
Published:		10.08.2006
Source:		MIKEREAVEY
SecurityVulns ID:		6270
Type:		client
Level:		8/10
Description:		hlink.dll and Excel styles vulnerability, vulnerabilities in different record types processing are used to install malicious software in-the-wild.

Affected:		MICROSOFT : Office 2000
		MICROSOFT : Office XP
		MICROSOFT : Office 2003

Original document		TSRT_(at)_3com.com, TSRT-06-10: Microsoft HLINK.DLL Hyperlink Object Library Buffer Overflow Vulnerability (10.08.2006)
		TSRT_(at)_3com.com, [Full-disclosure] TSRT-06-10: Microsoft HLINK.DLL Hyperlink Object Library Buffer Overflow Vulnerability (09.08.2006)
		MICROSOFT, Microsoft Security Bulletin MS06-050 Vulnerabilities in Microsoft Windows Hyperlink Object Library Could Allow Remote Code Execution (920670) (09.08.2006)
		NSFOCUS, [VulnWatch] NSFOCUS SA2006-06 : Microsoft Excel COLINFO Record Buffer Overflow Vulnerability (12.07.2006)
		NSFOCUS, [VulnWatch] NSFOCUS SA2006-05 : Microsoft Excel SELECTION Record Memory Corruption Vulnerability (12.07.2006)
		xin ouyang, [Full-disclosure] Microsoft Excel Could Allow Remote Code Execution by Malformed FNGROUPCOUNT value Vulnerability (12.07.2006)
		Sowhat ., [Full-disclosure] Microsoft Excel Array Index Error Remote Code Execution (12.07.2006)
		ZDI, ZDI-06-022: Microsoft Office Excel File Rebuilding Code Execution Vulnerability (12.07.2006)
		MICROSOFT, Microsoft Security Bulletin MS06-037 Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (917285) (11.07.2006)
		nanika, Excel 0day : Excel 2000/XP/2003 Style 0day POC (03.07.2006)
		CERT, US-CERT Technical Cyber Security Alert TA06-167A -- Microsoft Excel Vulnerability (17.06.2006)
		MIKEREAVEY, Reports of a new vulnerability in Microsoft Excel (16.06.2006)

Files:		excel unicode overflow poc
		Excel 2000/XP/2003 Style 0day POC
		"Microsoft Office Excel 2003" Hlink Stack/SEH Overflow Exploit
		0-day Microsoft WORD Hlink Local Buffer Overflow Exploit
		Microsoft Excel Remote Code Execution Proof Of Concept
		Microsoft Security Bulletin MS06-037 Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (917285)
		Microsoft Security Bulletin MS06-050 Vulnerabilities in Microsoft Windows Hyperlink Object Library Could Allow Remote Code Execution (920670)
Discuss:		Read or add your comments to this news (0 comments)