RESOURCES

Thought leaders in information security, we conduct radical, world-changing research and deliver renowned presentations around the world.
Disclosures | ADVISORIES | March 18, 2010

SQL Injection and Cross-site Scripting at www.courts.wa.gov

Discovered: 03.18.10. Reported: 03.23.10. The formID parameter at http://www.courts.wa.gov/forms/ is vulnerable to SQL injection. The searchTerms parameter at http://www.courts.wa.gov/search/index.cfm is vulnerable to cross-site scripting attacks. Exploiting these vulnerabilities would likely expose sensitive data and may result in compromise of the affected systems.

Launch PDF
Mike Davis Rich Lundeen & Sean Malone
Disclosures | ADVISORIES | March 1, 2010

Multiple Vulnerabilities in Accoria Web Server

Discovered/Reported to Accoria: December 2008. Date Reported to US-Cert: March 1, 2010. The Accoria Web Server 1.4.7 for x86 Solaris exhibits multiple vulnerabilities, including cross-site scripting, directory traversal, and format string errors.

Launch PDF
Ilja van Sprundel
Disclosures | ADVISORIES | January 5, 2010

Mach Exception Handling Privilege Escalation

Discovered: 01.05.10. Mach exception handling suffers from a vulnerability that allows an attacker to gain access to the memory of a suid process (set user identifier). Due to a vulnerability that is similar to CVE-2006-4392 (found by Dino Dai Zovi of Matasano Security), it is possible for a suid process to inherit the Mach exception ports of the parent.

Launch PDF
Richard van Eeden
Disclosures | ADVISORIES | October 13, 2009

Microsoft Windows CryptoAPI X.509 Spoofing Vulnerability

Release Date: 10.13.09. VUPEN ID: VUPEN/ADV-2009-2891. CVE ID: CVE-2009-2510, CVE-2009-2511. Researchers identified two vulnerabilities in Microsoft Windows relating to the use of X.509 certificates. Attackers could exploit these to bypass security restrictions.

Launch PDF
Dan Kaminsky Ian Wright & Jean-Luc Giraud
Disclosures | ADVISORIES | July 19, 2009

doc.export* Methods Allow Arbitrary File Creation

Discovered: 07.13.09. Several JavaScript methods of the Document Object do not honor the Privileged Context and Safe Path settings. IOActive was able to execute certain privileged JavaScript methods that can be used to create arbitrary files and folders on a targeted file system.

Launch PDF
IOActive
Disclosures | ADVISORIES | June 9, 2009

Recursive Stack Overflow in ClamAV

Reported: 10.30.08. Patched: 12.01.08. Disclosed: 06.09.0. ClamAV’s JPEG parser contains code that recursively checks thumbnails, if they are included. Since the thumbnails can be JPEGs, there is no limit to the amount of recursions that can occur. This can lead to stack overflows.

Launch PDF
Ilja van Sprundel
Disclosures | ADVISORIES | June 8, 2009

Heap Corruption in Tor

Discovered: January 2009. Reported: 01.20.09. Disclosed: 06.08.09. There is a potential heap corruption bug in Tor when escaping data for logging purposes. Only certain deployments are vulnerable, and the bug can be triggered only from certain locales.

Launch PDF
Ilja van Sprundel
Disclosures | ADVISORIES | March 3, 2009

AppleTalk Response Packet Parsing Array Over-indexing Vulnerability

Discovered: 03.03.09. Reported: 03.03.09. Disclosed: 08.05.09. CVE-ID: CVE-2009-2193. The Mac OS X AppleTalk stack contains an array over-indexing vulnerability that, if exploited correctly while AppleTalk is powered on, could lead to a remote system compromise. Even if only partially exploited, it could lead to denial-of-service conditions and cause a kernel panic remotely, effectively shutting down the system.

Launch PDF
Ilja van Sprundel
Disclosures | ADVISORIES | February 4, 2009

Pointer Dereference in OpenSolaris

Reported: 09.29.08. Disclosed: 02.04.09. Patched: 02.05.09. The OpenSolaris kernel exhibits a vulnerability around a userland pointer dereference, and allows both reading from and writing to the kernel.

Launch PDF
Ilja van Sprundel
Disclosures | ADVISORIES | October 31, 2008

QNX ker_msg_sendv System Call Integer Overflow

Discovered: 10.30.08. Reported: 10.30.08. Disclosed: 10.31.08. QNX’s ker_msg_sendv() system call contains an integer overflow that could lead to heap corruption and, if correctly exploited, system compromise. If only partially exploited, this could lead to denial-of-service conditions and kernel panic, effectively shutting down the system.

Launch PDF
Ilja van Sprundel

Arm IDA and Cross Check: Reversing the 787’s Core Network

IOActive has documented detailed attack paths and component vulnerabilities to describe the first plausible, detailed public attack paths to effectively reach the avionics network on a 787, commercial airplane from either non-critical domains, such as Passenger Information and Entertainment Services, or even external networks.

ACCESS THE WHITEPAPER


IOACTIVE CORPORATE OVERVIEW (PDF)