Thought leaders in information security, we conduct radical, world-changing research and deliver renowned presentations around the world.
Disclosures | ADVISORIES | July 1, 2012

Wonderware Archestra ConfigurationAccessComponent ActiveX stack overflow

The Wonderware Archestra ConfigurationAccessComponent ActiveX control that is marked “safe for scripting” is suffering from a stack-overflow vulnerability. The UnsubscribeData method of the IConfigurationAccess interface is using wcscpy() to copy its first parameter into a static-sized local buffer. Attackers can exploit this vulnerability to overwrite arbitrary stack data and gain code execution.

Launch PDF
Richard van Eeden
Disclosures | ADVISORIES |

XBMC File Traversal Vulnerability

XBMC is an award-winning, free, and open source (GPL) software media player and entertainment hub for digital media. XBMC is available for Linux, OSX, and Windows. Created in 2003 by a group of like-minded programmers, XBMC is a nonprofit project run and was developed by volunteers located around the world. More than 50 software developers have contributed to XBMC, and 100-plus translators have worked to expand its reach, making it available in more than 30 languages.

Launch PDF
Lucas Lundgren
Disclosures | ADVISORIES |

Multiple Vulnerabilities in Fwknop

Fwknop stands for the “FireWall KNock OPerator” and implements an authorization scheme called Single Packet Authorization (SPA). This method of authorization is based on a default-drop packet filter and libpcap. A server might appear to have no open ports available, but it could still grant access to certain services if authorized fwknop packets are received. Companies commonly use this service on exposed systems and need to diminish the attack surface of this service. wknop contains several vulnerabilities. The most critical of these might allow remote, authenticated attackers to leverage flaws…

Launch PDF
Fernando Arnaboldi
Disclosures | ADVISORIES |

IBM Informix XML functions overflows

Informix is one of the world’s most widely used database servers, with users ranging from the world’s largest corporations to startups. Informix incorporates design concepts that are significantly different from traditional relational platforms. This results in extremely high levels of performance and availability, distinctive capabilities in data replication and scalability, and minimal administrative overhead. Informix contains two vulnerabilities affecting several versions. Attackers can exploit these vulnerabilities to execute arbitrary code or cause denial-of-service conditions.

Launch PDF
Ariel Sanchez
Disclosures | ADVISORIES |

Windows Kernel Library Filename Parsing Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Windows. User interaction is required to exploit this vulnerability in that the target must open or browse to a file or subfolder with a specially crafted name on a network SMB share, UNC share, or WebDAV web folder.

Launch PDF
Lucas Apa
Disclosures | ADVISORIES | May 4, 2010

Authentication Bypass In Tranax Remote Management Software

Reported: 04.05.10. The Tranax Remote Management Software (RMS) allows for the administration of common Automated Teller Machine (ATM) tasks from a remote location. To successfully authenticate to a remote ATM, both the serial number and the RMS password are required. An attacker can leverage an implementation flaw that occurs when verifying credentials to craft a request that bypasses all authentication measures. The attacker could then perform remote management tasks with invalid credentials. The RMS interface is enabled, by default, on a typical ATM installation.

Launch PDF
Barnaby Jack
Disclosures | ADVISORIES | March 18, 2010

SQL Injection and Cross-site Scripting at

Discovered: 03.18.10. Reported: 03.23.10. The formID parameter at is vulnerable to SQL injection. The searchTerms parameter at is vulnerable to cross-site scripting attacks. Exploiting these vulnerabilities would likely expose sensitive data and may result in compromise of the affected systems.

Launch PDF
Mike Davis Rich Lundeen & Sean Malone
Disclosures | ADVISORIES | March 1, 2010

Multiple Vulnerabilities in Accoria Web Server

Discovered/Reported to Accoria: December 2008. Date Reported to US-Cert: March 1, 2010. The Accoria Web Server 1.4.7 for x86 Solaris exhibits multiple vulnerabilities, including cross-site scripting, directory traversal, and format string errors.

Launch PDF
Ilja van Sprundel
Disclosures | ADVISORIES | January 5, 2010

Mach Exception Handling Privilege Escalation

Discovered: 01.05.10. Mach exception handling suffers from a vulnerability that allows an attacker to gain access to the memory of a suid process (set user identifier). Due to a vulnerability that is similar to CVE-2006-4392 (found by Dino Dai Zovi of Matasano Security), it is possible for a suid process to inherit the Mach exception ports of the parent.

Launch PDF
Richard van Eeden
Disclosures | ADVISORIES | October 13, 2009

Microsoft Windows CryptoAPI X.509 Spoofing Vulnerability

Release Date: 10.13.09. VUPEN ID: VUPEN/ADV-2009-2891. CVE ID: CVE-2009-2510, CVE-2009-2511. Researchers identified two vulnerabilities in Microsoft Windows relating to the use of X.509 certificates. Attackers could exploit these to bypass security restrictions.

Launch PDF
Dan Kaminsky Ian Wright & Jean-Luc Giraud

Arm IDA and Cross Check: Reversing the 787’s Core Network

IOActive has documented detailed attack paths and component vulnerabilities to describe the first plausible, detailed public attack paths to effectively reach the avionics network on a 787, commercial airplane from either non-critical domains, such as Passenger Information and Entertainment Services, or even external networks.