The call for papers for the yStS (you Sh0t the Sheriff) conference is now
open!

The 4th edition will be, once again, held in Sao Paulo, Brazil, on May
17th, 2010.


INTRODUCTION

you sh0t the Sheriff is a very unique event dedicated to bringing cutting
edge topics to the top-notch Information Security Community in Brazil.

yStS mixes the highest quality presentations and speakers from all over the
globe, covering diverse topics in information security.

Our goal is to help attendees understand the current state of the
information security world by mixing professionals and topics from
different Infosec segments of the market.

For the most part, yStS is an invite-only event. So, submitting a talk is
certainly a good hack to try to be there, especially if you're local.

Due to the success of previous years' editions, yes, we're keeping the same
format:
* Kicked-back and cool environment
* ... Read more »

** FreeBSD local r00t 0day
Discovered & Exploited by Nikolaos Rangos also known as Kingcope.
Nov 2009 "BiG TiME"

"Go fetch your FreeBSD r00tkitz" // http://www.youtube.com/watch?v=dDnhthI27Fg

There is an unbelievable simple local r00t bug in recent FreeBSD versions.
I audited FreeBSD for local r00t bugs a long time *sigh*. Now it pays out.

The bug resides in the Run-Time Link-Editor (rtld).
Normally rtld does not allow dangerous environment variables like LD_PRELOAD
to be set when executing setugid binaries like "ping" or "su".
With a rather simple technique rtld can be tricked into
accepting LD variables even on setugid binaries.
See the attached exploit for details.

Example exploiting session
******************************

Views: 13350 | Added by: b1zz4rd | Date: 03 December 2009 | Comments (0)

This is the first batch of vulnerabilities found by the SimpleAudit team from elhacker.net
http://labs.elhacker.net/simpleaudit

Our goal is to evaluate the security of SMF 2.0 before using it on our own server, and we have found several security vulnerabilities.

The vulnerabilities that also apply to SMF 1.1.10 were fixed by the SMF team today, on SMF 1.1.11 visit simplemachines.org for details.

You can review the list of the published vulnerabilities in:
http://code.google.com/p/smf2-review/issues/list



 CSRF, RCE   PHP Remote Code Execution SMF2 www.kernel32
 CSRF   CSRF theme change SMF2, SMF1 www.kernel32
 CSRF   Subforum Category ... Read more »

Problem Description
===================

A remote command execution vulnerability exists in the dotDefender
(3.8-5) Site Management.


dotDefender [1] is a web appliaction firewall (WAF) which 'prevents
hackers from attacking your
website.'


Technical Details
=================

The Site Management application of dotDefender is reachable as a web
application (https:site/dotDefender/)
on the webserver. After passing the Basic Auth login you can
create/delete applications.
The mentioned vulnerability is in the 'deletesite' implementation and
the 'deletesitename' variable.
Insufficient input validation allows an attacker to inject arbitrary commands.


Delete Site
===========

A normal delete transaction looks as follow:

 POST /dotDefender/index.cgi HTTP/1.1
 Host: 172.16.159.132
 User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; ... Read more »

Hi!
I've just released the working exploit for CTXSYS.DRVXTABC.CREATE_TABLES
injection on Oracle DB 9i/10g (CVE-2009-1991)

You can find the code on my site, http://rawlab.mindcreations.com

In particular,

Classic SQL injection:
http://rawlab.mindcreations.com/codes/exploit/oracle/ctxsys-drvxtabc-create_tables.sql

Cursor injection:
http://rawlab.mindcreations.com/codes/exploit/oracle/ctxsys-drvxtabc-create_tablesV2.sql

Into the site you can find exploits for COMPRESSWORKSPACETREE,
REMOVEWORKSPACE and MERGEWORKSPACE injections (SYS.LT) too.

Reg ... Read more »

##############################

#2009-017 PHP multiple issues

Description:

PHP, an open source scripting language, suffers from several bugs that may
pose a security risk.

The reported issues have been discovered in several API functions, issues
include buffer overflows, near null reads/writes, arbitrary memory read
and an off-by-one issue. Some of the issues have been previously reported
in older versions of PHP but they either have not been fixed or they were
re-introduced in a later time. The issues have been discovered in both
core and, in some cases, PECL functions/classes/methods.

The following methods have been fixed.

   ibase_pconnect
   ibase_connect
   com_print_typeinfo
   popen
   mssql_connect
   mssql_pconnect
   SplFileObject
   DOMImplementation->

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------

================= IUT-CERT =================

Title: Eshopbuilde CMS SQL Injection Vulnerability

Vendor: www.eshopbuilder.ir

Dork: Design by Satcom Co
Type: Input.Validation.Vulnerability (SQL Injection)

Fix: N/A

================== nsec.ir =================

Description:

------------------

Eshopbuilder is a E-shop CMS written in persian language. The Eshopbuilder product is vulnerable to SQL injection.


Vulnerability Variant:

------------------
Injection "/home-f.asp","/opinions-f.

#!/usr/bin/env python
##############################

Dear List,

I  updated  the  whitepaper  with  a  lot  of  new  information,  some
leveraging  the  vulnerability  in  other  ways  that certainly increase
the effectiveness and impact of this vulnerability.

A brief warning to those that think they are safe because they
don't   accept   client-side   renegotiations   (server  + openssl). I
came across major websites where the SSL loadbalancer in front of the HTTPS
servers were vulnerable. Although the servers were patched it still was
possible   to  perform  the  attacks  (The  loadbalancer  merged  both
sessions and handed them as one to the webserver)

Updates :
--------
- Added a simple s_client testcase
- Analysis of FTPS (vendors are encouraged to assess)
- HTTPS : Injecting arbritary _responses_ into the stream
- HT ... Read more »