[FD] OpenBSD "sys_execve()" Executable Header Parsing Denial of Service Vulnerability

2015-06-13 Thread Bruno Luiz
Impact A non-privileged use could cause a local Denial-of-Service (DoS) condition by triggering a kernel panic through a malformed ELF executable. The kernel panic is reached at the UVM (virtual memory) subsystem. There are different if-else validations inside uvm_map(),and uvm_map_vmspace_upda

[FD] Apache vulnerability program faulting module ntdll.dll

2015-06-11 Thread Bruno Luiz
g/packages.html No workaround is available. References: === CVE-2015-0251 (Subversion) Reported by: Bruno Luiz, d4t Patches: Patch against 1.7.19: [[[ Index: subversion/mod_dav_svn/deadprops.c =

[FD] This POODLE Bites: Exploiting The SSL 3.0 Fallback

2015-06-10 Thread Bruno Luiz
Introduction SSL 3.0 [RFC6101] is an obsolete and insecure protocol. While for most practical purposes it has been replaced by its successors TLS 1.0 [RFC2246], TLS 1.1 [RFC4346], and TLS 1.2 [RFC5246], many TLS implementations remain backwards­compatible with SSL 3.0 to interoperate with legacy