Leaderboard

INCA 600 scoase azinoapte + azi http://www.ps-axl.net/paste/f/6PrVuk2amNNoOwlPnzome/dSGN9tdN9IHL@HWQx3rlA=.ps Parola : gWO0wx7e0ehACKOOzSzdfW3+zKPbB/GG HINT : 722

Cine ar fi crezut Intel...sau hardware in general...sistemele pe 32 biti sunt momentan sigure...insa cele pe 64 sunt in general vulnerabile. SYSRET 64-bit operating system privilege escalation vulnerability on Intel CPU hardware The U.S. Computer Emergency Readiness Team (US-CERT) has disclosed a flaw in Intel chips that could allow hackers to gain control of Windows and other operating systems. The flaw has already been exploited on 64-bit versions of Microsoft Windows 7, FreeBSD, NetBSD and there’s a chance Apple’s OS X may also be vulnerable. The flaw was disclosed the vulnerability in a security advisory released this week. Attackers could execute malicious code via kernel privileges or launch a local privilege escalation attack. VMware's virtualization software is not affected, and neither are AMD's processors, as they do not use the SYSRET instruction whose incorrect handling causes the flaw or handle it differently.Many of the affected vendors have already pushed out an update that defuses the flaw. Reff: Intel CPU Vulnerability can provide control of your system to attacker | The Hacker News Overview Some 64-bit operating systems and virtualization software running on Intel CPU hardware are vulnerable to a local privilege escalation attack. The vulnerability may be exploited for local privilege escalation or a guest-to-host virtual machine escape. Intel claims that this vulnerability is a software implementation issue, as their processors are functioning as per their documented specifications. However, software that fails to take the Intel-specific SYSRET behavior into account may be vulnerable. Description A ring3 Ring (computer security) - Wikipedia, the free encyclopedia attacker may be able to specifically craft a stack frame to be executed by ring0 (kernel) after a general protection exception (#GP). The fault will be handled before the stack switch, which means the exception handler will be run at ring0 with an attacker's chosen RSP causing a privilege escalation. Details from Xen CVE-2012-0217 / XSA-7 - 64-bit PV guest privilege escalation vulnerability [Xen-announce] Xen Security Advisory 7 (CVE-2012-0217) - PV privilege escalation A vulnerability which can allow a 64-bit PV guest kernel running on a 64-bit hypervisor to escalate privileges to that of the host by arranging for a system call to return via sysret to a non-canonical RIP. Intel CPUs deliver the resulting exception in an undesirable processor state. Details from FreeBSD FreeBSD-SA-12:04.sysret: Privilege escalation when returning from kernel http://security.freebsd.org/advisories/FreeBSD-SA-12:04.sysret.asc FreeBSD/amd64 runs on CPUs from different vendors. Due to varying behaviour of CPUs in 64 bit mode a sanity check of the kernel may be insufficient when returning from a system call. Successful exploitation of the problem can lead to local kernel privilege escalation, kernel data corruption and/or crash. Details from Microsoft User Mode Scheduler Memory Corruption Vulnerability - MS12-042 - Important Microsoft Security Bulletin MS12-042 - Important : Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (2711167) An elevation of privilege vulnerability exists in the way that the Windows User Mode Scheduler handles system requests. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights. Mitigating Factors for User Mode Scheduler Memory Corruption Vulnerability Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in your situation: An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability. The vulnerability could not be exploited remotely or by anonymous users. This vulnerability only affects Intel x64-based versions of Windows 7 and Windows Server 2008 R2. Systems with AMD or ARM-based CPUs are not affected by this vulnerability. Details from Red Hat RHSA-2012:0720-1 https://rhn.redhat.com/errata/RHSA-2012-0720.html & RHSA-2012:0721-1 https://rhn.redhat.com/errata/RHSA-2012-0721.html : It was found that the Xen hypervisor implementation as shipped with Red Hat Enterprise Linux 5 did not properly restrict the syscall return addresses in the sysret return path to canonical addresses. An unprivileged user in a 64-bit para-virtualized guest, that is running on a 64-bit host that has an Intel CPU, could use this flaw to crash the host or, potentially, escalate their privileges, allowing them to execute arbitrary code at the hypervisor level. (CVE-2012-0217, Important) Details from some affected vendors were not available at the time of publication. Impact A local authenticated attacker may exploit this vulnerability for operating system privilege escalation or for a guest-to-host virtual machine escape. Solution Apply an Update Please review the Vendor Information section of this document for vendor-specific patch and workaround details. Vendor Information: Vendor Status Date Notified Date Updated Citrix Affected - 18 Jun 2012 FreeBSD Project Affected 01 May 2012 12 Jun 2012 Intel Corporation Affected 01 May 2012 13 Jun 2012 Joyent Affected - 14 Jun 2012 Microsoft Corporation Affected 01 May 2012 18 Jun 2012 NetBSD Affected 01 May 2012 08 Jun 2012 Oracle Corporation Affected 01 May 2012 08 Jun 2012 Red Hat, Inc. Affected 01 May 2012 12 Jun 2012 SUSE Linux Affected 02 May 2012 12 Jun 2012 Xen Affected 02 May 2012 12 Jun 2012 AMD Not Affected - 13 Jun 2012 Apple Inc. Not Affected 01 May 2012 08 Jun 2012 VMware Not Affected 01 May 2012 08 Jun 2012 Debian GNU/Linux Unknown 02 May 2012 02 May 2012 Fedora Project Unknown 02 May 2012 02 May 2012 Sursa: US-CERT Vulnerability Note VU#649219 - SYSRET 64-bit operating system privilege escalation vulnerability on Intel CPU hardware

NICT has developed Daedalus, a cyber-attack alert system. Daedalus renders attacks on networks visible in real time. The sphere in the center represents the Internet, and the circles moving around it represent networks under observation. The state of an attack is shown using 3D graphics, and can be viewed from any perspective. Today's cyber-attacks breach boundary defenses from inside and outside organizations, including the spread of malware via USB memory sticks and mail attachments, as well as zero-day exploits. So, using Daedalus together with conventional boundary systems is expected to improve network security within organizations. The technology for this system will be transferred to clwit, which will include it in a commercial alert service called SiteVisor. NICT also provides the system free of charge to educational institutions where nicter sensors can be installed. source: DigInfo TV