Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

How to Compromise the Enterprise Endpoint

projectzero.google | blog | #rce | #vulnerability-disclosure | #enterprise-security | #project-zero | #wormable

Summary

Project Zero publishes details of multiple critical vulnerabilities, including several wormable remote code execution flaws affecting enterprise endpoints.
Published
Collected

original ↗

Related coverage

blog · projectzero.google
Taming the wild copy: Parallel Thread Corruption
A Google Project Zero post on a 'wild copy' parallel thread memory corruption bug and its exploitation.
blog · projectzero.google
Feedback and data-driven updates to Google’s disclosure policy
A Google Project Zero announcement on feedback and data-driven updates to Google's vulnerability disclosure policy.
blog · projectzero.google
Project Zero Patch Tuesday roundup, November 2014
A Google Project Zero roundup of the November 2014 Patch Tuesday advisories covering bugs reported by the team.
blog · projectzero.google
Mac OS X and iPhone sandbox escapes
A Google Project Zero publication of details on Mac OS X and iPhone sandbox escape bugs after Apple shipped fixes.
research · projectzero.google
Finding and exploiting ntpd vulnerabilities
A Google Project Zero guest post telling how one of the researchers found and exploited vulnerabilities in the ntpd network time server.
blog · projectzero.google
Remote iPhone Exploitation Part 2: Bringing Light into the Darkness -- a Remote ASLR Bypass
The initial primitive gained from the vulnerability is an absolute address dereference in which the read value is afterwards used as an ObjC object. As such, some knowledge of the target address space is required in order to exploit this vulnerability for remote code execution. This blog post describes a way to defeat ASLR remotely without any additional information disclosure vulnerabilities.
back