Core Impact Pro Exploits and Security Updates

When you buy Core Impact Pro, we provide real-time updates including new penetration testing exploits and tests for additional platforms as they become available. We advise you of any new modules by email, after which you can download them directly from within Core Impact Pro. All product updates are free during the license period. You're always on the cutting edge of vulnerability and threat intelligence because Core Impact Pro keeps you there.

Use the controls below to navigate Core Impact exploits and other modules.

Released Datesort ascending Title Description Vulnerabilty Category Platform
09.04.2008 CA BrightStor ARCserve Backup Message Service Exploit CA BrightStor ARCserve Backup is prone to a buffer overflow vulnerability on the RPC interface that could permit the execution of arbitrary remote code. A remote attacker can exploit this vulnerability to execute arbitrary code and completely compromise the computer. CVE-2006-5143 Exploits/Remote Windows
09.03.2008 VMware VMCI Arbitrary Code Execution Vulnerability Exploit Using the VMWare VMCI Arbitrary Code Execution vulnerability it is possible run code in the host machine. This module sends a malformed message through hardware port to host exploiting the vmware-vmx.exe process and installing an agent. CVE-2008-2099 Exploits/Local Windows
09.03.2008 IrfanView Formats Plugin IFF Buffer Overflow Exploit The vulnerability is caused due to a boundary error within the Formats plug-in (Formats.dll) when handling IFF files. This can be exploited to cause a stack-based buffer overflow via a specially crafted IFF file. CVE-2007-2363 Exploits/Client Side
09.02.2008 CA BrightStor ARCserve Backup LGServer Service Exploit This module exploits a buffer overflow vulnerability in the LGServer Service (LGServer.exe) component of CA BrightStor ARCserve Backup for Laptops and Desktops and installs an agent if successful. This vulnerability can be exploited remotely by sending a specially crafted packet to port TCP/1900. CVE-2008-1328 Exploits/Remote Windows
08.28.2008 Anzio Web Print Object Buffer Overflow Exploit This module exploits a vulnerability in the PWButtonXControl1.ocx control included in the Anzio Web Print Object application. The exploit is triggered when the mainuri property processes a long string argument resulting in a stack-based buffer overflow. This module runs a malicious web site on the CORE IMPACT Console and waits for an unsuspecting user to trigger the exploit by connecting to the web site. CVE-2008-3480 Exploits/Client Side Windows
08.21.2008 Microsoft Office Excel Exploit (MS08-043) This module exploits an error during processing of FORMAT records when loading Excel files into memory that can be exploited to corrupt memory via a specially crafted XLS file containing an out-of-bounds array index. CVE-2008-3005 Exploits/Client Side Windows
08.20.2008 Netscape Portable Runtime Environment Log File Overwrite Exploit Update This package updates the Netscape Portable Runtime Environment Log File Overwrite Exploit CVE-2006-4842 Exploits/Local Solaris
08.20.2008 IBM Lotus Domino Accept-Language Remote Buffer Overflow Exploit This module exploits a buffer overflow vulnerability in the Lotus Domino HTTP server (nHTTP.exe) by sending a specially crafted GET request. CVE-2008-2240 Exploits/Remote Windows
08.14.2008 Microsoft Office PowerPoint Viewer Exploit (MS08-051) This module exploits a memory allocation error in Microsoft PowerPoint Viewer 2003 that allows remote attackers to execute arbitrary code via a PowerPoint file with a malformed picture index that triggers memory corruption. CVE-2008-0120 Exploits/Client Side Windows
07.30.2008 Microsoft IGMPv3 Exploit (MS08-001) This exploit installs an agent using an overflow vulnerability located in Microsoft Windows tcpip.sys CVE-2007-0069 Exploits/Remote Windows
07.29.2008 Now SMS MMS Gateway Web Authorization Buffer Overflow Exploit A vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of software utilizing the web interface of Now SMS MMS Gateway. CVE-2008-0871 Exploits/Remote Windows
07.28.2008 XnView TAAC Buffer Overflow Exploit A security vulnerability with the way XnView processes TAAC files may allow a remote unprivileged user who provides a TAAC document that is opened or previewed by a local user to execute arbitrary commands on the system with the privileges of the user running XnView. This can be exploited to cause a buffer overflow when a specially crafted file is opened or previewed in XnView. CVE-2008-2427 Exploits/Client Side Windows
07.23.2008 Windows I2O Utility Filter Driver Privilege Escalation Exploit This module exploits a vulnerability in Windows I2O Utility Filter Driver when the 0x222F80 IOCTL in i2omgmt.sys is invoked with a specially crafted parameter. The IOCTL 0x222F80 handler in the i2omgmt.sys device driver in Windows I2O Utility Filter Driver allows local users to overwrite memory and execute arbitrary code via malformed Interrupt Request Packet (IRP) parameters. CVE-2008-0322 Exploits/Local Windows
07.20.2008 Mac OS X pppd Plugin Loading Privilege Escalation Exploit The PPP daemon (pppd) in Apple Mac OS X 10.4.8 checks ownership of the stdin file descriptor to determine if the invoker has sufficient privileges, which allows local users to load arbitrary plugins and gain root privileges by bypassing this check. CVE-2007-0752 Exploits/Local Mac OS X
07.17.2008 Download Accelerator Plus M3U Buffer Overflow Exploit This module exploits a vulnerability in Download Accelerator Plus when importing a M3U file (MP3 Playlist) and verify option is used, may allow a remote unprivileged user who provides a crafted M3U document that is opened by a local user to execute arbitrary commands on the system with the privileges of the user running Download Accelerator Plus. This can be exploited to cause a stack based buffer overflow when a specially crafted file is imported and the verify button is used in DAP. CVE-2008-3182 Exploits/Client Side Windows
07.14.2008 Adobe Photoshop BMP Exploit This module exploits a vulnerability in Adobe Photoshop products when a malformed .BMP file is parsed. CVE-2008-1765 Exploits/Client Side Windows
07.13.2008 Sun ONE Web Server-NSS challenge overflow exploit update A heap overflow in Netscape Network Security Services (NSS) library used by the Sun ONE Web Server is exploited remotely gaining control of the execution flow on the target host. This package updates the exploit. CVE-2004-0826 Exploits/Remote Solaris
07.13.2008 Adobe PDF JavaScript Buffer Overflow Exploit Update 2 This module exploits a vulnerability in Adobe Reader and Adobe Acrobat Professional .PDF files. The vulnerability is caused due to boundary error in collectEmailInfo() method in EScript.api. This can be exploited to cause a stack-based buffer overflow when a specially crafted PDF file is opened. This update adds support for Windows XP SP3 and Windows Vista SP1. CVE-2007-5659 Exploits/Client Side Windows
07.13.2008 Microsoft Office Word Memory Corruption Exploit This module exploits a vulnerability in Microsoft Office Word(.DOC files). The vulnerability is caused due to a boundary error in winword.exe within the processing of DOC files. This can be exploited to cause a memory corruption when a specially crafted file is opened. CVE-2008-2244 Exploits/Client Side
07.10.2008 IBM Lotus Sametime StMux Remote Buffer Overflow Exploit This module exploits a buffer overflow vulnerability in the Community Services Multiplexer (StMux.exe) by requesting a specially crafted URL. CVE-2008-2499 Exploits/Remote Windows
07.09.2008 Adobe PDF JavaScript Buffer Overflow Exploit Update This module exploits a vulnerability in Adobe Reader and Adobe Acrobat Professional .PDF files. The vulnerability is caused due to boundary error in collectEmailInfo() method in EScript.api. This can be exploited to cause a stack-based buffer overflow when a specially crafted PDF file is opened. This update adds support for Adobe Reader 7.0.9. CVE-2007-5659 Exploits/Client Side Windows
07.09.2008 Microsoft WINS Exploit (MS08-034) Update A memory corruption vulnerability in the ChkNtfSock function of wins.exe allows remote code execution. This update adds support for Windows 2000 Server SP4, Windows 2003 Server SP1 and SP2. CVE-2008-1451 Exploits/Remote Windows
07.07.2008 Microsoft Access Snapshot Viewer ActiveX Exploit This module exploits a arbitrary file download vulnerability in the Snapshot Viewer ActiveX Control included in Microsoft Access. CVE-2008-2463 Exploits/Client Side Windows
07.07.2008 Adobe Flash Player SWF Buffer Overflow Exploit Update This module exploits a vulnerability in Adobe Flash Player triggered when processing a specially crafted SWF file. This update adds support for Windows Vista. CVE-2007-0071 Exploits/Client Side Windows
07.06.2008 Microsoft GDI EMF Exploit (MS08-021) Update This module exploits a stack-based buffer overflow in GDI in Microsoft Windows, allowing remote attackers to execute arbitrary code via a specially crafted EMF image file. This update adds support for Windows XP Professional SP0 and Windows XP Professional SP1 CVE-2008-1087 Exploits/Client Side Windows
07.03.2008 Microsoft JET MDB Exploit (MS08-028) Update This update improves the reliability of the exploit. CVE-2007-6026 Exploits/Client Side Windows
07.02.2008 Novell iPrint Client ActiveX Buffer Overflow Exploit This module exploits a stack-based buffer overflow in the ienipp.ocx ActiveX Control included in Novell iPrint 4.34. CVE-2008-2908 Exploits/Client Side Windows
06.26.2008 OpenOffice OLE DocumentSummaryInformation Heap Overflow Exploit A security vulnerability with the way OpenOffice.org processes OLE files may allow a remote unprivileged user who provides an OpenOffice.org document that is opened by a local user to execute arbitrary commands on the system with the privileges of the user running OpenOffice.org. This can be exploited to cause a heap-based buffer overflow when a specially crafted file is opened. CVE-2008-0320 Exploits/Client Side Windows
06.26.2008 Samba nttrans Exploit Update This update improves reliability on Solaris. CVE-2003-0085 Exploits/Remote Solaris, Linux
06.20.2008 Microsoft WINS Exploit (MS08-034) A memory corruption vulnerability in the ChkNtfSock function of wins.exe allows remote code execution. The WINS service listens on more than one UDP port (it listens on 42/udp and also on a dynamic UDP port). This attack targets the dynamic udp port, thus it requires the identification of such dynamic port by the user. This can be accomplished by running a port scanner module such as the 'Port Scanner - UDP' module. CVE-2008-1451 Exploits/Remote

Pages