Core Impact Security and Penetration Testing Updates

Core Impact Threat Intelligence Exploits, Security and Penetration Testing Updates

We provide real-time updates including new penetration testing exploits and tests for additional platforms as they become available. We advise you of any new modules by email, after which you can download them directly from within Core Impact. All product updates are free during the license period. You're always on the cutting edge of vulnerability and threat intelligence because Core Impact keeps you there.

Fill out the form to sign up for email updates

Use the controls below to navigate Core Impact exploits and other modules.

Title Description Vulnerabilty Category Platform
AIX Libodm ODMPATH exploit This module exploits a vulnerability in the processing of the ODMPATH environment variable within the odm_searchpath() function. This function reads the ODMPATH variable from the user provided environment, and then copies it into a fixed sized stack buffer without properly validating its length. This results in a stack-based buffer overflow, and allows the saved return address to be overwritten allowing the execution of arbitrary code with root privileges. CVE-2007-3680 Exploits/Local AIX
VMware Vielib.DLL ActiveX Code Execution Exploit This module exploits a vulnerability in the vielib.dll of the VMWare application. The module will run a malicious website in the CORE IMPACT console and wait for a user to connect and trigger the exploit. CVE-2007-4155 Exploits/Client Side Windows
Adobe Reader and Acrobat PDF subroutine pointer exploit update 2 This package updates the Adobe Reader and Acrobat PDF subroutine pointer exploit module. CVE-2006-5857 Exploits/Client Side Windows
MSRPC MSMQ Buffer Overflow exploit update This package updates the MSRPC MSMQ Buffer Overflow exploit module. CVE-2005-0059 Exploits/Remote Windows
IE TLIApplication Exploit This module runs a web server waiting for vulnerable clients (Internet Explorer) to connect to it. When the client connects, it will try to install an agent by instancing TLBINF32.DLL (sometimes installed as VSTLBINF.DLL) with a malicious DLL (IMPActiveX.ocx) as parameter. IMPActiveX.ocx has a helpstringdll property pointing to itself, and implements DLLGetDocumentation to install an agent. CVE-2007-2216 Exploits/Client Side Windows
WinVNC Client exploit update This package updates the WinVNC Client exploit. CVE-2001-0167 Exploits/Client Side Windows
Xpdf-libpoppler StreamPredictor Exploit This module exploits a integer overflow vulnerability in the xpdf and libpoppler software included in most linux distributions. The vulnerability is caused by a integer overflow in the predictor calculation, which causes a buffer overflow in the stack of the StreamPredictor::getNextLine() function. The exploit is triggered when an unsuspecting user opens a specially crafted file distributed via an email. CVE-2007-3387 Exploits/Client Side Linux
Novell Messenger Server exploit update This package updates the Novell Messenger Server exploit. CVE-2006-0992 Exploits/Remote Windows
Surgemail Search Exploit This module exploits a stack-based buffer overflow in the Surgemail Server 3.x and deploys an agent when successful. The exploit triggers a buffer-overflow vulnerability due to insufficient bounds checking of user supplied input allowing remote attackers to execute arbitrary code on the remote machine. CVE-2007-4377 Exploits/Remote Windows
Ipswitch IMail login exploit update This package updates the Ipswitch IMail login exploit. CVE-2005-1255 Exploits/Remote Windows
Microsoft Agent MS07-051 Exploit This module exploits a vulnerability caused due to a boundary error in the Microsoft Agent ActiveX control (agentdpv.dll) when handling specially crafted URLs passed as argument to a certain unspecified method. This module runs a malicious web site on the CORE IMPACT Console and waits for an unsuspecting user to trigger the exploit by connecting to the web site. CVE-2007-3040 Exploits/Client Side Windows
OpenOffice RTF Prtdata tag Exploit This module exploits a heap-based buffer overflow vulnerability in the OpenOffice software included in most linux distributions. The vulnerability is caused by the prtdata tag with a length parameter inconsistency, which causes vtable entries to be overwritten. The exploit is triggered when an unsuspecting user opens a specially crafted file distributed via an email. CVE-2007-0245 Exploits/Client Side Linux
Firebird SQL Remote Buffer Overflow Exploit This module exploits a buffer overflow vulnerability in the database service (fbserver.exe) of the FireBird SQL application. The exploit triggers a stack-based buffer overflow by sending a specially crafted "create" request to port 3050/TCP of the vulnerable system and installs an agent if successful. CVE-2007-3566 Exploits/Remote Windows
WinPcap NPF.SYS IOCTL Handler Privilege Escalation Exploit Windows 2003 Support This module exploits a vulnerability in WinPcap. The IOCTL 9031 (BIOCGSTATS) handler in the NPF.SYS device driver in WinPcap before 4.0.1 allows local users to overwrite memory and execute arbitrary code via malformed Interrupt Request Packet (Irp) parameters. This update adds support for Windows 2003. CVE-2007-3681 Exploits/Local Windows
SIDVault LDAP Server Remote Buffer Overflow Exploit This module exploits a buffer overflow vulnerability in the LDAP service (sidvault.exe) of the SIDVault LDAP application. The exploit triggers a stack-based buffer overflow by sending a specially crafted packet to port 389/TCP of the vulnerable system and installs an agent if successful. CVE-2007-4566 Exploits/Remote Windows
Sun Java Web Start JNLP Stack Buffer Overflow Exploit This module exploits a stack-based buffer overflow vulnerability in the javaws.exe program and deploys an agent when successful. The exploit triggers a vulnerability in the Java Runtime Environment allowing an attacker to execute arbitrary code on the remote machine. CVE-2007-3655 Exploits/Remote Windows
RealPlayer SMIL wallclock Buffer Overflow Exploit This module exploits a vulnerability caused due to a boundary error in the wallclock functionality in SmilTimeValue::parseWallClockValue() when handling time formats. This module runs a malicious web site on the CORE IMPACT Console and waits for an unsuspecting user to trigger the exploit by connecting to the web site. CVE-2007-3410 Exploits/Client Side Windows
WinPcap NPF.SYS IOCTL Handler Privilege Escalation Exploit This module exploits a vulnerability in WinPcap. The IOCTL 9031 (BIOCGSTATS) handler in the NPF.SYS device driver in WinPcap before 4.0.1 allows local users to overwrite memory and execute arbitrary code via malformed Interrupt Request Packet (Irp) parameters. CVE-2007-3681 Exploits/Local Windows
Symantec SYMTDI.SYS IOCTL Handler Privilege Escalation Exploit This module exploits a vulnerability in Symantec products when the 0x83022323 function is invoked with a specially crafted parameter. The IOCTL 0x83022323 handler in the SYMTDI.SYS device driver in Symantec products allows local users to overwrite memory and execute arbitrary code via malformed Interrupt Request Packet (Irp) parameters to obtain system privileges. CVE-2007-3673 Exploits/Local Windows
VLC Media Player Format String exploit This module runs a web server waiting for vulnerable clients to connect to it. When the client connects, it will try to install an agent by exploiting a vulnerability in VLC 0.86, which allows user-assisted remote attackers to execute code via a crafted OGG file that triggers format string and overwrites a subroutine pointer during rendering. CVE-2007-3316 Exploits/Client Side Windows, Linux, Mac OS X
Ipswitch IMail Search On Exploit This module exploits a stack-based buffer overflow in the IMAP server in IMail 2006.1 in Ipswitch Collaboration Suite (ICS). CVE-2007-2795 Exploits/Remote Windows
RSH Daemon for Windows Remote Buffer Overflow Exploit This module exploits a stack-based buffer overflow vulnerability in the Windows RSH application (rshd.exe). The module sends a specially crafted packet to port 514/tcp and installs an agent if successful. CVE-2007-4005 Exploits/Remote Windows
Microsoft Internet Explorer Multiple Browser URI Handler Command Injection Exploit This module exploits an argument injection vulnerability in Mozilla Firefox, when running on systems with Microsoft Internet Explorer 7 installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a FirefoxURL or FirefoxHTML URI, which are inserted into the command line that is created when invoking firefox.exe. CVE-2007-3670 Exploits/Client Side Windows
Microsoft Visio 2002 MS07-030 exploit This module exploits a pointer overwrite vulnerability in Microsoft Visio 2002 to install an agent. CVE-2007-0936 Exploits/Client Side Windows
Borland InterBase Remote Buffer Overflow Exploit This module exploits a buffer overflow vulnerability in the database service (ibserver.exe) of the Borland InterBase application. The exploit triggers a stack-based buffer overflow by sending a specially crafted "create" request to port 3050/TCP of the vulnerable system and installs an agent if successful. CVE-2007-3566 Exploits/Remote Windows
IncrediMail ActiveX Exploit Stack-based buffer overflow in the DoWebMenuAction function in the IncrediMail IMMenuShellExt ActiveX control (ImShExt.dll) allows remote attackers to execute arbitrary code via unspecified vectors. CVE-2007-1683 Exploits/Client Side Windows
Microsoft Publisher MS07-037 exploit PUBCONV.DLL in Microsoft Office Publisher 2007 does not properly clear memory when transferring data from disk to memory, which allows user-assisted remote attackers to execute arbitrary code via a malformed .pub page via a certain negative value, which bypasses a sanitization procedure that initializes critical pointers to NULL, aka the "Publisher Invalid Memory Reference Vulnerability". CVE-2007-1754 Exploits/Client Side Windows
Versalsoft HTTP File Uploader Buffer Overflow Exploit This module exploits a vulnerability in the UFileUploaderD.dll control included in the HTTP File Upload ActiveX Control. The exploit is triggered when the AddFile() method processes a long string argument resulting in a stack-based buffer overflow. This module runs a malicious web site on the CORE IMPACT Console and waits for an unsuspecting user to trigger the exploit by connecting to the web site. CVE-2007-2563 Exploits/Client Side Windows
SAP DB WebTools Buffer Overflow Exploit This module exploits a stack-based buffer overflow vulnerability in the waHTTP.exe (SAP DB Web Server) component included with the SAP DB. The exploit is triggered by sending an unauthenticated, specially crafted HTTP request to the default port 9999/TCP. CVE-2007-3614 Exploits/Remote Windows
Zenturi ProgramChecker ActiveX Exploit This module exploits a vulnerability in the sasatl.dll control included in the Zenturi ProgramChecker ActiveX application. The exploit is triggered when the DebugMsgLog() method processes a long string argument resulting in a stack-based buffer overflow. This module runs a malicious web site on the CORE IMPACT Console and waits for an unsuspecting user to trigger the exploit by connecting to the web site. CVE-2007-2987 Exploits/Client Side Windows