Core Impact Security and Penetration Testing Updates

Core Impact Threat Intelligence Exploits, Security and Penetration Testing Updates

When you buy Core Impact, we provide real-time updates including new penetration testing exploits and tests for additional platforms as they become available. We advise you of any new modules by email, after which you can download them directly from within Core Impact. All product updates are free during the license period. You're always on the cutting edge of vulnerability and threat intelligence because Core Impact keeps you there.

Use the controls below to navigate Core Impact exploits and other modules.

Title Description Vulnerabilty Category Platform
Microsoft Office Excel Malformed Object Exploit (MS09-009) Update This module exploits Microsoft Office 2007 systems via a crafted Excel document that triggers an access attempt on an invalid SST record. This update modifies the CVE number related to the module to correctly reflect the specific vulnerability which is being exploited. CVE-2009-0238 Exploits/Client Side Windows
TFTPServer SP Buffer Overflow Exploit Update This module exploits a buffer overflow vulnerability in the handling of Error Packet for overwrite all the .bss section and some portion of the .idata section. This module add the service specification tag. CVE-2008-2161 Exploits/Remote Windows
Adobe PDF FlateDecode Argument Buffer Overflow Exploit This module exploits a heap based buffer overflow vulnerability in Adobe Reader when handling a specially crafted PDF file. WARNING: This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. CVE-2009-3459 Exploits/Client Side Windows
Microsoft Office Drawing Format Shape Exploit (MS09-062) This module exploits a memory corruption in Microsoft Office Powerpoint when parsing a .PPT document with a specially crafted msofbtOPT record type. This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. CVE-2009-2528 Exploits/Client Side Windows
Cerberus FTP Server Long Command DoS Cerberus FTP Server is prone to a denial-of-service. The vulnerability is caused due to an error in the processing of overly long arguments passed via FTP commands. NOCVE-9999-40396 Denial of Service/Remote Windows
osCommerce Arbitrary File Upload Exploit osCommerce Online Merchant 2.2 RC2a is vulnerable to an Arbitrary File Upload without the need to be authenticated. This leads to arbitrary PHP code execution in the context of the webserver. This module tries to install a RFI agent if the Web Application is vulnerable. It will fail if the webserver is not allowed to write on the document root of the vulnerable web application. NOCVE-9999-40096 Exploits/Remote File Inclusion/Known Vulnerabilities none
EMC Captiva QuickScan KeyHelp ActiveX Exploit This module exploits a vulnerability in the keyhelp.ocx control included in EMC Captiva QuickScan application. The vulnerability is triggered when the JumpURL() method processes a long string argument resulting in a stack-based buffer overflow. NOCVE-9999-40371 Exploits/Client Side Windows
Oracle Secure Backup Remote Command Execution Exploit This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Oracle Secure Backup. User interaction is not required to exploit this vulnerability. The specific flaw exists in the logic used to authenticate a user to the administration server running on port 443. The script login.php does not properly sanitize the 'username' variable before using it in a database query. A specially crafted 'username' allows unauthorized attackers to log in with full administrative capabilities. CVE-2009-1977 Exploits/Remote Code Execution Windows, Solaris
Linux Kernel Sock_Sendpage Local Privilege Escalation Exploit The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures, which allows local users to trigger a NULL pointer dereference and gain privileges by using mmap to map page zero, placing arbitrary code on this page, and then invoking an unavailable operation, as demonstrated by the sendpage operation (sock_sendpage function) on a PF_PPPOX socket CVE-2009-2692 Exploits/Local Linux
eEye Retina WiFi Scanner RWS Buffer Overflow Exploit eEye Retina WiFi Scanner is prone to a buffer-overflow vulnerability when handling .RWS files having an overly long string. CVE-2009-3859 Exploits/Client Side Windows
MS SMB 2.0 Negociate Protocol Request Remote Exploit Update 2 This update uses two different methods to exploit the targets, and it also improves the exploited target stability when repairing the SMB service. This module exploits a vulnerability on srv2.sys via a SMB 2 malformed packet. CVE-2009-3103 Exploits/Remote Windows
IIS FTP LIST Stack Exhaustion DoS Update This exploit forces the IIS process inetinfo.exe to throw an unhandled exception. IIS' behavior depends on the operating system version, its configuration and the system-wide debugger specified in the registry. This update adds more supported platforms to the exploit. CVE-2009-2521 Denial of Service/Remote Windows
VMware Fusion Privilege Escalation Exploit This module exploits a privilege escalation vulnerability on VMware Fusion. WARNING: This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. CVE-2009-3281 Exploits/Local Mac OS X
MS SMB 2.0 Negociate Protocol Request Remote BSOD Exploit Update This update improves the exploit reliability. This module exploits a vulnerability on srv2.sys via a SMB 2 malformed packet. This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. CVE-2009-3103 Exploits/Remote Windows
MS Word Record Parsing Buffer Overflow Exploit (MS09-027) Update Microsoft Word is prone to a buffer-overflow vulnerability. An attacker can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial-of-service conditions. This update adds support for Office 2003 SP0. CVE-2009-0565 Exploits/Client Side Windows
Avast Antivirus ASWMON.SYS Privilege Escalation Exploit This module exploits a vulnerability in Avast Antivirus ASWMON.SYS driver when handling a specially crafted IOCTL request. The vulnerability allows local users to overwrite memory and execute arbitrary code via malformed Interrupt Request Packet (Irp) parameters. CVE-2009-3522 Exploits/Local Windows
Windows Debugging Subsystem Exploit Update There is an authentication vulnerability in the Windows debugging subsystem (smss). This allows any user to obtain a handle with any access of any process running. With this handle an agent is injected in a SYSTEM process. The update fixes an issue using Import * CVE-2002-0367 Exploits/Local Windows
Microsoft Windows SMB 2.0 Negotiate Protocol Request Remote Exploit This module exploits a vulnerability on srv2.sys via a SMB 2 malformed packet. This is an early release module. This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation. CVE-2009-3103 Exploits/Remote Windows
Microsoft Windows SRV.SYS Server Driver DoS (MS06-035) A boundary error in the Server service (SRV.SYS) when handling first-class Mailslot messages can be exploited to corrupt memory by sending a specially crafted packet to the service. CVE-2006-1314 Denial of Service/Remote Windows
CA Antivirus CAB Header Parsing Buffer Overflow Exploit This module exploits a stack based buffer overflow vulnerability in CA Antivirus when handling a specially crafted CAB file. CVE-2007-2864 Exploits/Client Side Windows
Drupal Forum Cross Site Scripting Exploit A Cross-Site Scripting (XSS) vulnerability in the Forum module in Drupal 6.x (proir to version 6.13) allows remote attackers to inject arbitrary web scripts or HTML by requesting a specially crafted tid. The vulnerability is present only if the Forum module is activated, this is not the default configuration but the module is shipped by default with Drupal. CVE-2009-2373 Exploits/Cross Site Scripting (XSS)/Known Vulnerabilities none
JOnAS Remote Command Injection Exploit This module exploits a XSS vulnerability in JOnAS which allows IMPACT Pro to perform remote command injection impersonating an administrator and uploading a plugin to the JOnAS server. This module runs a web server waiting for a JOnAS administrator to connect to it. When the client connects, it will retrieve their JOnAS cookie and try to install an agent on the JOnAS server by installing a custom plugin in JOnAS. NOCVE-9999-36877 Exploits/Client Side Windows, Mac OS X, Linux
Winamp gen_ff DLL Buffer Overflow Exploit Update Winamp is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied input. This update enhances support for the Impact 9. CVE-2009-1831 Exploits/Client Side Windows
Jetty Directory Listing Cross Site Scripting Exploit A Cross-Site scripting vulnerability has been reported in Jetty. This vulnerability can be induced whenever Jetty displays a web directory listing. Client-side script code can be included in the HTTP response by appending it next to directory listing's path, preceded by a ';' character. CVE-2009-1524 Exploits/Cross Site Scripting (XSS)/Known Vulnerabilities none
Phpmyadmin Server_databases Remote Code Execution Exploit Update This updates provides more readable log messages when specific errors occur and improves the reliability of the exploit. CVE-2008-4096 Exploits/Remote Linux
Winamp Computer Name Handling Buffer Overflow Exploit Update This module exploits a vulnerability in Winamp 5.12. This Update adds support for Impact v9 and Windows XP SP3. CVE-2006-0476 Exploits/Client Side Windows
Microsoft Windows MSMQ Null Pointer DoS (MS09-040) This module exploits a vulnerability in Microsoft Message Queue Service driver (MQAC.SYS). The IOCTL handler in the MQAC.SYS device driver allows local users to overwrite memory via malformed Interrupt Request Packet (Irp) parameters. CVE-2009-1922 Denial of Service/Local Windows
Microsoft Word Malformed Object Pointer Exploit (MS06-027) Microsoft Word is prone to a remote code-execution vulnerability. The issue arises because Word fails to properly handle malformed object pointers. CVE-2006-2492 Exploits/Client Side Windows
Apple Mac OS X HFS Plus Local Privilege Escalation Exploit XNU 1228.9.59 and earlier on Apple Mac OS X 10.5.6 and earlier does not properly restrict interaction between user space and the HFS IOCTL handler. This allows local users to overwrite kernel memory and gain privileges by attaching an HFS+ disk image and performing certain steps involving HFS_GET_BOOT_INFO fcntl calls. CVE-2009-1235 Exploits/Local Mac OS X
ProFTP Welcome Message Buffer Overflow Exploit This exploit takes advantage of a vulnerability that allows attackers to cause ProFTP to execute arbitrary code via a malformed welcome message of the server. CVE-2009-3976 Exploits/Client Side Windows