Supposed zero-day exploit for Plesk

Plesk

The hacker known as KingCope has taken to the security mailing list Full Disclosure to publish what seems to be a zero-day exploit for Plesk, the hosting software package made by Parallels. KingCope says that the exploit uses specially prepared HTTP queries to inject PHP commands and that he has successfully tested it on Plesk 9.5.4, 9.3, 9.2, 9.0 and 8.6 on Red Hat, CentOS and Fedora. Version 11.0.9 is apparently not affected.


The hacker seems to have found a way to use a POST request to launch the PHP interpreter with any configuration parameters that an attacker may want; the interpreter can then be made to carry out any command at will. The exploit uses the requested URL to start the interpreter with the desired parameters (say, "safe_mode=off"), and the PHP code that is to be executed is in the data portion of the request.

Source »

Google researcher discloses zero-day exploit for Windows

Google security expert Tavis Ormandy has discovered a security vulnerability in Windows which can be exploited by any user on the system to obtain administrator privileges. Rather than reporting the vulnerability to Microsoft, he posted details to the Full Disclosure security mailing list in mid-May and has now published an exploit to the same mailing list.

With this latest vulnerability, Ormandy once more opted for full disclosure on the mailing list of the same name. After discovering a bug in the Windows kernel's EPATHOBJ::pprFlattenRec function, he wrote to the list: "I don't have much free time to work on silly Microsoft code" and solicited ideas on how to successfully exploit the bug. With the help of user progmboy, Ormandy then developed a privilege escalation exploit which he shared with the mailing list, noting that another exploit was already in circulation.

Continue to the article »