Vulnerabilities (Page 3)

de_Fuse, the One True Pwn

This article is about glitching the Wii-U’s read of One-Time Programmable (OTP) fuses into registers for verifying the boot process.Under normal circumstances, the boot ROM will verify the firmware stored in the NAND storage against a hash stored in fuses…

 

Privilege escalation in AWS Elastic Kubernetes Service (EKS)

Nothing to crazy here, its well known that if someone can compromise something running within an AWS Elastic Kubernetes Service (EKS) pod, they can use that access to hit the AWS EC2 Metadata Service and gain the machine’s IAM token. There has been some prior research about performing a denial of service by removing a network interface with that token, but the author An Trinh here takes a look at going for a more significant privilege escalation.

 

SNIProxy wildcard backend hosts buffer overflow vulnerability

A stack-based buffer overflow in SNI Proxy, in parsing Hostnames to determine where to redirect traffic to the application would The vulnerability exists when aprsing IPv6 blocks, it’ll calculate the source length by looking for the end ] character, and then copy those characters into the target buffer. While it does “limit” the copy, it limits it based on the source length rather than the destination buffer size allowing for an overflow.

 
1
2
3
4
5
6
7