[Dailydave] The path

[Dave Aitel]

Kit Dale likes to say he doesn't train particular BJJ moves per se, so
much as a chain of moves that go from one side of the game to another.
For example, an escape, then a transition to top position, then a pass,
then a submission. Those of us in the infosec world would recognize this
as an "Attack Chain".

And we like to do this with our exploit releases too. That way it's not
like you get just an exploit that will maybe get you onto a box or one
that will get you root if you already happen to have a shell, but you
get a full path from remote to root control. And ideally we try to
supply a toolchain that provides persistence, data exfiltration, and the
whole package.

But this month instead we're releasing what I consider "point solution"
additions, including the three already in CANVAS Early Updates.

CVE-2014-1776 (cmarkup uaf)
CVE-2014-4943 (pppol2tp local root)
CVE-2014-3153 (Futex)

One of the reasons we're concentrating on Linux Locals is we find that
after doing a training on PHP exploitation, people naturally have a lot
more shells on Linux systems.

-dave



-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 196 bytes
Desc: OpenPGP digital signature
URL: <https://lists.immunityinc.com/pipermail/dailydave/attachments/20140819/444379bf/attachment.sig>