Defense in depth — the Microsoft way (part 26): "Set Program Access and Computer Defaults" hides applications like Outlook

Posted by Stefan Kanthak on Jan 03

Hi @ll,

in order to prevent the possible execution of a rogue program like
“C:Program.exe” or “C:Program FilesMicrosoft.exe”, on x64 also
“C:Program Files.exe” or “C:Program Files (x86)Microsoft.exe”,
due to the beginner’s error of using unquoted pathnames containing
spaces (see <https://cwe.mitre.org/data/definitions/428.html>),
Windows’ [*] “Set Program Access and Computer…

CVE-2014-9427

sapi/cgi/cgi_main.c in the CGI component in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x through 5.6.4, when mmap is used to read a .php file, does not properly consider the mapping’s length during processing of an invalid file that begins with a # character and lacks a newline character, which causes an out-of-bounds read and might (1) allow remote attackers to obtain sensitive information from php-cgi process memory by leveraging the ability to upload a .php file or (2) trigger unexpected code execution if a valid PHP script is present in memory locations adjacent to the mapping.

CVE-2013-7418

cgi-bin/iptablesgui.cgi in IPCop (aka IPCop Firewall) before 2.1.5 allows remote authenticated users to execute arbitrary code via shell metacharacters in the TABLE parameter. NOTE: this can be exploited remotely by leveraging a separate cross-site scripting (XSS) vulnerability.