SektionEins Blog
sektioneins.de · Company blog · on HN since 2014
SektionEins is a German security firm whose blog publishes vulnerability write-ups on OS X, iOS, Drupal and PHP.
What HN saysHN links it for technical vulnerability analyses, such as the OS X DYLD_PRINT_TO_FILE privilege escalation and the Drupal SQL injection.
27HN people shared it
10linked it in comments
18stories submitted
300story points
6 years agolast shared
2014people per year2026
Most-shared posts
- 1OS X 10.10 DYLD_PRINT_TO_FILE Local Privilege Escalation Vulnerability4 people · 17 points · first shared 2015 · discussion on HN
- 2Advisory 01/2014: Drupal – Pre Auth SQL Injection Vulnerability4 people · 2 points · first shared 2014 · 1 comments on HN
- 3Apple OSX Mavericks 10.9.x SSL Key Exchange Verification Vulnerability3 people · 4 points · first shared 2014 · 1 comments on HN
- 4PEGASUS iOS Kernel Vulnerability Explained – Part 22 people · 8 points · first shared 2016 · discussion on HN
- 5[Patch] Apple OSX 10.9.x SSL Key Verification Vulnerability (CVE-2014-1266)2 people · 1 points · first shared 2014 · discussion on HN
- 6Drupal 7 SQL Injection Vulnerability1 people · 160 points · first shared 2014 · 81 comments on HN
- 7PEGASUS iOS Kernel Vulnerability Explained1 people · 82 points · first shared 2016 · 17 comments on HN
- 8Phpinfo() Type Confusion Infoleak Vulnerability and SSL Private Keys1 people · 7 points · first shared 2014 · discussion on HN
- 9Drupal 7.31 Pre Auth SQL Injection Vulnerability1 people · 6 points · first shared 2014 · discussion on HN
- 10SPL ArrayObject/SPLObjectStorage Unserialization Type Confusion Vulnerabilities1 people · 2 points · first shared 2014 · discussion on HN
- 11CSRF/SSRF and DoS in GnuPG's WKD Handling1 people · 2 points · first shared 2018 · discussion on HN
- 12iOS 7/8 Kernel Exploitation Training (November 2014) – 4500€ fee1 people · 2 points · first shared 2014 · 1 comments on HN
- 13PHP vulnerable configuration checker1 people · 2 points · first shared 2014 · discussion on HN
- 14OpenSSHd Security Configuration Checker1 people · 2 points · first shared 2018 · discussion on HN
- 15Phpinfo() Type Confusion Infoleak Vulnerability and SSL Private Keys1 people · 1 points · first shared 2014 · discussion on HN
What HN people wrote when they linked it
bascule · 2015-07-27
The recent OS X DYLD_PRINT_TO_FILE local privilege escalation vulnerability was a classic confused deputy:
https://www.sektioneins.de/en/blog/15-07-07-dyld_print_to_file_lpe.htm…
UnoriginalGuy · 2014-11-01
Why does Drupal use string manipulation to generate SQL statements instead of bind parameters? It is 2014, hasn't this been best practice since at least the late 1990s? Wouldn't all security audits, including automated ones, pick this up?
And before someone makes a "joke" about PHP, they're using the PDO framework which supports bindParam(). Seems like woful incompetence in the Drupal codebase to me.
Exploit in detail:
https://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-au…
pr0zac · 2020-09-11
Ironically, one example is an app that was useful for detecting malware or other security problems:
https://www.sektioneins.de/en/blog/16-08-11-sysinfo-what-happened.html
x0x0 · 2015-08-07
It's a good contender, but in 10.2, you could hold down a key in the screen saver lock screen and overflow a buffer, crashing the screensaver and logging you in. Seriously. Not a root exploit but embarrassing.
http://www.cvedetails.com/cve/CVE-2003-0518/
btw, discoverer claims to have written a kext fixing the hole
http://www.sektioneins.de/blog/15-07-07-dyld_print_to_file_lpe.html
marquis · 2015-08-07
Is there a test to determine if the patch is successful?
Edit: as noted in Esser's blog [1]:
$ EDITOR=/usr/bin/true DYLD_PRINT_TO_FILE=/this_system_is_vulnerable crontab -e
I found this test failed in both a patched (10.10.4) and un-patched system (10.10.1) so not sure what these results mean.
[1] https://www.sektioneins.de/en/blog/15-07-07-dyld_print_to_file_lpe.htm…
itg · 2015-07-22
Stefan's blog post: https://www.sektioneins.de/en/blog/15-07-07-dyld_print_to_file_lpe.htm…
ayrx · 2014-10-15
Technical details can be found in this link: https://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-au…
mikeash · 2014-02-25
No need to MITM anything. You can just patch the binaries on disk. People have already done the legwork for it: http://www.sektioneins.de/en/blog/14-02-22-Apple-SSL-BUG.html
cantfindmypass · 2014-02-22
I am now for informational purposes linking to the OS X patch released by i0n1c.
http://www.sektioneins.de/en/blog/14-02-22-Apple-SSL-BUG.html
knweiss · 2014-02-22
(Caveat: I haven't tried this myself!)
Here's the analysis and an experimental patch from @i0n1c for the 64bit version of Mavericks' Security.framework (32-bit remains unpatched):
http://sektioneins.de/blog/14-02-22-Apple-SSL-BUG.html