Editing Bugs & Vulnerabilities
Jump to navigation
Jump to search
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.
| Latest revision | Your text | ||
| Line 1: | Line 1: | ||
== Unknown / unpatched == | == Unknown / unpatched == | ||
=== Memory corruption and NULL pointer in Unreal Tournament III 1.2 === | === Memory corruption and NULL pointer in Unreal Tournament III 1.2 === | ||
http://cxsecurity.com/issue/WLB-2008070060 | |||
unsure if applies to PS3? | |||
=== MacOS X 10.5/10.6 libc/strtod(3) buffer overflow === | === MacOS X 10.5/10.6 libc/strtod(3) buffer overflow === | ||
http://cxsecurity.com/issue/WLB-2010010162 | |||
unsure if applies to PS3? | |||
=== OpenPrinter() stack-based buffer overflow === | === OpenPrinter() stack-based buffer overflow === | ||
http://seclists.org/fulldisclosure/2007/Jan/474 | |||
Patched: ? | |||
=== DOM flaw === | === DOM flaw === | ||
http://seclists.org/fulldisclosure/2009/Jul/299 | http://seclists.org/fulldisclosure/2009/Jul/299 | ||
Patched: ? | |||
== Patched == | == Patched == | ||
=== RSX Syscall bug === | === RSX Syscall bug === | ||
In most syscalls sony reduces a pointer to 32 bits and would use a special function to write to that pointer.<br> however, in certain rsx syscalls, sony forgot about it, allowing the attacker to write to any part of lv2 memory. | In most syscalls sony reduces a pointer to 32 bits and would use a special function to write to that pointer.<br> however, in certain rsx syscalls, sony forgot about it, allowing the attacker to write to any part of lv2 memory. | ||
Patched: [[4. | Patched: [[4.45_CEX|4.45]] | ||
=== CTR bugs on SELFs (and ebootroms maybe?) === | |||
http://crypto.stackexchange.com/questions/14628/why-do-we-use-xts-over-ctr-for-disk-encryption CTR bugs on SELFs | |||
Patched: since Vita pre-retail [http://www.vitadevwiki.com/index.php?title=00.996.090_DEX 0.9.9.6] (SELFs, should match with ps3 firmware at release date), unknown (ebootroms) | |||
=== PARAM.SFO stack-based buffer overflow === | === PARAM.SFO stack-based buffer overflow === | ||
http://seclists.org/fulldisclosure/2013/May/113 | |||
Patched: since 2012-05-01 ([[4.40_CEX|4.40]] and later) | Patched: since 2012-05-01 ([[4.40_CEX|4.40]] and later) | ||
| Line 153: | Line 40: | ||
==== Proof of Concept ==== | ==== Proof of Concept ==== | ||
Unsigned code can be added to the [[PARAM.SFO]] because the console does not recognize special characters | Unsigned code can be added to the [[PARAM.SFO]] because the console does not recognize special characters | ||
http://www.exploit-db.com/exploits/25718/ | |||
Working on [[4.31_CEX|4.31]] | Working on [[4.31_CEX|4.31]], Patched: since 2012-05-01 ([[4.40_CEX|4.40]] and later) | ||
PoC: PARAM.SFO | PoC: PARAM.SFO | ||
| Line 186: | Line 73: | ||
=== AVP patch bypass exploit === | === AVP patch bypass exploit === | ||
Patched: since [[3.70_CEX|3.70]] and later | Patched: since [[3.70_CEX|3.70]] and later | ||
=== PSN security intrusion === | === PSN security intrusion === | ||
| Line 193: | Line 80: | ||
=== Sony PSN Account Service - Password Reset Vulnerability === | === Sony PSN Account Service - Password Reset Vulnerability === | ||
http://www.vulnerability-lab.com/get_content.php?id=740 | |||
Patched: since 2012-05-01 | Patched: since 2012-05-01 | ||
=== | === Private key nonrandom fail === | ||
Patched: since [[3.56-1 CEX|3.56]] | Patched: since [[3.56-1 CEX|3.56]] | ||
| Line 208: | Line 92: | ||
Patched: since [[3.56-1 CEX|3.56]] | Patched: since [[3.56-1 CEX|3.56]] | ||
=== USB config | === USB config stack-based buffer overflow (PSjailbreak/PSGroove) === | ||
Patched: since [[3.42_CEX|3.42]] and later | Patched: since [[3.42_CEX|3.42]] and later | ||
| Line 232: | Line 116: | ||
Patched: since [[2.50_CEX|2.50]] and later | Patched: since [[2.50_CEX|2.50]] and later | ||
=== | === Downgrading with Hardware flasher === | ||
See also: [[Downgrading with Hardware flasher]] | |||
See also: [[Downgrading with Hardware flasher]] | |||
Patched: since [[2.20_CEX|2.20]] and later (by adding [[CoreOS]] hashing in [[Syscon Hardware|Syscon]] to be checked by [[Hypervisor Reverse Engineering|hypervisor]]; worked around by patching hypervisor on [[3.56-1 CEX|3.56]] and lower capable consoles) | Patched: since [[2.20_CEX|2.20]] and later (by adding [[CoreOS]] hashing in [[Syscon Hardware|Syscon]] to be checked by [[Hypervisor Reverse Engineering|hypervisor]]; worked around by patching hypervisor on [[3.56-1 CEX|3.56]] and lower capable consoles) | ||
=== Full RSX access in OtherOS === | === Full RSX access in OtherOS === | ||
| Line 243: | Line 126: | ||
=== Web browser DoS via a large integer value for the length property of a Select object === | === Web browser DoS via a large integer value for the length property of a Select object === | ||
http://www.cvedetails.com/cve/CVE-2009-2541/ | |||
Patched: since 4 sept 2009 | Patched: since 4 sept 2009 | ||
=== Remote Play UDP packets DoS === | === Remote Play UDP packets DoS === | ||
http://www.cvedetails.com/cve/CVE-2007-1728/ / http://cxsecurity.com/issue/WLB-2007030183 | |||
Affected: [[1.60_CEX|2.10]] and PSP 3.10 OE-A | Affected: [[1.60_CEX|2.10]] and PSP 3.10 OE-A | ||
| Line 264: | Line 145: | ||
Patched | Patched | ||
{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude> | {{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude> | ||