MMS Exploit Part 3: Constructing the Memory Corruption Primitives

Posted by Mateusz Jurczyk, Project Zero This post is the third of a multi-part series capturing my journey from discovering a vulnerable little-known Samsung image codec, to completing a remote zero-click MMS attack that worked on the latest Samsung flagship devices. New posts will be published a...

MMS Exploit Part 2: Effective Fuzzing of the Qmage Codec

Posted by Mateusz Jurczyk, Project Zero This post is the second of a multi-part series capturing my journey from discovering a vulnerable little-known Samsung image codec, to completing a remote zero-click MMS attack that worked on the latest Samsung flagship devices. New posts will be published ...

MMS Exploit Part 1: Introduction to the Samsung Qmage Codec and Remote Attack Surface

Posted by Mateusz Jurczyk, Project Zero This post is the first of a multi-part series capturing my journey from discovering a vulnerable little-known Samsung image codec, to completing a remote zero-click MMS attack that worked on the latest Samsung flagship devices. New posts will be published a...

ABB Multiple System 800xA Products

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low skill level to exploit Vendor: ABB Equipment: System 800xA Vulnerabilities: Incorrect Default Permissions 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to make the system node inaccessible or tamper with...

ABB System 800xA

1. EXECUTIVE SUMMARY CVSS v3 7.3 ATTENTION: Low skill level to exploit Vendor: ABB Equipment: System 800xA Vulnerabilities: Incorrect Default Permissions 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to escalate privileges, cause system functions to...

CVE-2020-8899

There is a buffer overwrite vulnerability in the Quram qmg library of Samsung's Android OS versions O8.x, P9.0 and Q10.0. An unauthenticated, unauthorized attacker sending a specially crafted MMS to a vulnerable phone can trigger a heap-based buffer overflow in the Quram image codec leading to an...

CVE-2020-8899 Memory corruption in Quram library when decoding qmg can lead to RCE

There is a buffer overwrite vulnerability in the Quram qmg library of Samsung's Android OS versions O8.x, P9.0 and Q10.0. An unauthenticated, unauthorized attacker sending a specially crafted MMS to a vulnerable phone can trigger a heap-based buffer overflow in the Quram image codec leading to an...

CVE-2020-8899 Samsung Quarm RCE via MMS

There is a buffer overwrite vulnerability in the Quram qmg library of Samsung's Android OS versions O8.x, P9.0 and Q10.0. An unauthenticated, unauthorized attacker sending a specially crafted MMS to a vulnerable phone can trigger a heap-based buffer overflow in the Quram image codec leading to an...

PT-2020-20359 · Quram +1 · Quram Qmg Library +1

Name of the Vulnerable Software and Affected Versions: Samsung Android OS versions O8.x through Q10.0 Description: A buffer overwrite vulnerability exists in the Quram qmg library, allowing an unauthenticated attacker to trigger a heap-based buffer overflow by sending a specially crafted MMS. Thi...

CVE-2020-8899: Heap-based Buffer Overflow

There is a buffer overwrite vulnerability in the Quram qmg library of Samsung's Android OS versions O8.x, P9.0 and Q10.0. An unauthenticated, unauthorized attacker sending a specially crafted MMS to a vulnerable phone can trigger a heap-based buffer overflow in the Quram image codec leading to an...

Design/Logic Flaw

Insufficient protection of the inter-process communication functions in ABB System 800xA products OPC Server for AC 800M, MMS Server for AC 800M and Base Software for SoftControl all published versions enables an attacker authenticated on the local system to inject data, affecting the online view...

CVE-2020-8478

The CVE-2020-8478 issue affects ABB System 800xA components (OPC Server for AC 800M, MMS Server for AC 800M, and Base Software for SoftControl) where weak inter-process communication access controls allow an authenticated local attacker to inject data and tamper the online runtime data view in Co...

CVE-2020-8478: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Insufficient protection of the inter-process communication functions in ABB System 800xA products OPC Server for AC 800M, MMS Server for AC 800M and Base Software for SoftControl all published versions enables an attacker authenticated on the local system to inject data, affecting the online view...

Access Control Error Vulnerability in Multiple ABB Products

ABB OPCServer for AC800M and others are products of ABB Switzerland.ABB OPCServer for AC800M is an OPC OLE for Process Control server for AC800M.Control Builder M Professional is a Compact Control Builder. MMSServer for AC800M is an MMS server for AC800M. An Access Control Error vulnerability...

CVE-2020-0060

In query of SmsProvider.java and MmsSmsProvider.java, there is a possible permission bypass due to SQL injection. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID...

The vulnerability of the MMS All software component for Oracle Hospitality Cruise Materials Management allows a hacker to gain unauthorized access to protected information.

The vulnerability of the MMS All software component for Oracle Hospitality Cruise Materials Management is related to lack of access control. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...

mms-company.ru Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1082560 Security Researcher geeknik Helped patch 8930 vulnerabilities Received 8 Coordinated Disclosure badges Received 21 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting mms-company.ru website and...

mms-dpo.ru Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1075163 Security Researcher geeknik Helped patch 8675 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting mms-dpo.ru website and its...

CVE-2020-2599

Vulnerability in the Oracle Hospitality Cruise Materials Management product of Oracle Hospitality Applications component: MMS All. The supported version that is affected is 7.30.567. Difficult to exploit vulnerability allows physical access to compromise Oracle Hospitality Cruise Materials...

CVE-2020-2599: Undefined Security Weakness

Vulnerability in the Oracle Hospitality Cruise Materials Management product of Oracle Hospitality Applications component: MMS All. The supported version that is affected is 7.30.567. Difficult to exploit vulnerability allows physical access to compromise Oracle Hospitality Cruise Materials...