Symantec System Center Alert Management System (xfr.exe) Arbitrary Command Execution

Symantec System Center Alert Management System is prone to a remote command-injection vulnerability because the application fails to properly sanitize user-supplied input. Module Options msf use exploit/windows/antivirus/ams/xfr msf undefinedxfr show actions ...actions... msf undefinedxfr set...

Symantec Alert Management System Intel Alert Originator Service Buffer Overflow

This module exploits a stack buffer overflow in Intel Alert Originator Service msgsys.exe. When an attacker sends a specially crafted alert, arbitrary code may be executed. Module Options msf use exploit/windows/antivirus/symantec/iao msf undefinediao show actions ...actions... msf undefinediao s...

Microsoft WordPad Word97 text converter buffer overflow

Added: 04/23/2009 CVE: CVE-2009-0235 BID: 34470 OSVDB: 53664 Background The Microsoft WordPad Word 97 text converter allows Windows users who do not have Microsoft Word to open Word 97 files. Problem A buffer overflow vulnerability in the Word 97 text converter allows command execution when a use...

Microsoft PowerPoint invalid object reference vulnerability

Added: 04/20/2009 CVE: CVE-2009-0556 BID: 34351 OSVDB: 53182 Background Microsoft PowerPoint is presentation software included in the Microsoft Office desktop suite. Problem A memory corruption vulnerability in Microsoft PowerPoint allows command execution when an invalid object is referenced...

Linux udev Netlink Local Privilege Escalation

Versions of udev use exploit/linux/local/udev/netlink msf undefinednetlink show actions ...actions... msf undefinednetlink set ACTION msf undefinednetlink show options ...show and set options... msf undefinednetlink run This module requires Metasploit: https://metasploit.com/download Current...

Microsoft Whale Intelligent Application Gateway ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in Microsoft Whale Intelligent Application Gateway Whale Client. When sending an overly long string to CheckForUpdates method of WhlMgr.dll 3.1.502.64 an attacker may be able to execute arbitrary code. Module Options msf use...

EnjoySAP SAP GUI ActiveX Control Arbitrary File Download

This module allows remote attackers to place arbitrary files on a users file system by abusing the "CompDownload" method in the SAP KWEdit ActiveX Control kwedit.dll 6400.1.1.41. Module Options msf use exploit/windows/browser/enjoysapgui/compdownload msf undefinedcompdownload show actions...

Novell NetIdentity Agent XTIERRPCPIPE Named Pipe Buffer Overflow

This module exploits a stack buffer overflow in Novell's NetIdentity Agent. When sending a specially crafted string to the 'XTIERRPCPIPE' named pipe, an attacker may be able to execute arbitrary code. The success of this module is much greater once the service has been restarted. Module Options m...

UltraISO CCD File Parsing Buffer Overflow

This module exploits a stack-based buffer overflow in EZB Systems, Inc's UltraISO. When processing .CCD files, data is read from file into a fixed-size stack buffer. Since no bounds checking is done, a buffer overflow can occur. Attackers can execute arbitrary code by convincing their victim to...

IBM Access Support ActiveX GetXMLValue buffer overflow

Added: 04/01/2009 CVE: CVE-2009-0215 BID: 34228 OSVDB: 52958 Background The IBM Access Support ActiveX control is used to collect system information. It comes with certain IBM and Lenovo computer systems. Problem A buffer overflow vulnerability allows command execution when a user loads a page...

IBM Access Support ActiveX GetXMLValue buffer overflow

Added: 04/01/2009 CVE: CVE-2009-0215 BID: 34228 OSVDB: 52958 Background The IBM Access Support ActiveX control is used to collect system information. It comes with certain IBM and Lenovo computer systems. Problem A buffer overflow vulnerability allows command execution when a user loads a page...

SAP AG SAPgui EAI WebViewer3D Buffer Overflow

This module exploits a stack buffer overflow in Siemens Unigraphics Solutions Teamcenter Visualization EAI WebViewer3D ActiveX control that is bundled with SAPgui. When passing an overly long string the SaveViewToSessionFile method, arbitrary code may be executed. Module Options msf use...

Symantec AppStream Client LaunchObj ActiveX Control installAppMgr vulnerability

Added: 03/31/2009 CVE: CVE-2008-4388 BID: 33247 OSVDB: 51410 Background Symantec AppStream is an application deployment framework. Problem The LaunchObj ActiveX control exposes the installAppMgr method, which can be used to download and execute arbitrary code. This could allow command execution...

Symantec AppStream Client LaunchObj ActiveX Control installAppMgr vulnerability

Added: 03/31/2009 CVE: CVE-2008-4388 BID: 33247 OSVDB: 51410 Background Symantec AppStream is an application deployment framework. Problem The LaunchObj ActiveX control exposes the installAppMgr method, which can be used to download and execute arbitrary code. This could allow command execution...

XM Easy Personal FTP Server 5.7.0 NLST DoS

You need a valid login to DoS this FTP server, but even anonymous can do it as long as it has permission to call NLST. Module Options msf use auxiliary/dos/windows/ftp/xmeasy570/nlst msf undefinednlst show actions ...actions... msf undefinednlst set ACTION msf undefinednlst show options ...show a...

ffdshow URL link buffer overflow

Added: 03/25/2009 CVE: CVE-2008-5381 BID: 32438 OSVDB: 50064 Background ffdshow tryouts also known just as ffdshow is an audio and video decoder for Windows. Problem A buffer overflow vulnerability allows command execution when a user opens a media stream with a long, specially crafted URL link...

IBM Access Support ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in IBM Access Support. When sending an overly long string to the GetXMLValue method of IbmEgath.dll 3.20.284.0 an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/browser/ibmegath/getxmlvalue msf undefinedgetxmlval...

Foxit Reader Authorization Bypass

This module exploits an authorization bypass vulnerability in Foxit Reader build 1120. When an attacker creates a specially crafted pdf file containing an Open/Execute action, arbitrary commands can be executed without confirmation from the victim. Module Options msf use...

Foxit Reader 3.0 Open Execute Action Stack Based Buffer Overflow

This module exploits a buffer overflow in Foxit Reader 3.0 builds 1301 and earlier. Due to the way Foxit Reader handles the input from an "Launch" action, it is possible to cause a stack-based buffer overflow, allowing an attacker to gain arbitrary code execution under the context of the user...

Orbit Downloader Connecting log message buffer overflow

Added: 03/04/2009 CVE: CVE-2009-0187 BID: 33894 OSVDB: 52294 Background Orbit Downloader is a download manager supporting various protocols. Problem A buffer overflow vulnerability when constructing "Connecting" log messages allows command execution when a user loads an HTTP URL with a long,...