AndroidSecNotes

原文 by 瘦蛟舞 0x00 序 随着移动安全越来越火,各种调试工具也都层出不穷,但因为环境和需求的不同,并没有工具是万能的。另外工具是死的,人是活的,如果能搞懂工具的原理再结合上自身的经验,你也可以创造出属于自己的调试武器。因此,笔者将会在这一系列文章中分享一些自己经常用或原创的调试工具以及手段,希望能对国内移动安全的研究起到一些催化剂的作用。 文章中所有提到的代码和工具都可以在我的github下载到,地址是: https://github.com/zhengmin1989/TheSevenWeapons 0x01 利用函数挂钩实现native层的hook...

so-good.jp Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1187920 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

so-fa.fr Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1155124 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

CVE-2020-7489

A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability exists on EcoStruxure Machine Expert – Basic or SoMachine Basic programming software versions in security notification. The result of this vulnerability, DLL substitution, coul...

so-nails.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1129611 Security Researcher Dipu1A Helped patch 1022 vulnerabilities Received 6 Coordinated Disclosure badges Received 22 recommendations , a holder of 6 badges for responsible and coordinated disclosure, found a security vulnerability affecting so-nails.com website and it...

CVE-2019-12128

In ONAP SO through Dublin, by accessing an applicable port 30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271, an attacker gains full access to the respective ONAP services without any authentication. All ONAP Operations Manager OOM setups are affected...

Authentication flaw

In ONAP SO through Dublin, by accessing an applicable port 30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271, an attacker gains full access to the respective ONAP services without any authentication. All ONAP Operations Manager OOM setups are affected...

CVE-2019-12128

CVE-2019-12128 affects ONAP SO (Dublin and prior) with an authorization flaw: by contacting any of ports 30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, or 30271, an attacker gains full access to the corresponding ONAP services without authentication. Documents consistently describe this ...

CVE-2020-9267

SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary user creation via process/xajaxserver.php...

url.hqhl.net Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1087920 Security Researcher g0bl1nsec Helped patch 3735 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting url.hqhl.net website and...

Debian DLA-2081-1 : openjpeg2 security update

OpenJPEG had a heap-based buffer overflow in opjt1clbldecodeprocessor in libopenjp2.so. For Debian 8 'Jessie', this problem has been fixed in version 2.1.0-2+deb8u9. We recommend that you upgrade your openjpeg2 packages. NOTE: Tenable Network Security has extracted the preceding description block...

Denial Of Service (DoS)

libxml2.so is vulnerable to denial of service DoS. The attack is possible due to a lack of proper memory handing in the function xmlParseBalancedChunkMemoryRecover in parser.c, leading to an application crash...

Mozilla FireFox (Windows 10 x64) - Full Chain Client Side Attack Exploit

// Axel '0vercl0k' Souchet - November 19 2019 // EDB Note: Download https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47752.zip // 0:000 ? xul!sAutomationPrefIsSet - xul // Evaluate expression: 85724947 = 00000000051c0f13 const XulsAutomationPrefIsSet = 0x051c0f13...

Denial Of Service (DoS)

libexiv2.so is vulnerable to denial of service DoS attacks. When an attacker sends a malicious CRW image,the function Exiv2::Internal::CiffDirectory::readDirectory in crwimageint.cpp fails to check the offset and size against the total size, causing a trigger for an application crash via...

Denial Of Service (DoS)

libbind9.so is vulnerable to denial of service. The number of TCP clients that can be connected at any given time is not limited, allowing a TCP client to send a large number of DNS requests over a single connection. This results in excess resource consumption which can lead to a denial of servic...

Denial Of Service (DoS)

libexiv2.so is vulnerable to denial of service DoS. An attacker can input a malicious PNG file to PngImage::readMetadata in pngimage.cpp to cause a heap-based buffer overflow which results in a denial of service condition...

Design/Logic Flaw

An issue was discovered in BMC Patrol Agent 9.0.10i. Weak execution permissions on the best1collect.exe SUID binary could allow an attacker to elevate his/her privileges to the ones of the "patrol" user by specially crafting a shared library .so file that will be loaded during execution...

Buffer Overflow

libexiv2.so is vulnerable to buffer overflow. The vulnerability exists due to lack of careful bounds checking in Exiv2::MrwImage::readMetadata in mrwimage.cpp, leading to an out-of-bounds read...

Buffer Over-read

libexiv2.so is vulnerable to buffer over-read. The function RafImage::readMetadata in rafimage.cpp ignores the buffer size when reading metadata of raf images which can lead to an out-of-bounds read...

Denial Of Service (DoS)

libexiv2.so is vulnerable to denial of service DoS. The vulnerability exists because the function Exiv2::MrwImage::readMetadata in mrwimage.cpp does not handle the bound checking properly, causing an application crash...