Adobe Flash - URLStream.readObject Use-After-Free

Adobe Flash - URLStream.readObject Use-After-Free Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=611 There is a use-after-free in URLStream.readObject. If the object read is a registered class, the constructor will get invoked to create the object. If the constructor calls...

Adobe Flash - textfield.maxChars Use-After-Free

Adobe Flash - textfield.maxChars Use-After-Free Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=581 There is a use-after-free in the TextField.maxChars setter. If the maxChars the field is set to is an object with valueOf defined, the valueOf function can free the field's parent...

WordPress Plugin Advanced Video 1.0 - Local File Inclusion

WordPress Plugin Advanced Video 1.0 - Local File Inclusion !/usr/bin/env python Exploit Title: Advanced-Video-Embed Arbitrary File Download / Unauthenticated Post Creation Google Dork: N/A Date: 04/01/2016 Exploit Author: evait security GmbH Vendor Homepage: arshmultani - http://dscom.it/ Softwar...

Microsoft Windows Kernel - NtGdiGetTextExtentExW Out-of-Bounds Memory Read

Microsoft Windows Kernel - NtGdiGetTextExtentExW Out-of-Bounds Memory Read Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=685 The attached Proof-of-Concept crashes Windows 7 with special pool enabled on win32k.sys. The crash is due accessing memory past the end of a buffer. Pro...

PHP 5.5.337.0.4 - SNMP Format String

PHP 5.5.337.0.4 - SNMP Format String // Should bypass ASLR/NX just fine // This exploit utilizes PHP's internal "%Z" zval // format specifier in order to achieve code-execution. // We fake an object-type zval in memory and then bounce // through it carefully. First though, we use the same // bug ...

PHP 5.5.33 - Invalid Memory Write

PHP 5.5.33 - Invalid Memory Write Exploit Title: Invalid memory write in phar on filename with \0 in name Date: 2016-03-19 Exploit Author: @vah13 Vendor Homepage: https://secure.php.net/ Software Link: https://github.com/php/php-src Version: 5.5.33 Tested on: Linux Test script: --------------- ca...

Adobe Flash - Color.setTransform Use-After-Free

Adobe Flash - Color.setTransform Use-After-Free Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=451 If Color.setTransform is set to a transform that deletes the field it is called on, a UaF occurs. A PoC is as follows: var tf:TextField = this.createTextField"tf",1,1,1,4,4 var n ...

Google Android - ih264d_process_intra_mb Memory Corruption

Google Android - ih264dprocessintramb Memory Corruption Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=523 The attached file causes a crash in ih264dprocessintramb in avc parsing, likely due to incorrect bounds checking in one of the memcpy or memset calls in the method. The fi...

JOIYBbt2VLmlUjB

A Remote Browser's Agent XSS is a piece of software that allows a remote "operator" to control a browser as if he has physical access to that system. While desktop sharing and remote administration have many legal uses, "XSS" software is usually associated with criminal or malicious activity...

2d9nrrPmNF1O7wd

A Remote Browser's Agent XSS is a piece of software that allows a remote "operator" to control a browser as if he has physical access to that system. While desktop sharing and remote administration have many legal uses, "XSS" software is usually associated with criminal or malicious activity...

MOBOTIX Video Security Cameras - Cross-Site Request Forgery (Add Admin)

MOBOTIX Video Security Cameras - Cross-Site Request Forgery Add Admin...

Apache OpenMeetings 1.9.x 3.1.0 - .ZIP File Directory Traversal

Apache OpenMeetings 1.9.x 3.1.0 - .ZIP File Directory Traversal Severity: Moderate Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings 1.9.x - 3.1.0 Description: The Import/Export System Backups functionality in the OpenMeetings Administration menu...

Wireshark - dissect_pktc_rekey Heap Out-of-Bounds Read

Wireshark - dissectpktcrekey Heap Out-of-Bounds Read Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=754 The following crash due to a heap-based out-of-bounds read can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to tshark "$ ./tshark...

LN5KyLD3PXVFYox

A Remote Browser's Agent XSS is a piece of software that allows a remote "operator" to control a browser as if he has physical access to that system. While desktop sharing and remote administration have many legal uses, "XSS" software is usually associated with criminal or malicious activity...

6i1KDv7LY0BZLgb

A Remote Browser's Agent XSS is a piece of software that allows a remote "operator" to control a browser as if he has physical access to that system. While desktop sharing and remote administration have many legal uses, "XSS" software is usually associated with criminal or malicious activity...

Apple QuickTime 7.7.79.80.95 - .FPX Parsing Memory Corruption (2)

Apple QuickTime 7.7.79.80.95 - .FPX Parsing Memory Corruption 2 Application: Apple Quicktime Platforms: Windows, OSX Versions: before version 7.7.79.80.95 Author: Francis Provencher of COSIG Website: http://www.protekresearchlab.com/ Twitter: @COSIG @protekresearch CVE-2016-1768 1 Introduction 2...

Apple QuickTime 7.7.79.80.95 - .FPX Parsing Memory Corruption (1)

Apple QuickTime 7.7.79.80.95 - .FPX Parsing Memory Corruption 1 Application: Apple Quicktime Platforms: Windows, OSX Versions: before version 7.7.79.80.95 Author: Francis Provencher of COSIG Website: http://www.protekresearchlab.com/ Twitter: @COSIG @protekresearch CVE-2016-1767 1 Introduction 2...

CubeCart 6.0.10 - Multiple Vulnerabilities

CubeCart 6.0.10 - Multiple Vulnerabilities Advisory ID: HTB23298 Product: CubeCart Vendor: CubeCart Limited Vulnerable Versions: 6.0.10 and probably prior Tested Version: 6.0.10 Advisory Publication: March 2, 2016 without technical details Vendor Notification: March 2, 2016 Vendor Patch: March 16...

Kamailio 4.3.4 - Heap Buffer Overflow

Kamailio 4.3.4 - Heap Buffer Overflow census ID: census-2016-0009 CVE ID: CVE-2016-2385 Affected Products: Kamailio 4.3.4 and possibly previous versions Class: Heap-based Buffer Overflow CWE-122 Remote: Yes Discovered by: Stelios Tsampas Kamailio successor of former OpenSER and SER is an Open...

Apple QuickTime 7.7.79.80.95 - .PSD Parsing Memory Corruption

Apple QuickTime 7.7.79.80.95 - .PSD Parsing Memory Corruption Application: Apple Quicktime Platforms: Windows, OSX Versions: before version 7.7.79.80.95 Author: Francis Provencher of COSIG Website: http://www.protekresearchlab.com/ Twitter: @COSIG @protekresearch CVE-2016-1769 1 Introduction 2...

Google Android 5.0.1 - Metaphor Stagefright (ASLR Bypass)

Google Android 5.0.1 - Metaphor Stagefright ASLR Bypass Source: https://github.com/NorthBit/Metaphor Metaphor - Stagefright with ASLR bypass By Hanan Be'er from NorthBit Ltd. Link to whitepaper: https://raw.githubusercontent.com/NorthBit/Public/master/NorthBit-Metaphor.pdf Twitter:...

Adobe Flash - Object.unwatch Use-After-Free

Adobe Flash - Object.unwatch Use-After-Free Sources: https://bugs.chromium.org/p/project-zero/issues/detail?id=716 https://googleprojectzero.blogspot.ca/2016/03/life-after-isolated-heap.html The bug is an uninitialized variable in the fix to an ActionScript 2 use-after-free bug. Roughly 80 of the...

Cogent Datahub 7.3.9 Gamma Script - Local Privilege Escalation

Cogent Datahub 7.3.9 Gamma Script - Local Privilege Escalation / Exploit Title: Cogent Datahub sc qc "Cogent DataHub" SC QueryServiceConfig SUCCESS SERVICENAME...

TallSoft SNMPTFTP Server 1.0.0 - Denial of Service

TallSoft SNMPTFTP Server 1.0.0 - Denial of Service Exploit Title: TallSoft SNMP TFTP Server 1.0.0 - DoS Date: 28-03-2016 Software Link: http://www.tallsoft.com/snmptftpserver.exe Exploit Author: Charley Celice stmerry Contact: https://twitter.com/charleycelice Credits: Based off TallSoft Quick TF...

Android One - mt_wifi IOCTL_GET_STRUCT Privilege Escalation

Android One - mtwifi IOCTLGETSTRUCT Privilege Escalation Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=678 The wireless driver for the Android One sprout devices has a bad copyfromuser in the handling for the wireless driver socket private read ioctl IOCTLGETSTRUCT with...

FireEye - Malware Input Processor Privilege Escalation

FireEye - Malware Input Processor Privilege Escalation Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=670 The mip user is already quite privileged, capable of accessing sensitive network data. However, as the child process has supplementary gid contents, there is a very simple...

Liferay Portal 5.1.2 - Persistent Cross-Site Scripting

Liferay Portal 5.1.2 - Persistent Cross-Site Scripting Exploit Title: Liferay Portal 5.1.2 - Persistent XSS Discovery Date: 2016-02-10 Exploit Author: Sarim Kiani Vendor Homepage: https://www.liferay.com Software Link: https://www.liferay.com/community/releases Version: 5.1.2 Tested on: Windows O...

WordPress Plugin IMDb Profile Widget 1.0.8 - Local File Inclusion

WordPress Plugin IMDb Profile Widget 1.0.8 - Local File Inclusion Exploit Title: Wordpress Plugin IMDb Profile Widget - Local File Inclusion Exploit Author: CrashBandicot @DosPerl Date: 2016-03-26 Google Dork : inurl:/wp-content/plugins/imdb-widget Vendor Homepage:...

Trend Micro Deep Discovery Inspector 3.83.7 - Cross-Site Request Forgery

Trend Micro Deep Discovery Inspector 3.83.7 - Cross-Site Request Forgery + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/TRENDMICRO-DDI-CSRF.txt Vendor: ==================== www.trendmicro.com Product:...

WordPress Plugin Photocart Link 1.6 - Local File Inclusion

WordPress Plugin Photocart Link 1.6 - Local File Inclusion Exploit Title: Wordpress Plugin Photocart Link - Local File Inclusion Exploit Author: CrashBandicot @DosPerl Date: 2016-03-27 Google Dork : inurl:/wp-content/plugins/photocart-link/ Vendor Homepage:...

Multiple CCTV-DVR Vendors - Remote Code Execution

Multiple CCTV-DVR Vendors - Remote Code Execution !/usr/bin/python Blog post: http://www.kerneronsec.com/2016/02/remote-code-execution-in-cctv-dvrs-of.html ''' Vendors List Ademco ATS Alarmes technolgy and ststems Area1Protection Avio Black Hawk Security Capture China security systems Cocktail...

Avira - Heap Underflow Parsing PE Section Headers

Avira - Heap Underflow Parsing PE Section Headers Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=765 One of the things you might expect an Antivirus engine to do reliably is parse PE files. However, after some simple testing with Avira, I found a heap underflow that is, writing...

Apple Mac OSX Kernel - AppleKeyStore Use-After-Free

Apple Mac OSX Kernel - AppleKeyStore Use-After-Free / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=710 The AppleKeyStore userclient uses an IOCommandGate to serialize access to its userclient methods, however by racing two threads, one of which closes the userclient which fre...

MiCollab 7.0 - SQL Injection

MiCollab 7.0 - SQL Injection ================ Exploit Title: SQL Injection Vulnerability in MiCollab v7.0 Date: 3-22-2016 Vendor Homepage: http://www.mitel.com Vendor: Mitel Software: MiCollab End User Portal Version: v7.0 Advisory:...

Adobe Flash - Uninitialized Stack Parameter Access in AsBroadcaster.broadcastMessage UaF Fix

Adobe Flash - Uninitialized Stack Parameter Access in AsBroadcaster.broadcastMessage UaF Fix Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=717 The ActionScript parameter conversion in the fix for an issue in the December Flash bulletin...

Comodo AntiVirus - Forwards Emulated API Calls to the Real API During Scans

Comodo AntiVirus - Forwards Emulated API Calls to the Real API During Scans Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=769 Comodo Antivirus includes a x86 emulator that is used to unpack and monitor obfuscated executables, this is common practice among antivirus products. T...

Apple Mac OSX Kernel - Use-After-Free and Double Delete Due to Incorrect Locking in Intel GPU Driver

Apple Mac OSX Kernel - Use-After-Free and Double Delete Due to Incorrect Locking in Intel GPU Driver / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=708 The external methods IGAccelGLContext::unmapusermemory and IGAccelCLContext::unmapusermemory take an 8 byte struct input whi...

Adobe Flash - Sprite Creation Use-After-Free

Adobe Flash - Sprite Creation Use-After-Free Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=718 There is a use-after-free in Sprite Creation. If a Sprite is created, and then the handler for the frameConstructed event triggers a remove object action, the Sprite is then used aft...

Comodo - PackMan Unpacker Insufficient Parameter Validation

Comodo - PackMan Unpacker Insufficient Parameter Validation Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=764 Packman is an obscure opensource executable packer that Comodo Antivirus attempts to unpack during scanning. The code is available online here:...

Apple Mac OSX Kernel - Unchecked Array Index Used to Read Object Pointer Then Call Virtual Method in Nvidia Geforce Driver

Apple Mac OSX Kernel - Unchecked Array Index Used to Read Object Pointer Then Call Virtual Method in Nvidia Geforce Driver / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=709 nvDevice::ReleaseDeviceTexture is external method 0x10a of userclient 5 of the geforce IOAccelerator. ...

Comodo - Integer Overlow Leading to Heap Overflow Parsing Composite Documents

Comodo - Integer Overlow Leading to Heap Overflow Parsing Composite Documents Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=762 In COleMemFile::LoadDiFatList, values from the header are used to parse the document FAT. If header.csectDif is very high, the calculation overflows...

Comodo AntiVirus - Heap Overflow in LZX Decompression

Comodo AntiVirus - Heap Overflow in LZX Decompression Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=737 LzxDecoder::init initializes the vector LzxDecoder-window to a fixed size of 2^method bytes, which is then used during LzxDecoder::Extract. It's possible for LZX compressed...

Apple Mac OSX iOS - SUID Binary Logic Error Kernel Code Execution

Apple Mac OSX iOS - SUID Binary Logic Error Kernel Code Execution Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=676 tl;dr The code responsible for loading a suid-binary following a call to the execve syscall invalidates the task port after first swapping the new vmmap into the...

Wireshark - dissect_ber_integer Static Out-of-Bounds Write

Wireshark - dissectberinteger Static Out-of-Bounds Write Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=750 The following crash due to a static memory out-of-bounds write can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to tshark "$...

Apple Mac OSX Kernel - Code Execution Due to Lack of Bounds Checking in AppleUSBPipe::Abort

Apple Mac OSX Kernel - Code Execution Due to Lack of Bounds Checking in AppleUSBPipe::Abort / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=728 External Method 36 of IOUSBInterfaceUserClient is AbortStreamPipe. It takes two scalar inputs and uses the second one as an array ind...

Adobe Flash - Uninitialized Stack Parameter Access in MovieClip.swapDepths UaF Fix

Adobe Flash - Uninitialized Stack Parameter Access in MovieClip.swapDepths UaF Fix Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=715 The ActionScript parameter conversion in the fix for issue 403 https://code.google.com/p/google-security-research/issues/detail?id=403 can...

Comodo - Integer Overflow Leading to Heap Overflow in Win32 Emulation

Comodo - Integer Overflow Leading to Heap Overflow in Win32 Emulation Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=738 A major component of Comodo Antivirus is the x86 emulator, which includes a number of shims for win32 API routines so that common API calls work in emulated...

Adobe Flash - Uninitialized Stack Parameter Access in Object.unwatch UaF Fix

Adobe Flash - Uninitialized Stack Parameter Access in Object.unwatch UaF Fix Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=716 The ActionScript parameter conversion in the fix for an issue in the December Flash bulletin...

Adobe Flash - Zlib Codec Heap Overflow

Adobe Flash - Zlib Codec Heap Overflow Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=720 There is a heap overflow in the Zlib codecs used when playing flv files in flash. Sample flv files are attached. Load http://127.0.0.1/LoadMP42.swf?file=smalloverflow.flv to reproduce. Pro...

Adobe Flash - Shape Rendering Crash

Adobe Flash - Shape Rendering Crash Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=721 The attached fuzz case causes a crash in shape rendering. Proof of Concept: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/39608.zip...