880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
46 lines
No EOL
1.9 KiB
Text
46 lines
No EOL
1.9 KiB
Text
source: https://www.securityfocus.com/bid/11968/info
|
|
|
|
CUPS is reported prone to a remote buffer overflow vulnerability. The issue is reported to exist in the 'hpgl-input.c' source file and is because of a lack of sufficient boundary checks performed on data contained in HPGL files.
|
|
|
|
A remote attacker may exploit this condition to execute arbitrary code in the context of the vulnerable CUPS daemon.
|
|
|
|
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/24977.gz
|
|
|
|
|
|
|
|
|
|
Ariel Berkman, a student in my Fall 2004 UNIX Security Holes course, has
|
|
discovered a remotely exploitable security hole in CUPS. I'm publishing
|
|
this notice, but all the discovery credits should be assigned to
|
|
Berkman.
|
|
|
|
A CUPS installation is at risk whenever it prints an HPGL file obtained
|
|
from email (or a web page or any other source that could be controlled
|
|
by an attacker). You are at risk if you print data through a CUPS
|
|
installation at risk. The source of the HPGL file has complete control
|
|
over the CUPS ``lp'' account; in particular, he can read and modify the
|
|
files you are printing.
|
|
|
|
Proof of concept: On an x86 computer running FreeBSD 4.10, as root, type
|
|
|
|
cd /usr/ports/print/cups
|
|
make install
|
|
|
|
to download and compile the CUPS package, version 1.1.22 (current).
|
|
Then, as any user, save the file 21.hpgl.gz attached to this message,
|
|
and type
|
|
|
|
gunzip 21.hpgl
|
|
/usr/local/libexec/cups/filter/hpgltops \
|
|
15 $USER test-title 1 none 21.hpgl > 21.ps
|
|
|
|
with the unauthorized result that a file named x is removed from the
|
|
current directory. (I tested this with a 541-byte environment, as
|
|
reported by printenv | wc -c.)
|
|
|
|
Here's the bug: In hpgl-input.c, ParseCommand() reads any number of
|
|
bytes into a 262144-byte buf[] array.
|
|
|
|
---D. J. Bernstein, Associate Professor, Department of Mathematics,
|
|
Statistics, and Computer Science, University of Illinois at Chicago
|
|
Source: http://securesoftware.list.cr.yp.to/archive/0/25 |