CVE-2017-1258
published 2017-07-05CVE-2017-1258: IBM Security Guardium 10.0 and 10.1 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to…
PriorityP430medium6.5CVSS 3.0
AVNACLPRNUINSUCLILAN
EPSS
1.13%
62.8th percentile
IBM Security Guardium 10.0 and 10.1 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas. IBM X-Force ID: 124685
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | security_guardium | — | — |
| ibm | security_guardium | — | — |
| ibm | security_guardium | — | — |
| ibm | security_guardium | — | — |
CVSS provenance
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Microsoft MsMpEng - Remote Use-After-Free Due to Design Issue in GC Engine
exploitdb·2017-05-30
CVE-2017-8540 Microsoft MsMpEng - Remote Use-After-Free Due to Design Issue in GC Engine
Microsoft MsMpEng - Remote Use-After-Free Due to Design Issue in GC Engine
---
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1258
MsMpEng's JS engine uses garbage collection to manage the lifetime of Javascript objects.
During mark and sweep the GC roots the vectors representing the JS stack as well as a few other hardcoded objects, traversing reachable objects from those roots then frees any unreachable objects. The native stack is *not* marked therefore any native code which is using JsObject pointers needs to take care to ensure that either the objects will remain reachable or that a GC cannot occur.
MsMpEng's JS engine supports script defining toString and valueOf methods on objects which will be invoked when the native code attempts to convert JsObjects to str
Exploit-DB
Microsoft MsMpEng - Use-After-Free via Saved Callers
exploitdb·2017-05-30
CVE-2017-8541 Microsoft MsMpEng - Use-After-Free via Saved Callers
Microsoft MsMpEng - Use-After-Free via Saved Callers
---
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1259
In JsRuntimeState::setCaller, it saves the current caller in the JsRuntimeState object(rcx+158h in 64-bit). But the garbage collector doesn't mark this saved value. So it results in a UAF.
Unlike in our test environment(Linux), it doesn't make reliable crashes on Windows. So I used another bug(#1258) to confirm the bug. If the UAF bug doesn't exist, the "crash" function will not be called(See poc.js).
The password of the zip file is "calleruaf"
Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42092.zip
No writeups or analysis indexed.
http://www.ibm.com/support/docview.wss?uid=swg22004309http://www.securityfocus.com/bid/99377https://exchange.xforce.ibmcloud.com/vulnerabilities/124685http://www.ibm.com/support/docview.wss?uid=swg22004309http://www.securityfocus.com/bid/99377https://exchange.xforce.ibmcloud.com/vulnerabilities/124685
2017-07-05
Published