DiskBoss Enterprise v7.8.16 is vulnerable to a buffer overflow vulnerability in the 'Import Command' feature. An attacker can exploit this vulnerability by sending a specially crafted XML file to the application, which can lead to arbitrary code execution. The vulnerability is caused due to a boundary error when handling user-supplied data, which can be exploited to cause a stack-based buffer overflow by sending an overly long string in the 'name' parameter of the 'classify' element.
DiskSorter Enterprise 9.5.12 is vulnerable to a buffer overflow vulnerability in the 'Import Command' feature. An attacker can exploit this vulnerability by sending a specially crafted XML file to the application, which can lead to arbitrary code execution. This vulnerability was discovered by Daniel Teixeira and affects version 9.5.12 of the software.
Ubuntu Vivid 1504 (development branch) installs an insecure upstart logrotation script which will read user-supplied data from /run/user/[uid]/upstart/sessions and pass then unsanitized to an env command. As user run directory is user-writable, the user may inject arbitrary commands into the logrotation script, which will be executed during daily cron job execution around midnight with root privileges.
The cronjob script bundled with ntp package is intended to perform cleanup on statistics files produced by NTP daemon running with statistics enabled. The script is run as root during the daily cronjobs all operations on the ntp-user controlled statistics directory without switching to user ntp. Thus all steps are performed with root permissions in place. Due to multiple bugs in the script, a malicious ntp user can make the backup process to overwrite arbitrary files with content controlled by the attacker, thus gaining root privileges. The attacker can pass arbitrary command line options to gzip, which will be executed as root.
Linux user namespace allows to mount file systems as normal user, including the overlayfs. As many of those features were not designed with namespaces in mind, this increase the attack surface of the Linux kernel interface. Overlayfs was intended to allow create writeable filesystems when running on readonly medias, e.g. on a live-CD. In such scenario, the lower filesystem contains the read-only data from the medium, the upper filesystem part is mixed with the lower part. This mixture is then presented as an overlayfs at a given mount point. When writing to this overlayfs, the write will only modify the data in upper, which may reside on a tmpfs for that purpose. Due to inheritance of Posix ACL information (xattrs) when copying up overlayfs files and not cleaning those additional and unintended ACL attribues, SGID directories may become user writable, thus allowing to gain privileges of this group using methods described in SetgidDirectoryPrivilegeEscalation.
Aufs is a union filesystem to mix content of different underlying filesystems, e.g. read-only medium with r/w RAM-fs. Due to different bugs, aufs in a crafted USERNS allows privilege escalation, which is a problem on systems enabling unprivileged USERNS by default, e.g. Ubuntu Wily. The basic exploitation sequence is: mount fuse filesystem exposing crafted SUID binary, create USERNS, mount aufs on top of fuse, execute the SUID binary via aufs from outside the namespace.
With Ubuntu Wily and earlier, /usr/lib/pt_chown was used to change ownership of slave pts devices in /dev/pts to the same uid holding the master file descriptor for the slave. This is done using the pt_chown SUID binary, which invokes the ptsname function on the master-fd, thus again performing a TIOCGPTN ioctl to get the slave pts number. Using the result from the ioctl, the pathname of the slave pts is constructed and chown invoked on it. Exploitation is trivial: At first use any user namespace demo to create the namespace needed, e.g. UserNamespaceExec.c and work with standard shell commands, e.g. to take over /dev/pts/0.
An unauthenticated attacker can inject malicious SQL queries into the vulnerable parameter 'keyword' of the 'advance_result.php' script. This can be used to extract sensitive information from the database such as the 'd_hotlisting', 'adm_id', 'adm_username', 'adm_password', 'adm_lastvisit' and 'c_id' fields.
When an email containing a specific CSS code is sent to someone, when they just read the email, Outlook will crash. The PoC could be as simple as the following, or you may download the .eml file. The CSS code '<style>body{display:none !important;}</style>' is important here. If it is removed, Outlook won't crash.
A buffer overflow vulnerability exists in VX Search Enterprise v9.5.12 when sending an overly long string to the email verify function. An attacker can exploit this vulnerability to execute arbitrary code in the context of the application. The vulnerability is due to a boundary error when handling user-supplied input. A remote attacker can send a specially crafted request to the vulnerable application and execute arbitrary code in the context of the application.
Services By CQR