MS15-100 is a vulnerability in Windows Media Center which allows an attacker to execute arbitrary commands on the target system. The vulnerability is caused due to the application not properly validating user-supplied input. An attacker can exploit this vulnerability by crafting a malicious Music.mcl file and sending it to the target user. When the target user opens the malicious Music.mcl file, the attacker's arbitrary command will be executed on the target system.
No CSRF token exists when making some POST requests, allowing arbitrary deletion of files on the monstaftp server dirs. Monstaftp sanitizes most $_GET requests with call to sanitizeStr() e.g --> echo sanitizeStr($ftp_host), However we find vulnerable code that is not santized on line 494 of index.php ---> echo $_GET["openFolder"]; creating an XSS entry point and will execute when victim accesses the Monstaftp login page before logging in.
The Webcam Logitech registration .ini file is vulnerable to a unicode SEH based buffer overflow.
By sending a crafted packet, an attacker may cause the OpenLDAP server to reach an assert() statement, crashing the daemon. This was tested on OpenLDAP 2.4.42 (built with GCC 4.9.2) and OpenLDAP 2.4.40 installed from the Debian package repository. By sending a crafted packet, an attacker can cause the OpenLDAP daemon to crash with a SIGABRT. This is due to an assert() call within the ber_get_next method (io.c line 682) that is hit when decoding tampered BER data.
The private Install.framework has a few helper executables in /System/Library/PrivateFrameworks/Install.framework/Resources, one of which is suid root. Taking a look at it, it can be seen that it's vending an objective-c Distributed Object. The main function immediately temporarily drops privs doing seteuid(getuid()); setegid(getgid()); then reads line from stdin. It passes this to NSConnection rootProxyForConnectionWithRegisteredName to lookup that name in the DO namespace and create a proxy to connect to it via. It then allocates an IFInstallRunner which in its init method vends itself using a name made up of its pid, time() and random(). It then calls the setRunnerConnectionName method on the proxy to tell it the IFInstallRunner's DO name so that whoever ran the runner can connect to the IFInstallRunner. The IFRunnerMessaging protocol tells us the methods and prototypes of the remote methods we can invoke on the IFInstallRunner. Most of the methods begin with a call to processKey which will set the euid back to root if the process can provide a valid admin authorization reference from authd. Otherwise the euid will remain equal to the uid and the methods (like movePath, touchPath etc) will only run with the privs of the user. The methods then mostly end with a call to restoreUIDs which will drop back to euid==uid if we did temporarily regain root privs (with the auth ref). Not all methods we can invoke are like that though. IFInstallRunner setExternalAuthorizationRef calls seteuid(0);setegid(0); to regain root privs without requiring any auth. It then calls AuthorizationCreateFromExternalForm passing the bytes of an NSData we give it. This means that if we can craft an auth ref that authd will accept, we can gain root privs.
Install.framework has a suid root binary which can be used to create arbitrary directories, chown files to root:admin and unlink files. This can be done by creating a couple of custom classes and overriding various selectors and failing at the right points.
Octogate UTM Device is managed via web interface. The download function for SSL-Certifcate and Documentation is accessable without authentication, and allows access to files outside of the web root via the script /scripts/download.php.
It was discovered that Synology Video Station is vulnerable to command injection that allows an attacker to execute arbitrary system commands with root privileges. In addition, Video Station is affected by multiple SQL injection vulnerabilities that allows for execution of arbitrary SQL statements with DBA privileges. As a result it is possible to compromise the PostgreSQL database server.
This paper discusses a vulnerability in the PHP interpreter that allows attackers to bypass the disable_functions directive. The vulnerability is caused by the fact that the Zend_Executor_Globals structure contains a pointer to the current opcode array, which can be modified by an attacker. This allows attackers to execute arbitrary code, even if the disable_functions directive is enabled.
Multiple use-after-free vulnerabilities were discovered in unserialize() with Serializable class that can be abused for leaking arbitrary memory blocks or execute arbitrary code remotely.
Services By CQR