0day.today - 世界最大的漏洞利用数据库。
0day.today 用户须知:
本站管理员使用官方账号。请谨防诈骗!
- 我们唯一的域名:http://0day.today
- 我们大多数的材料都完全免费
- 如果你想购买漏洞利用 / 获取V.I.P.权限 或者使用其他付费服务,
你需要购买或者赢取金币 金币
本站管理员使用官方账号。请谨防诈骗!
We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!
Please, beware of scammers!
你可以由此方式联系我们:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
ImageMagick 6.8.8-4 - Local Buffer Overflow (SEH)
[ 0Day-ID-21901 ]
完整标题
ImageMagick 6.8.8-4 - Local Buffer Overflow (SEH)
[ 置顶 ]
置顶 - 是一项付费服务,可以使你的材料有更多访问者。
价格: 10
价格: 10
添加日期
平台
已确认
价格
免费
风险
[
安全风险级别 - 高
]Rel. releases
描述
I saw the notice for this CVE today but there was no known published expoits so
# I figured I'd put together this quick POC. Note, all app modules for the tested
# version were compiled with safeSEH so my use of an OS module may require adjustment
# of the offsets. There also appears to be several bad chars that fail the sploit.
# For this POC I only generate a basic messagebox using FatalAppExit(). It may take
# some work to get it to do more.
# I figured I'd put together this quick POC. Note, all app modules for the tested
# version were compiled with safeSEH so my use of an OS module may require adjustment
# of the offsets. There also appears to be several bad chars that fail the sploit.
# For this POC I only generate a basic messagebox using FatalAppExit(). It may take
# some work to get it to do more.
使用说明
This particular BOF takes advantage of insecure handling of the english.xml file
# which the app uses to display various error messages. I didn't spend much time
# investigating the app so there may be additional vulnerable locations
#
# This script generates two files:
# 1) a malfored .bmp file that will cause ImageMagick to generate a specific
# error when opened (LengthAndFilesizeDoNotMatch), as defined in the
# english.xml file
# 2) a modified english.xml file that replaces the original error message with
# our exploit code
#
# To test this POC:
# 1) run the script, replace the original english.xml file (in App's folder)
# 2) open the .bmp file with ImageMagick
# which the app uses to display various error messages. I didn't spend much time
# investigating the app so there may be additional vulnerable locations
#
# This script generates two files:
# 1) a malfored .bmp file that will cause ImageMagick to generate a specific
# error when opened (LengthAndFilesizeDoNotMatch), as defined in the
# english.xml file
# 2) a modified english.xml file that replaces the original error message with
# our exploit code
#
# To test this POC:
# 1) run the script, replace the original english.xml file (in App's folder)
# 2) open the .bmp file with ImageMagick
厂商
http://ftp.sunet.se/pub/multimedia/graphics/ImageMagick/binaries/
受影响的版本
ImageMagick (all versions prior to 6.8.8-5)
Tested on
Windows XP SP3
CVE
CVE-2014-1947
其他信息
投诉
0
评论
0
视角
4 382
We DO NOT use Telegram or any messengers / social networks! Please, beware of scammers!
免费
开放此漏洞利用
你可以免费开放此漏洞利用的代码
你可以免费开放此漏洞利用的代码
[ 评论: 0 ]
评论须知:
- 用户不得在此交换个人联系方式
- 禁止在此谈论其它网站/项目的交易价格
- 禁止转售
登录或注册后即可发表评论
登录或注册后即可发表评论