Writeup Exploits

CVE-2012-2330 WRITEUP

Node.js <0.6.17 & <0.7.8 - Info Disclosure

The Update method in src/node_http_parser.cc in Node.js before 0.6.17 and 0.7 before 0.7.8 does not properly check the length of a string, which allows remote attackers to obtain sensitive information (request header contents) and possibly spoof HTTP headers via a zero length string.

View

CVE-2012-2385 WRITEUP

mosh < 1.2.1 - Authenticated Denial of Service via Escape Sequence with Large Repeat Count

The terminal dispatcher in mosh before 1.2.1 allows remote authenticated users to cause a denial of service (long loop and CPU consumption) via an escape sequence with a large repeat count value.

View

CVE-2012-2654 WRITEUP

OpenStack Compute - Privilege Escalation

The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) do not properly check the protocol when security groups are created and the network protocol is not specified entirely in lowercase, which allows remote attackers to bypass intended access restrictions.

View

CVE-2012-2671 WRITEUP

Rack::Cache 0.3.0-1.1 - Sensitive Header Caching

The Rack::Cache rubygem 0.3.0 through 1.1 caches Set-Cookie and other sensitive headers, which allows attackers to obtain sensitive cookie information, hijack web sessions, or have other unspecified impact by accessing the cache.

View

CVE-2012-2673 WRITEUP

Boehm-Demers-Weiser GC <7.2 - Memory Corruption

Multiple integer overflows in the (1) GC_generic_malloc and (2) calloc functions in malloc.c, and the (3) GC_generic_malloc_ignore_off_page function in mallocx.c in Boehm-Demers-Weiser GC (libgc) before 7.2 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected.

View

CVE-2012-2675 WRITEUP

nedmalloc <1.10 beta2 - Memory Corruption

Multiple integer overflows in the (1) CallMalloc (malloc) and (2) nedpcalloc (calloc) functions in nedmalloc (nedmalloc.c) before 1.10 beta2 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected.

View

CVE-2012-2691 WRITEUP

MantisBT <1.2.11 - Privilege Escalation

The mc_issue_note_update function in the SOAP API in MantisBT before 1.2.11 does not properly check privileges, which allows remote attackers with bug reporting privileges to edit arbitrary bugnotes via a SOAP request.

View

CVE-2012-2760 WRITEUP

mod_auth_openid <0.7 - Info Disclosure

mod_auth_openid before 0.7 for Apache uses world-readable permissions for /tmp/mod_auth_openid.db, which allows local users to obtain session ids.

View

CVE-2012-3360 WRITEUP

OpenStack Compute (Nova) Essex and Folsom - Authenticated Path Traversal via Disk Image File Path Attribute

Directory traversal vulnerability in virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2) and Essex (2012.1), when used over libvirt-based hypervisors, allows remote authenticated users to write arbitrary files to the disk image via a .. (dot dot) in the path attribute of a file element.

View

CVE-2012-3361 WRITEUP

OpenStack Compute (Nova) Diablo Essex Folsom - Authenticated Arbitrary File Write via Symlink Attack

virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image.

View

CVE-2012-3375 WRITEUP

Linux Kernel < 3.2.24 - Denial of Service via EPOLL_CTL_ADD Circular Dependency

The epoll_ctl system call in fs/eventpoll.c in the Linux kernel before 3.2.24 does not properly handle ELOOP errors in EPOLL_CTL_ADD operations, which allows local users to cause a denial of service (file-descriptor consumption and system crash) via a crafted application that attempts to create a circular epoll dependency. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1083.

View

CVE-2012-3400 WRITEUP

Linux Kernel < 3.4.5 - Heap-Based Buffer Overflow in UDF Filesystem Handling

Heap-based buffer overflow in the udf_load_logicalvol function in fs/udf/super.c in the Linux kernel before 3.4.5 allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted UDF filesystem.

View

CVE-2012-3426 WRITEUP

OpenStack Keystone < 2012.1.1 - Authenticated Token Expiration Bypass via Token Chaining

OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before Folsom-1 and OpenStack Essex, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by (1) creating new tokens through token chaining, (2) leveraging possession of a token for a disabled user account, or (3) leveraging possession of a token for an account with a changed password.

View

CVE-2012-3430 WRITEUP

Linux Kernel < 3.0.44 - Information Exposure via Uninitialized Structure in RDS recvmsg

The rds_recvmsg function in net/rds/recv.c in the Linux kernel before 3.0.44 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a (1) recvfrom or (2) recvmsg system call on an RDS socket.

View

CVE-2012-3447 WRITEUP

OpenStack Nova 2012.1.x < 2012.1.2 and Folsom < Folsom-3 - Authenticated Arbitrary File Overwrite via Symlink Attack

virt/disk/api.py in OpenStack Compute (Nova) 2012.1.x before 2012.1.2 and Folsom before Folsom-3 allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image that uses a symlink that is only readable by root. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3361.

View

CVE-2012-3468 WRITEUP

Ushahidi Platform < 2.5 - SQL Injection via Alerts Verify, Settings Save, or Timeline Media Type

Multiple SQL injection vulnerabilities in the Ushahidi Platform before 2.5 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) the verify function in application/controllers/alerts.php, (2) the save_all function in application/models/settings.php, or (3) the media type to the timeline function in application/controllers/json.php.

View

CVE-2012-3469 WRITEUP

Ushahidi Platform < 2.5 - SQL Injection via Messages Admin or Location API

Multiple SQL injection vulnerabilities in the Ushahidi Platform before 2.5 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) the messages admin functionality in application/controllers/admin/messages.php, (2) application/libraries/api/MY_Checkin_Api_Object.php, (3) application/controllers/admin/messages/reporters.php, or (4) the location API in application/libraries/api/MY_Locations_Api_Object.php and application/models/location.php.

View

CVE-2012-3473 WRITEUP

Ushahidi Platform < 2.5 - Unauthenticated Report Creation and Comment Organization via API

The (1) reports API and (2) administration feature in the comments API in the Ushahidi Platform before 2.5 do not require authentication, which allows remote attackers to generate reports and organize comments via API functions.

View

CVE-2012-3475 WRITEUP

Ushahidi Platform <2.5 - Privilege Escalation

The installer in the Ushahidi Platform before 2.5 omits certain calls to the exit function, which allows remote attackers to obtain administrative privileges via unspecified vectors.

View

CVE-2012-3537 WRITEUP

Dell Crowbar < 1.4 - Local Arbitrary Command Execution via Insecure Temporary File Handling

The Crowbar Ohai plugin (chef/cookbooks/ohai/files/default/plugins/crowbar.rb) in the Deployer Barclamp in Crowbar, possibly 1.4 and earlier, allows local users to execute arbitrary shell commands via vectors related to "insecure handling of tmp files" and predictable file names.

View

CVE-2012-3542 WRITEUP

OpenStack Keystone < 2012.1 - Unauthenticated User Addition to Arbitrary Tenant via Default Tenant Update

OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to the administrative API. NOTE: this identifier was originally incorrectly assigned to an open redirect issue, but the correct identifier for that issue is CVE-2012-3540.

View

CVE-2012-3551 WRITEUP

Dell Crowbar < 1.4 - Cross-Site Scripting via File Parameter

Cross-site scripting (XSS) vulnerability in crowbar_framework/app/views/support/index.html.haml in the Crowbar barclamp in Crowbar, possibly 1.4 and earlier, allows remote attackers to inject arbitrary web script or HTML via the file parameter to /utils.

View

CVE-2012-3830 WRITEUP

Decoda < 3.3.3 - Cross-Site Scripting via Video Directive

Cross-site scripting (XSS) vulnerability in decoda/templates/video.php in Decoda before 3.3.3 allows remote attackers to inject arbitrary web script or HTML via the video directive.

View

CVE-2012-3831 WRITEUP

milesj/decoda < 3.3 - Cross-Site Scripting via img Tag URL

Cross-site scripting (XSS) vulnerability in decoda/templates/video.php in Decoda before 3.3.1 allows remote attackers to inject arbitrary web script or HTML via multiple URLs in an img tag.

View

CVE-2012-3839 WRITEUP

MyClientBase 0.12 - SQL Injection via Invoice Search Parameters

Multiple SQL injection vulnerabilities in application/core/MY_Model.php in MyClientBase 0.12 allow remote attackers to execute arbitrary SQL commands via the (1) invoice_number or (2) tags parameter to index.php/invoice_search.

View