exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 25 of 42 RSS Feed

Files

Avian JVM 1.2.0 Silent Return
Posted Aug 12, 2020
Authored by Pietro Oliva

Avian JVM version 1.2.0 suffers from a silent return issue in the vm::arrayCopy method defined in classpath-common.h, where multiple boundary checks are performed to prevent out-of-bounds memory read/write. One of these boundary checks makes the code return silently when a negative length is provided instead of throwing an exception.

tags | exploit
advisories | CVE-2020-17361
SHA-256 | 53ead956cdf9e9e2c075fcdfff1ae5c760e139f9927afb026cac0d5b93cd5921

Related Files

SimpleRmiDiscoverer 0.1
Posted Jan 5, 2023
Authored by Marcin Wolak | Site github.com

SimpleRmiDiscoverer is a JMX RMI scanning tool for unsecured (without enabled authentication) instances of JAVA JMX. It does not use standard Java RMI/JMX classes like other available tools but rather communicates directly over TCP. The tool is written in Java and is very useful in red teaming operations because JVM is still ubiquitous in corporate environments. It can be executed by unprivileged (non-admin) users.

tags | tool, java, scanner, tcp
systems | unix
SHA-256 | 93daab8314c5a134f408dc5214f71dbb47eac17e499aa7e761104430bd8a7f8f
Red Hat Security Advisory 2022-0289-04
Posted Jan 27, 2022
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2022-0289-04 - Parfait is a Java performance monitoring library that collects metrics and exposes them through a variety of outputs. It provides APIs for extracting performance metrics from the JVM and other sources. It interfaces to Performance Co-Pilot using the Memory Mapped Value machinery for extremely lightweight instrumentation. Issues addressed include code execution, deserialization, and remote SQL injection vulnerabilities.

tags | advisory, java, remote, vulnerability, code execution, sql injection
systems | linux, redhat
advisories | CVE-2021-4104, CVE-2022-23302, CVE-2022-23305, CVE-2022-23307
SHA-256 | 9931203266878ec8ee0138ce4ab9109c2e39e27123382c3d49f5ec1c89c67e73
Red Hat Security Advisory 2022-0291-04
Posted Jan 27, 2022
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2022-0291-04 - Parfait is a Java performance monitoring library that collects metrics and exposes them through a variety of outputs. It provides APIs for extracting performance metrics from the JVM and other sources. It interfaces to Performance Co-Pilot using the Memory Mapped Value machinery for extremely lightweight instrumentation. Issues addressed include code execution, deserialization, and remote SQL injection vulnerabilities.

tags | advisory, java, remote, vulnerability, code execution, sql injection
systems | linux, redhat
advisories | CVE-2021-4104, CVE-2022-23302, CVE-2022-23305, CVE-2022-23307
SHA-256 | 02ce2dbca92af00639ffd0a1459648d387e54641e74941836f669d57f9916b7d
Red Hat Security Advisory 2022-0294-04
Posted Jan 27, 2022
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2022-0294-04 - Parfait is a Java performance monitoring library that collects metrics and exposes them through a variety of outputs. It provides APIs for extracting performance metrics from the JVM and other sources. It interfaces to Performance Co-Pilot using the Memory Mapped Value machinery for extremely lightweight instrumentation. Issues addressed include code execution, deserialization, and remote SQL injection vulnerabilities.

tags | advisory, java, remote, vulnerability, code execution, sql injection
systems | linux, redhat
advisories | CVE-2021-4104, CVE-2022-23302, CVE-2022-23305, CVE-2022-23307
SHA-256 | 8e75915778ce7907c6f34b783320b348d93585f68aeae5b3c5f559dde068a203
Red Hat Security Advisory 2022-0290-06
Posted Jan 27, 2022
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2022-0290-06 - Parfait is a Java performance monitoring library that collects metrics and exposes them through a variety of outputs. It provides APIs for extracting performance metrics from the JVM and other sources. It interfaces to Performance Co-Pilot using the Memory Mapped Value machinery for extremely lightweight instrumentation. Issues addressed include code execution, deserialization, and remote SQL injection vulnerabilities.

tags | advisory, java, remote, vulnerability, code execution, sql injection
systems | linux, redhat
advisories | CVE-2021-4104, CVE-2022-23302, CVE-2022-23305, CVE-2022-23307
SHA-256 | d3a9b327c1f6a6ac05a0921a4108fd9f13b7467642217aa8fbad5007566759f3
Log4j Recognizer
Posted Dec 15, 2021
Authored by scitotec | Site github.com

This utility looks for log4j in the currently running JVM. It is useful for systems that allow plugins to introduce their own jars. Therefore, you can find if someone is using log4j with a dangerous version.

tags | tool, java
systems | unix
advisories | CVE-2021-44228
SHA-256 | f3e9c324df46c5349054a5e341c715ffbb5f3a49b2dcb09981741f4aa2e019e7
ReadyTalk Avian JVM FileOutputStream.write() Integer Overflow
Posted Nov 13, 2020
Authored by Pietro Oliva

ReadyTalk Avian JVM versions 1.2.0 before 27th October 2020 suffer from a FileOutputStream.write() integer overflow vulnerability.

tags | exploit, overflow
SHA-256 | 6900d0810f32c7a4085388df479ec9c677eafb362f0ace4123fc2d63eacfd040
Avian JVM 1.2.0 Integer Overflow
Posted Aug 12, 2020
Authored by Pietro Oliva

Avian JVM version 1.2.0 suffers from multiple vm::arrayCopy() integer overflow vulnerabilities.

tags | exploit, overflow, vulnerability
advisories | CVE-2020-17360
SHA-256 | f95c4205b8ecd4cf340fed2f7ac5947cbf815565adc1c0184abd2d90668c51dc
Ubuntu Security Notice USN-3613-1
Posted Apr 2, 2018
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3613-1 - It was discovered that a race condition existed in the cryptography implementation in OpenJDK. An attacker could possibly use this to expose sensitive information. It was discovered that the Hotspot component of OpenJDK did not properly validate uses of the invokeinterface JVM instruction. An attacker could possibly use this to access unauthorized resources. It was discovered that the LDAP implementation in OpenJDK did not properly encode login names. A remote attacker could possibly use this to expose sensitive information. Various other issues were also addressed.

tags | advisory, remote
systems | linux, ubuntu
advisories | CVE-2018-2579, CVE-2018-2582, CVE-2018-2588, CVE-2018-2599, CVE-2018-2602, CVE-2018-2603, CVE-2018-2618, CVE-2018-2629, CVE-2018-2633, CVE-2018-2634, CVE-2018-2637, CVE-2018-2641, CVE-2018-2663, CVE-2018-2677, CVE-2018-2678
SHA-256 | 928013bd5e1ee1d64cc4573070b7f35cde515ccf144ffe9f8098bc389a7993d3
ElasticSearch Snapshot API Directory Traversal
Posted Oct 14, 2015
Authored by Pedro Andujar, Roberto S. Soares, Jose A. Guasch, Benjamin Smith | Site metasploit.com

This Metasploit module exploits a directory traversal vulnerability in ElasticSearch, allowing an attacker to read arbitrary files with JVM process privileges, through the Snapshot API.

tags | exploit, arbitrary
advisories | CVE-2015-5531
SHA-256 | 9e9a04cf21f31c1319caa6af694dd744146d5b671a3f719be244d3e2a6ee6426
Elasticsearch Directory Traversal
Posted Jul 17, 2015
Authored by Kevin Kluge

Elasticsearch versions from 1.0.0 to 1.6.0 are vulnerable to a directory traversal attack that allows an attacker to retrieve files that are readable by the Elasticsearch JVM process.

tags | advisory, file inclusion
advisories | CVE-2015-5531
SHA-256 | b31e33f0be2db96a5fdb079e65aaf1b8bd17143da9e03e617b58e897d6aa2937
Red Hat Security Advisory 2015-1052-01
Posted Jun 4, 2015
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2015-1052-01 - Thermostat is a monitoring and instrumentation tool for the OpenJDK HotSpot Java Virtual Machine with support for monitoring multiple JVM instances. A pluggable agent and GUI framework allow users to collect and visualize performance data beyond what is included out of the box. The thermostat1 packages have been upgraded to upstream version 1.2.0, which provides a number of bug fixes and enhancements over the previous version.

tags | advisory, java
systems | linux, redhat
advisories | CVE-2015-3201
SHA-256 | 96baedde8efeaaf2e6afd0dcb8a95bbdbbeeb52213e7566166d882bc79235547
Red Hat Security Advisory 2014-2000-01
Posted Dec 16, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-2000-01 - Thermostat is a monitoring and instrumentation tool for the OpenJDK HotSpot Java Virtual Machine with support for monitoring multiple JVM instances. It was discovered that, in certain configurations, the Thermostat agent disclosed JMX management URLs of all local Java virtual machines to any local user. A local, unprivileged user could use this flaw to escalate their privileges on the system. This issue was discovered by Elliott Baron of Red Hat.

tags | advisory, java, local
systems | linux, redhat
advisories | CVE-2014-8120
SHA-256 | aeca17094bb56abecbd3f12a0b0b346a3d837163e0c5bf0e8cd9cb1cd587566e
Red Hat Security Advisory 2014-1082-01
Posted Aug 20, 2014
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-1082-01 - Thermostat is a monitoring and instrumentation tool for the OpenJDK HotSpot Java Virtual Machine with support for monitoring multiple JVM instances. The httpcomponents-client package provides an HTTP agent implementation that is used by Thermostat to visualize collected data in an HTTP-aware client application. It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server hostname matches the domain name in a subject's Common Name field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.

tags | advisory, java, web, spoof
systems | linux, redhat
advisories | CVE-2012-6153, CVE-2014-3577
SHA-256 | bfae5fc3bb60d3716504aa9437504ce45b829444527176b89c73d86eb3a68576
Sun Java Web Start Double Quote Injection
Posted Jun 13, 2013
Authored by Rh0 | Site metasploit.com

This Metasploit module exploits a flaw in the Web Start component of the Sun Java Runtime Environment. Parameters intial-heap-size and max-heap-size in a JNLP file can contain a double quote which is not properly sanitized when creating the command line for javaw.exe. This allows the injection of the -XXaltjvm option to load a jvm.dll from a remote UNC path into the java process. Thus an attacker can execute arbitrary code in the context of a browser user. This flaw was fixed in Oct. 2012 and affects JRE <= 1.6.35 and <= 1.7.07. In order for this module to work, it must be ran as root on a server that does not serve SMB. Additionally, the target host must have the WebClient service (WebDAV Mini-Redirector) enabled. Alternatively an UNC path containing a jvm.dll can be specified with an own SMB server.

tags | exploit, java, remote, web, arbitrary, root
advisories | CVE-2012-1533, OSVDB-86348
SHA-256 | 03e81d85cf7b77c63f98b9875e24d7c92e3dd03261f33f78773cc25fedd945f5
Sun Java Web Start Double Quote Injection
Posted Jun 10, 2013
Authored by Rh0 | Site metasploit.com

This Metasploit module exploits a flaw in the Web Start component of the Sun Java Runtime Environment. Parameters intial-heap-size and max-heap-size in a JNLP file can contain a double quote which is not properly sanitized when creating the command line for javaw.exe. This allows the injection of the -XXaltjvm option to load a jvm.dll from a remote UNC path into the java process. Thus an attacker can execute arbitrary code in the context of a browser user. This flaw was fixed in Oct. 2012 and affects JRE <= 1.6.35 and <= 1.7.07. In order for this module to work, it must be ran as root on a server that does not serve SMB. Additionally, the target host must have the WebClient service (WebDAV Mini-Redirector) enabled. Alternatively an UNC path containing a jvm.dll can be specified with an own SMB server.

tags | exploit, java, remote, web, arbitrary, root
advisories | CVE-2012-1533
SHA-256 | 7c4106b8276c9c6b588b2cdcba693eefaab7d0e2605a82a0728828840ed79442
Mandriva Linux Security Advisory 2013-021
Posted Mar 8, 2013
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2013-021 - Multiple security issues were identified and fixed in OpenJDK. The 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code or cause a denial of service via vectors that trigger a write of arbitrary memory in the JVM, as exploited in the wild in February 2013. Unspecified vulnerability in the 2D component in the Java Runtime Environment component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2013-1493. The updated packages provides icedtea6-1.11.9 which is not vulnerable to these issues.

tags | advisory, java, remote, denial of service, arbitrary
systems | linux, mandriva
advisories | CVE-2013-0809, CVE-2013-1493
SHA-256 | 5b454321a55eb475ee4170f49c5dd25c68794fe01d96b8252b64fbb67b52fb24
Red Hat Security Advisory 2012-1577-01
Posted Dec 18, 2012
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2012-1577-01 - IBM J2SE version 1.4.2 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. As of October 1 2012, IBM J2SE 1.4.2 is no longer supported for use with SAP products. All SAP users should migrate to SAP JVM 4 provided by SAP as the only supported Java Virtual Machine. Refer to "SAP Note 1495160 - SAP JVM replacement for Partner JDKs 1.4.2" for additional details. These java-1.4.2-ibm-sap packages provide the last SAP certified IBM J2SE 1.4.2 release, SR13-FP13.

tags | advisory, java
systems | linux, redhat
SHA-256 | a43700d6ba0bc0574467857824d4435add3e4282a47fc4dc060447e3c6ab3d02
Ubuntu Security Notice USN-1505-1
Posted Jul 13, 2012
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1505-1 - It was discovered that multiple flaws existed in the CORBA (Common Object Request Broker Architecture) implementation in OpenJDK. An attacker could create a Java application or applet that used these flaws to bypass Java sandbox restrictions or modify immutable object data. It was discovered that multiple flaws existed in the OpenJDK font manager's layout lookup implementation. A attacker could specially craft a font file that could cause a denial of service through crashing the JVM (Java Virtual Machine) or possibly execute arbitrary code. Various other issues were also addressed.

tags | advisory, java, denial of service, arbitrary
systems | linux, ubuntu
advisories | CVE-2012-1713, CVE-2012-1716, CVE-2012-1717, CVE-2012-1718, CVE-2012-1724, CVE-2012-1711, CVE-2012-1713, CVE-2012-1716, CVE-2012-1717, CVE-2012-1718, CVE-2012-1719, CVE-2012-1723, CVE-2012-1724, CVE-2012-1725
SHA-256 | d9174e9a4ed57d8cbb518a50151cad98d40855786e4a1d98cef9256e2cf24668
Sun Java Web Start Plugin Command Line Argument Injection (2012)
Posted Feb 24, 2012
Authored by jduck | Site metasploit.com

This Metasploit module exploits a flaw in the Web Start component of the Sun Java Runtime Environment. The arguments passed to Java Web Start are not properly validated, allowing injection of arbitrary arguments to the JVM. By utilizing the lesser known -J option, an attacker can take advantage of the -XXaltjvm option, as discussed previously by Ruben Santamarta. This method allows an attacker to execute arbitrary code in the context of an unsuspecting browser user. In order for this module to work, it must be ran as root on a server that does not serve SMB. Additionally, the target host must have the WebClient service (WebDAV Mini-Redirector) enabled.

tags | exploit, java, web, arbitrary, root
advisories | CVE-2012-0500, OSVDB-79227
SHA-256 | 81161207244c8e7484b4277932284c0018d20eb38ceb3a2c62bd1e994ede6a05
java.util.zip Denial Of Service
Posted Feb 17, 2012
Authored by Timo Warns | Site pre-cert.de

PRE-CERT Security Advisory - The function countCENHeaders() in zip_util.c of the java.util.zip implementation contains an off-by-one bug. The bug can be exploited via corrupted ZIP files to cause an endless recursion. The endless recursion results in a segmentation fault of the JVM. Oracle Java SE and IcedTea6 have multiple affected versions.

tags | advisory, java
advisories | CVE-2012-0501
SHA-256 | b5f37a7f307a6f81bd2dc8df66689823d138dc57ed9df9c9fb504453144b4fc0
Zend Server Java Bridge Arbitrary Java Code Execution
Posted Apr 6, 2011
Authored by bannedit | Site metasploit.com

This Metasploit module takes advantage of a trust relationship issue within the Zend Server Java Bridge. The Java Bridge is responsible for handling interactions between PHP and Java code within Zend Server. When Java code is encountered Zend Server communicates with the Java Bridge. The Java Bridge then handles the java code and creates the objects within the Java Virtual Machine. This interaction however, does not require any sort of authentication. This leaves the JVM wide open to remote attackers. Sending specially crafted data to the Java Bridge results in the execution of arbitrary java code.

tags | exploit, java, remote, arbitrary, php
advisories | OSVDB-71420
SHA-256 | 0b7ab4865dc9886b7d46ce4b5433ed01d7157a9568397fc5d7d07dd4d712244f
Ubuntu Security Notice USN-1079-3
Posted Mar 18, 2011
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1079-3 - USN-1079-2 fixed vulnerabilities in OpenJDK 6 for armel (ARM) architectures in Ubuntu 9.10 and Ubuntu 10.04 LTS. This update fixes vulnerabilities in OpenJDK 6 for armel (ARM) architectures for Ubuntu 10.10. It was discovered that untrusted Java applets could create domain name resolution cache entries, allowing an attacker to manipulate name resolution within the JVM. It was discovered that the Java launcher did not did not properly setup the LD_LIBRARY_PATH environment variable. A local attacker could exploit this to execute arbitrary code as the user invoking the program. It was discovered that within the Swing library, forged timer events could allow bypass of SecurityManager checks. This could allow an attacker to access restricted resources. It was discovered that certain bytecode combinations confused memory management within the HotSpot JVM. This could allow an attacker to cause a denial of service through an application crash or possibly inject code. It was discovered that the way JAXP components were handled allowed them to be manipulated by untrusted applets. An attacker could use this to bypass XML processing restrictions and elevate privileges. It was discovered that the Java2D subcomponent, when processing broken CFF fonts could leak system properties. It was discovered that a flaw in the XML Digital Signature component could allow an attacker to cause untrusted code to replace the XML Digital Signature Transform or C14N algorithm implementations. Konstantin PreiBer and others discovered that specific double literals were improperly handled, allowing a remote attacker to cause a denial of service. It was discovered that the JNLPClassLoader class when handling multiple signatures allowed remote attackers to gain privileges due to the assignment of an inappropriate security descriptor.

tags | advisory, java, remote, denial of service, arbitrary, local, vulnerability
systems | linux, ubuntu
advisories | CVE-2010-4448, CVE-2010-4450, CVE-2010-4465, CVE-2010-4469, CVE-2010-4470, CVE-2010-4471, CVE-2010-4472, CVE-2010-4476, CVE-2011-0706
SHA-256 | c33a79c9cbb271d022cc60d25b2598bc554e7e817f3e003bca02dabf306d9ac9
Ubuntu Security Notice USN-1079-2
Posted Mar 15, 2011
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1079-2 - USN-1079-1 fixed vulnerabilities in OpenJDK 6 for non-armel (ARM) architectures. This update provides the corresponding updates for OpenJDK 6 for use with the armel (ARM) architectures. Multiple openjdk-6 vulnerabilities have been addressed. It was discovered that untrusted Java applets could create domain name resolution cache entries, allowing an attacker to manipulate name resolution within the JVM. It was discovered that the Java launcher did not did not properly setup the LD_LIBRARY_PATH environment variable. A local attacker could exploit this to execute arbitrary code as the user invoking the program. It was discovered that within the Swing library, forged timer events could allow bypass of SecurityManager checks. Konstantin PreiBer and others discovered that specific double literals were improperly handled, allowing a remote attacker to cause a denial of service. It was discovered that the JNLPClassLoader class when handling multiple signatures allowed remote attackers to gain privileges due to the assignment of an inappropriate security descriptor. Various other issues were also addressed.

tags | advisory, java, remote, denial of service, arbitrary, local, vulnerability
systems | linux, ubuntu
advisories | CVE-2010-4448, CVE-2010-4450, CVE-2010-4465, CVE-2010-4469, CVE-2010-4470, CVE-2010-4471, CVE-2010-4472, CVE-2010-4476, CVE-2011-0706
SHA-256 | c5c18368e20b050d150d2c53891f0010937af3d0d826c64263852fc25e700d30
Ubuntu Security Notice USN-1079-1
Posted Mar 1, 2011
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1079-1 - Multiple openjdk-6 vulnerabilities have been addressed. It was discovered that untrusted Java applets could create domain name resolution cache entries, allowing an attacker to manipulate name resolution within the JVM. It was discovered that the Java launcher did not did not properly setup the LD_LIBRARY_PATH environment variable. A local attacker could exploit this to execute arbitrary code as the user invoking the program. It was discovered that within the Swing library, forged timer events could allow bypass of SecurityManager checks. Konstantin PreiBer and others discovered that specific double literals were improperly handled, allowing a remote attacker to cause a denial of service. It was discovered that the JNLPClassLoader class when handling multiple signatures allowed remote attackers to gain privileges due to the assignment of an inappropriate security descriptor. Various other issues were also addressed.

tags | advisory, java, remote, denial of service, arbitrary, local, vulnerability
systems | linux, ubuntu
advisories | CVE-2010-4448, CVE-2010-4450, CVE-2010-4465, CVE-2010-4469, CVE-2010-4470, CVE-2010-4471, CVE-2010-4472, CVE-2010-4476, CVE-2011-0706
SHA-256 | 675d0308ed338b1cf506b437119680a9688b4b8b8a44d555acc084f28eb3fcd5
Page 1 of 2
Back12Next

File Archive:

June 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    0 Files
  • 2
    Jun 2nd
    0 Files
  • 3
    Jun 3rd
    18 Files
  • 4
    Jun 4th
    21 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    57 Files
  • 7
    Jun 7th
    6 Files
  • 8
    Jun 8th
    0 Files
  • 9
    Jun 9th
    0 Files
  • 10
    Jun 10th
    12 Files
  • 11
    Jun 11th
    27 Files
  • 12
    Jun 12th
    38 Files
  • 13
    Jun 13th
    16 Files
  • 14
    Jun 14th
    14 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    16 Files
  • 18
    Jun 18th
    26 Files
  • 19
    Jun 19th
    15 Files
  • 20
    Jun 20th
    18 Files
  • 21
    Jun 21st
    8 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close