MIT PGP Public Key Server搜索字符串远程缓冲区溢出漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1106742 漏洞类型 未知
发布时间 2002-05-24 更新时间 2005-05-02
CVE编号 CVE-2002-0900 CNNVD-ID CNNVD-200210-191
漏洞平台 Linux CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/21482
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200210-191
|漏洞详情
PGPPublicKeyServer是一款MIT分发的免费开放源代码的公共密钥搜索系统,可运行在Unix和Linux操作系统下。PGPPublicKeyServer没有很好的处理超长的字符串数据,可导致远程攻击者进行缓冲区溢出攻击。由于PGPPublicKeyServer对用户提交的数据缺少正确的检查,攻击者可以提交超长的搜索字符串给服务程序,可导致产生缓冲区溢出,精心构建字符串数据可使攻击者以Web进程的权限在目标系统上执行任意代码。必须注意的是漏洞比较难于利用,因为客户提交的数据必须通过isalnum()和tolower()函数转换后提交给系统处理。
|漏洞EXP
source: http://www.securityfocus.com/bid/4828/info

The PGP Public Key Server is a freely available, open source software package distributed by MIT. It is designed for use on Linux and Unix operating systems.

The PGP Public Key Server does not properly handle long search strings. Under some conditions, it may be possible to pass a long string to the server that could result in a buffer overflow. This may result in the overwriting of stack variables, including the return address. It should be noted that this vulnerability would be difficult to exploit, as client data is passed through isalnum() and tolower().

gpg --search-keys `perl -e "print 'A'x512"`

echo -e "GET /pks/lookup?op=index&search=`perl -e "print 'A'x512"`"| nc example.com 11371
|参考资料

来源:BID
名称:4828
链接:http://www.securityfocus.com/bid/4828
来源:XF
名称:pgp-pks-search-bo(9171)
链接:http://www.iss.net/security_center/static/9171.php
来源:www.rubin.ch
链接:http://www.rubin.ch/pgp/src/patch_buffoverflow20020525
来源:BUGTRAQ
名称:20020524pkspublickeyserverDOSandremoteexecution
链接:http://online.securityfocus.com/archive/1/274107