Acronis Snap Deploy 'pxesrv.exe'目录遍历漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1114738 漏洞类型 路径遍历
发布时间 2008-03-10 更新时间 2008-09-05
CVE编号 CVE-2008-1410 CNNVD-ID CNNVD-200803-342
漏洞平台 Windows CVSS评分 4.3
|漏洞来源
https://www.exploit-db.com/exploits/5228
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200803-342
|漏洞详情
AcronisSnapDeploy2.0.0.1076及其早期版本的PXEServer(pxesrv.exe)中存在的目录遍历漏洞。远程攻击者通过目录遍历序列到达TFTP服务来读取任意文件。
|漏洞EXP
#######################################################################

                             Luigi Auriemma

Application:  Acronis PXE Server
              http://www.acronis.com/enterprise/products/snapdeploy/
Versions:     <= 2.0.0.1076
Platforms:    Windows
Bugs:         A] directory traversal
              B] NULL pointer
Exploitation: remote
Date:         08 Mar 2008
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bugs
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


The Acronis PXE Server is an essential component of Acronis Snap Deploy
Server, a deployment solution for automatically configuring all the
clients of the local network.


#######################################################################

=======
2) Bugs
=======

----------------------
A] directory traversal
----------------------

The PXE Server (pxesrv.exe) implements a TFTP server for allowing the
downloading of the bootstrap files (uploading is not allowed).
This service is vulnerable to a classical directory traversal and an
arbitrary path attacks which allow an attacker to download any file
from the local disks or the network shares.


---------------
B] NULL pointer
---------------

An incomplete TFTP request (anything which goes from the simple absence
of the option field to the usage of only the 2 bytes for the opcode)
causes the crashing of the PXE Server due to a NULL pointer access.


#######################################################################

===========
3) The Code
===========


A]
http://aluigi.org/testz/tftpx.zip

  tftpx SERVER ..\../..\../boot.ini none
  tftpx SERVER c:\boot.ini none
  tftpx SERVER \\internal_host\documents\file.txt none

B]
send the bytes 00 01 to UDP port 69 of the server:

  echo -n -e \x00\x01|nc SERVER 69 -v -v -u



#######################################################################

======
4) Fix
======


No fix


#######################################################################

# milw0rm.com [2008-03-10]
|参考资料

来源:XF
名称:acronissnap-pxeserver-directory-traversal(41074)
链接:http://xforce.iss.net/xforce/xfdb/41074
来源:BID
名称:28182
链接:http://www.securityfocus.com/bid/28182
来源:BUGTRAQ
名称:20080310DirectorytraversalandNULLpointerinAcronisPXEServer2.0.0.1076
链接:http://www.securityfocus.com/archive/1/archive/1/489358/100/0/threaded
来源:MILW0RM
名称:5228
链接:http://www.milw0rm.com/exploits/5228
来源:VUPEN
名称:ADV-2008-0814
链接:http://www.frsirt.com/english/advisories/2008/0814/references
来源:SECUNIA
名称:29305
链接:http://secunia.com/advisories/29305
来源:MISC
链接:http://aluigi.altervista.org/adv/acropxe-adv.txt
来源:SREASON
名称:3758
链接:http://securityreason.com/securityalert/3758