Syworks SafeNET policy.dat文件 访问控制绕过漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1194616 漏洞类型 未知
发布时间 2006-06-12 更新时间 2006-06-12
CVE编号 CVE-2006-2967 CNNVD-ID CNNVD-200606-209
漏洞平台 N/A CVSS评分 2.1
|漏洞来源
https://www.securityfocus.com/bid/80491
https://cxsecurity.com/issue/WLB-2006060082
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200606-209
|漏洞详情
SyworksSafeNET本地用户通过编辑policy.dat文件来绕过网络资源消费限制。
|漏洞EXP
Title:

[Kil13r-SA-20060605] Syworks SafeNET Policy File Vulnerability

Author:

Kil13r - http://www.kil13r.info/

Local / Remote:

Local

Timeline:

2006/04/18 - Discovery

2006/06/05 - Release

Affected version:

All version of Syworks SafeNET

Not affected version:

In this time, none

Description:

Syworks SafeNET is network resource protection solution which organized by client/server, but that has serious vulnerability.

It has client policy file that can be modified by end user.

In file of policy.dat

08h to 16h: Ascii value of Syworks SafeNET server address

18h: The switch of Syworks SafeNET client (On: 0x01, Off: 0x00)

1ch to 1dh: ICMP limit (0x0000 to 0xFFFF)

20h to 21h: Broadcast limit (0x0000 to 0xFFFF)

24h to 25h: Session limit (0x0000 to 0xFFFF)

28h: Session limit violation allowed time (0x00 to 0xFF)

2ah: The switch which blocking continuous violation (On: 0x01, Off: 0x00)

2ch: Continuous violation allowed time (0x00 to 0xFF)

2fh: The switch which warning continuous violation (On: 0x01, Off: 0x00)

31h: The switch which disallowing Syworks SafeNET client termination by end user (On: 0x01, Off: 0x00)

33h: The switch which disallowing Syworks SafeNET client icon in tray (On: 0x01, Off: 0x00)

3eh to 41h: Problem autoreport interval (0x00000000 to 0xFFFFFFFF)

If attacker modify client policy file, attacker can consume all of network resource.

Proof of Concept code:

None

Proof of Concept example:

None

Proof of Concept screenshot:

None
|受影响的产品
Syworks Safenet 0
|参考资料

来源:BUGTRAQ
名称:20060605[Kil13r-SA-20060605]SyworksSafeNETPolicyFileVulnerability
链接:http://www.securityfocus.com/archive/1/archive/1/436000/100/0/threaded
来源:SECTRACK
名称:1016231
链接:http://securitytracker.com/id?1016231
来源:XF
名称:safenet-policy-dos(27083)
链接:http://xforce.iss.net/xforce/xfdb/27083
来源:SREASON
名称:1077
链接:http://securityreason.com/securityalert/1077