当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2013-025530

漏洞标题:奥迪某分站任意命令执行漏洞

相关厂商:一汽-大众汽车有限公司

漏洞作者: zhk

提交时间:2013-06-09 12:01

修复时间:2013-07-24 16:16

公开时间:2013-07-24 16:16

漏洞类型:命令执行

危害等级:中

自评Rank:10

漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2013-06-09: 细节已通知厂商并且等待厂商处理中
2013-06-14: 厂商已经确认,细节仅向厂商公开
2013-06-24: 细节向核心白帽子及相关领域专家公开
2013-07-04: 细节向普通白帽子公开
2013-07-14: 细节向实习白帽子公开
2013-07-24: 细节向公众公开

简要描述:

奥迪分站Apache Struts命令执行

详细说明:

http://contact.audi.cn/m/dealer/msizes!seljxs.action

网站物理路径: /www/audicontact
java.home: /usr/java/jdk1.5.0_16/jre
java.version: 1.5.0_16
os.name: Linux
os.arch: i386
os.version: 2.6.18-92.el5
user.name: tomcat
user.home: /home/tomcat
user.dir: /home/tomcat
java.class.version: 49.0
java.class.path: :/usr/local/tomcat/bin/bootstrap.jar:/usr/local/tomcat/bin/commons-logging-api.jar
java.library.path: /usr/java/jdk1.5.0_16/jre/lib/i386/server:/usr/java/jdk1.5.0_16/jre/lib/i386:/usr/java/jdk1.5.0_16/jre/../lib/i386
file.separator: /
path.separator: :
java.vendor: Sun Microsystems Inc.
java.vendor.url: http://java.sun.com/
java.vm.specification.version: 1.0
java.vm.specification.vendor: Sun Microsystems Inc.
java.vm.specification.name: Java Virtual Machine Specification
java.vm.version: 1.5.0_16-b02
java.vm.vendor: Sun Microsystems Inc.
java.vm.name: Java HotSpot(TM) Server VM
java.specification.version: 1.5
java.specification.vender:
java.specification.name: Java Platform API Specification
java.io.tmpdir: /usr/local/tomcat/temp
hibernate信息
-- listing properties --
java.vendor=Sun Microsystems Inc.
sun.java.launcher=SUN_STANDARD
catalina.base=/usr/local/tomcat
hibernate.connection.url=jdbc:oracle:thin:@10.172.12.42:1521:a...
sun.management.compiler=HotSpot Server Compiler
catalina.useNaming=true
os.name=Linux
sun.boot.class.path=/usr/java/jdk1.5.0_16/jre/lib/rt.jar:...
java.util.logging.config.file=/usr/local/tomcat/conf/logging.proper...
java.vm.specification.vendor=Sun Microsystems Inc.
java.runtime.version=1.5.0_16-b02
user.name=tomcat
shared.loader=${catalina.base}/shared/classes,${cat...
tomcat.util.buf.StringCache.byte.enabled=true
connection.driver_class=oracle.jdbc.driver.OracleDriver
user.language=en
java.naming.factory.initial=org.apache.naming.java.javaURLContext...
sun.boot.library.path=/usr/java/jdk1.5.0_16/jre/lib/i386
dialect=org.hibernate.dialect.Oracle9Dialect
java.version=1.5.0_16
java.util.logging.manager=org.apache.juli.ClassLoaderLogManager
user.timezone=Asia/Shanghai
sun.arch.data.model=32
java.endorsed.dirs=/usr/local/tomcat/common/endorsed
sun.cpu.isalist=
sun.jnu.encoding=UTF-8
file.encoding.pkg=sun.io
package.access=sun.,org.apache.catalina.,org.apache....
file.separator=/
java.specification.name=Java Platform API Specification
java.class.version=49.0
user.country=US
connection.url=jdbc:oracle:thin:@10.172.12.42:1521:a...
java.home=/usr/java/jdk1.5.0_16/jre
java.vm.info=mixed mode
os.version=2.6.18-92.el5
path.separator=:
connection.password=audicms!#
java.vm.version=1.5.0_16-b02
hibernate.connection.password=audicms!#
java.awt.printerjob=sun.print.PSPrinterJob
sun.io.unicode.encoding=UnicodeLittle
hibernate.connection.username=audicms
package.definition=sun.,java.,org.apache.catalina.,org.a...
java.naming.factory.url.pkgs=org.apache.naming
user.home=/home/tomcat
java.specification.vendor=Sun Microsystems Inc.
java.library.path=/usr/java/jdk1.5.0_16/jre/lib/i386/se...
java.vendor.url=http://java.sun.com/
hibernate.connection.driver_class=oracle.jdbc.driver.OracleDriver
connection.username=audicms
java.vm.vendor=Sun Microsystems Inc.
hibernate.dialect=org.hibernate.dialect.Oracle9Dialect
common.loader=${catalina.home}/common/classes,${cat...
java.runtime.name=Java(TM) 2 Runtime Environment, Stand...
java.class.path=:/usr/local/tomcat/bin/bootstrap.jar:...
hibernate.bytecode.use_reflection_optimizer=false
java.vm.specification.name=Java Virtual Machine Specification
java.vm.specification.version=1.0
catalina.home=/usr/local/tomcat
sun.cpu.endian=little
sun.os.patch.level=unknown
java.io.tmpdir=/usr/local/tomcat/temp
java.vendor.url.bug=http://java.sun.com/cgi-bin/bugreport...
server.loader=${catalina.home}/server/classes,${cat...
os.arch=i386
java.awt.graphicsenv=sun.awt.X11GraphicsEnvironment
myeclipse.connection.profile=audicn42
java.ext.dirs=/usr/java/jdk1.5.0_16/jre/lib/ext
user.dir=/home/tomcat
line.separator=
java.vm.name=Java HotSpot(TM) Server VM
hibernate.myeclipse.connection.profile=audicn42
file.encoding=UTF-8
java.specification.version=1.5

漏洞证明:

2013-06-09 11:52:44的屏幕截图.png

修复方案:

升级

版权声明:转载请注明来源 zhk@乌云


漏洞回应

厂商回应:

危害等级:低

漏洞Rank:5

确认时间:2013-06-14 01:25

厂商回复:

最新状态:

暂无