漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2013-039791
漏洞标题：和讯网配置不当造成源码泄露
相关厂商：和讯网
漏洞作者： kobin97
提交时间：2013-10-15 13:05
修复时间：2013-11-29 13:06
公开时间：2013-11-29 13:06
漏洞类型：系统/服务运维配置不当
危害等级：高
自评Rank：15
漏洞状态：厂商已经确认
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2013-10-15： 细节已通知厂商并且等待厂商处理中
2013-10-15： 厂商已经确认，细节仅向厂商公开
2013-10-25： 细节向核心白帽子及相关领域专家公开
2013-11-04： 细节向普通白帽子公开
2013-11-14： 细节向实习白帽子公开
2013-11-29： 细节向公众公开
简要描述：
和讯网配置不当造成源码泄露
详细说明：
rsync 空口令，主站源码泄露
rsync 60.28.250.45::rsync_all
root@bt5:~# rsync 60.28.250.45::rsync_all
drwxr-xr-x 4096 2013/09/29 15:30:54 .
drwxrwxr-x 12288 2013/06/04 01:29:01 2008
drwxrwxr-x 4096 2013/10/12 09:57:00 3g
drwxrwsr-x 4096 2013/05/08 14:22:34 adjs
drwxrwxr-x 69632 2013/10/15 13:00:42 auto
drwxrwxr-x 135168 2013/10/15 13:00:46 bank
drwxrwxr-x 20480 2013/10/15 13:00:40 bbs
drwxrwxr-x 4096 2012/06/28 15:24:03 blogzt
drwxrwxr-x 131072 2013/10/15 13:00:43 bond
drwxrwxr-x 69632 2013/10/15 13:00:32 book
drwxrwsr-x 69632 2013/10/15 13:00:30 bschool
drwxrwxr-x 4096 2011/12/28 11:02:48 ceshi
drwxrwxr-x 4096 2013/10/14 11:24:25 chinawellnesshp
drwxrwxr-x 4096 2011/11/29 14:43:06 cj123
drwxrwxr-x 4096 2013/10/09 11:07:18 club
drwxrwxr-x 4096 2013/10/15 01:30:21 corp
drwxrwxr-x 20480 2013/10/15 10:16:57 cpxf
drwxrwxr-x 20480 2013/02/13 13:36:29 cs
drwxrwxr-x 36864 2013/10/15 13:00:34 digi
drwxrwxr-x 12288 2013/10/15 01:31:00 edu
drwxrwxr-x 12288 2013/04/21 01:34:58 expo2010
drwxrwxr-x 20480 2013/10/09 10:11:31 fblog
drwxrwxr-x 69632 2013/04/21 01:35:52 finance
drwxr-xr-x 4096 2011/10/14 16:03:53 flash
drwxrwsr-x 135168 2013/10/15 13:00:47 forex
drwxrwxr-x 20480 2013/10/15 00:09:00 fujian
drwxrwxr-x 135168 2013/10/15 13:00:27 funds
drwxrwxr-x 135168 2013/10/15 13:00:42 futures
drwxrwxr-x 126976 2013/10/15 13:00:45 gold
drwxr-xr-x 28672 2013/06/25 01:30:37 golf
drwxrwxr-x 36864 2013/10/14 08:21:54 gongyi
drwxrwxr-x 4096 2013/06/01 01:31:16 gov
drwxr-xr-x 20480 2013/10/15 06:56:22 gqimg
drwxrwxr-x 20480 2013/10/15 06:23:54 gzqh
drwxrwxr-x 20480 2013/10/11 01:29:34 hdhouse
drwxrwxr-x 20480 2013/10/15 07:48:30 henan
drwxrwxr-x 4096 2011/12/09 01:30:20 hermes
drwxrwsr-x 114688 2013/10/15 13:00:30 house
drwxr-xr-x 4096 2011/12/01 15:32:55 hxtimg.hexun.com
drwxr-xr-x 4096 2010/08/04 14:56:57 img.tool.hexun.com
drwxrwsr-x 69632 2013/10/15 13:00:05 img
drwxrwxr-x 126976 2013/10/15 13:00:45 insurance
drwxrwxr-x 4096 2013/09/26 01:31:38 integration
drwxr-xr-x 4096 2013/10/11 16:41:53 iof
drwxrwsr-x 131072 2013/10/15 13:00:30 it
drwxr-xr-x 4096 2011/12/12 11:23:16 jcimg.tool.hexun.com
drwxrwxr-x 4096 2011/11/29 09:42:17 jifen
drwxrwxr-x 12288 2013/05/02 09:52:20 jr
drwxrwxr-x 4096 2013/10/15 12:59:59 jucai
drwxrwxrwx 4096 2009/12/03 14:36:21 lbi-html
drwxrwxr-x 12288 2013/05/26 01:31:06 lc
drwxrwxr-x 4096 2013/02/13 13:36:29 life
drwxrwxr-x 4096 2013/06/30 07:36:26 lujiazuiforum
drwxrwxr-x 69632 2013/10/15 00:05:36 lux
drwxrwxr-x 4096 2013/02/13 13:36:29 market
drwxrwsr-x 69632 2013/09/14 01:29:08 media
drwxrwxr-x 36864 2013/10/15 09:08:59 mediashow
drwxrwxr-x 106496 2013/10/15 13:00:41 money
drwxrwxr-x 20480 2013/10/15 02:25:04 msngold
drwxrwxr-x 28672 2013/04/17 17:47:42 msnmoney
drwxrwxr-x 24576 2013/04/21 01:38:27 msnnews
drwxrwxr-x 36864 2013/08/23 01:34:21 msnstock
drwxrwxr-x 36864 2013/09/14 17:27:46 nc
drwxrwsr-x 253952 2013/10/15 13:00:29 news
drwxrwxr-x 4096 2013/10/15 01:30:21 nservices
drwxrwsr-x 114688 2013/10/15 13:00:49 opinion
drwxrwxr-x 32768 2013/10/15 12:16:17 pcmag
drwxrwxr-x 32768 2013/10/15 13:00:35 pe
drwxrwxr-x 24576 2013/10/15 01:31:12 pension
drwxrwxr-x 12288 2013/10/14 16:40:44 px
drwxrwxr-x 98304 2013/10/15 13:00:51 qizhi
drwxrwxr-x 4096 2013/04/06 01:33:50 rich
drwxrwxr-x 4096 2013/10/07 16:22:29 rj
drwxrwxr-x 36864 2013/10/10 05:24:08 salon
drwxrwxr-x 4096 2013/10/15 07:19:52 shandong
drwxrwxr-x 12288 2013/10/14 13:55:07 shlca
drwxrwxr-x 69632 2013/10/15 13:00:35 shoucang
drwxrwxr-x 12288 2013/10/15 03:17:01 sichuan
drwxrwxr-x 4096 2013/02/13 13:36:29 soft
drwxr-xr-x 143360 2013/10/15 13:00:32 stock
drwxr-xr-x 4096 2013/10/15 10:25:22 suzhouhouse
drwxrwxr-x 36864 2013/10/15 13:00:35 tax
drwxrwxr-x 49152 2013/10/15 01:32:57 travel
drwxrwxr-x 49152 2013/10/15 13:00:32 trust
drwxrwxr-x 12288 2013/04/21 01:32:47 tuba
drwxrwxr-x 4096 2011/12/10 01:30:18 tuiguang
drwxrwxr-x 69632 2013/10/15 13:00:24 tv
drwxrwxr-x 36864 2013/04/21 01:34:21 vnetnews
drwxr-xr-x 12288 2013/10/14 13:21:33 www
drwxr-xr-x 4096 2011/06/01 16:10:16 wz_hq_upload
drwxrwxr-x 28672 2013/10/15 08:51:03 xianhuo
drwxrwxr-x 12288 2013/10/14 19:55:16 yuqing
drwxrwxr-x 4096 2013/10/08 08:32:11 zt
漏洞证明：
只读权限。也不知道怎么证明了。。你们自己检查下吧。
修复方案：
空口令！
版权声明：转载请注明来源 kobin97@乌云
漏洞回应
厂商回应：
危害等级：中
漏洞Rank：5
确认时间：2013-10-15 13:52
厂商回复：
处理ing
最新状态：
暂无