当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2013-039944

漏洞标题：中国航空某采购系统命令执行漏洞(root权限已shell)

相关厂商：中国航空工业集团公司

漏洞作者： niliu

提交时间：2013-10-16 16:10

修复时间：2013-11-30 16:11

公开时间：2013-11-30 16:11

漏洞类型：命令执行

危害等级：高

自评Rank：12

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2013-10-16： 细节已通知厂商并且等待厂商处理中
2013-10-20： 厂商已经确认，细节仅向厂商公开
2013-10-30： 细节向核心白帽子及相关领域专家公开
2013-11-09： 细节向普通白帽子公开
2013-11-19： 细节向实习白帽子公开
2013-11-30： 细节向公众公开

简要描述：

http://wooyun.org/bugs/wooyun-2013-039937
怎么小厂商了？麻烦管理给改下吧~谢谢！

详细说明：

中国航空工业电子采购平台

http://ebuy.avic.com/front/user-login.action


22.jpg


补丁不及时，可shell
shell地址

http://ebuy.avic.com/shell.jsp


11.jpg


[/u01/tomcat6/webapps/cpp/]$ ifconfig
eth0      Link encap:Ethernet  HWaddr 6C:AE:8B:21:FF:4A  
          inet addr:10.64.2.105  Bcast:10.64.2.255  Mask:255.255.255.0
          inet6 addr: fe80::6eae:8bff:fe21:ff4a/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:19212807 errors:0 dropped:0 overruns:0 frame:0
          TX packets:18512781 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:2136185755 (1.9 GiB)  TX bytes:11680218758 (10.8 GiB)
          Memory:91a60000-91a80000 
eth1      Link encap:Ethernet  HWaddr 6C:AE:8B:21:FF:4B  
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)
          Memory:91a40000-91a60000 
eth2      Link encap:Ethernet  HWaddr 6C:AE:8B:21:FF:4C  
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)
          Memory:91a20000-91a40000 
eth3      Link encap:Ethernet  HWaddr 6C:AE:8B:21:FF:4D  
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)
          Memory:91a00000-91a20000 
lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:63235345 errors:0 dropped:0 overruns:0 frame:0
          TX packets:63235345 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:12993689945 (12.1 GiB)  TX bytes:12993689945 (12.1 GiB)
usb0      Link encap:Ethernet  HWaddr 6E:AE:8B:21:FF:49  
          inet6 addr: fe80::6cae:8bff:fe21:ff49/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:5333027 errors:0 dropped:0 overruns:0 frame:0
          TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:150359796 (143.3 MiB)  TX bytes:468 (468.0 b)


33.jpg

漏洞证明：

11.jpg


[/u01/tomcat6/webapps/cpp/]$ ifconfig
eth0      Link encap:Ethernet  HWaddr 6C:AE:8B:21:FF:4A  
          inet addr:10.64.2.105  Bcast:10.64.2.255  Mask:255.255.255.0
          inet6 addr: fe80::6eae:8bff:fe21:ff4a/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:19212807 errors:0 dropped:0 overruns:0 frame:0
          TX packets:18512781 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:2136185755 (1.9 GiB)  TX bytes:11680218758 (10.8 GiB)
          Memory:91a60000-91a80000 
eth1      Link encap:Ethernet  HWaddr 6C:AE:8B:21:FF:4B  
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)
          Memory:91a40000-91a60000 
eth2      Link encap:Ethernet  HWaddr 6C:AE:8B:21:FF:4C  
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)
          Memory:91a20000-91a40000 
eth3      Link encap:Ethernet  HWaddr 6C:AE:8B:21:FF:4D  
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)
          Memory:91a00000-91a20000 
lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:63235345 errors:0 dropped:0 overruns:0 frame:0
          TX packets:63235345 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:12993689945 (12.1 GiB)  TX bytes:12993689945 (12.1 GiB)
usb0      Link encap:Ethernet  HWaddr 6E:AE:8B:21:FF:49  
          inet6 addr: fe80::6cae:8bff:fe21:ff49/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:5333027 errors:0 dropped:0 overruns:0 frame:0
          TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:150359796 (143.3 MiB)  TX bytes:468 (468.0 b)


33.jpg

修复方案：

打补丁！

版权声明：转载请注明来源 niliu@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：6

确认时间：2013-10-20 19:07

厂商回复：

最新状态：

暂无