|
|
Gravity Storm Service Pack Manager 2000目录权限漏洞
发布时间：2002-03-25
更新时间：2002-03-25
严重程度：中
威胁程度：其它
错误类型：设计错误
利用方式：服务器模式
BUGTRAQ ID：4347
受影响系统Gravity Storm Software Service Pack Manager 2000 6.0
- Microsoft Windows 2000 Advanced Server 0.0
- Microsoft Windows 2000 Advanced Server 0.0SP1
- Microsoft Windows 2000 Advanced Server 0.0SP2
- Microsoft Windows 2000 Datacenter Server 0.0
- Microsoft Windows 2000 Datacenter Server 0.0SP1
- Microsoft Windows 2000 Datacenter Server 0.0SP2
- Microsoft Windows 2000 Professional 0.0
- Microsoft Windows 2000 Professional 0.0SP1
- Microsoft Windows 2000 Professional 0.0SP2
- Microsoft Windows 2000 Server 0.0
- Microsoft Windows 2000 Server 0.0SP1
- Microsoft Windows 2000 Server 0.0SP2
- Microsoft Windows 2000 Terminal Services 0.0
- Microsoft Windows 2000 Terminal Services 0.0SP1
- Microsoft Windows 2000 Terminal Services 0.0SP2
- Microsoft Windows NT Enterprise Server 4.0
- Microsoft Windows NT Enterprise Server 4.0SP1
- Microsoft Windows NT Enterprise Server 4.0SP2
- Microsoft Windows NT Enterprise Server 4.0SP3
- Microsoft Windows NT Enterprise Server 4.0SP4
- Microsoft Windows NT Enterprise Server 4.0SP5
- Microsoft Windows NT Enterprise Server 4.0SP6
- Microsoft Windows NT Enterprise Server 4.0SP6a
- Microsoft Windows NT Server 4.0
- Microsoft Windows NT Server 4.0SP1
- Microsoft Windows NT Server 4.0SP2
- Microsoft Windows NT Server 4.0SP3
- Microsoft Windows NT Server 4.0SP4
- Microsoft Windows NT Server 4.0SP5
- Microsoft Windows NT Server 4.0SP6
- Microsoft Windows NT Server 4.0SP6a
- Microsoft Windows NT Terminal Server 4.0
- Microsoft Windows NT Terminal Server 4.0SP1
- Microsoft Windows NT Terminal Server 4.0SP2
- Microsoft Windows NT Terminal Server 4.0SP3
- Microsoft Windows NT Terminal Server 4.0SP4
- Microsoft Windows NT Terminal Server 4.0SP5
- Microsoft Windows NT Terminal Server 4.0SP6
- Microsoft Windows NT Terminal Server 4.0SP6a
- Microsoft Windows NT Workstation 4.0
- Microsoft Windows NT Workstation 4.0SP1
- Microsoft Windows NT Workstation 4.0SP2
- Microsoft Windows NT Workstation 4.0SP3
- Microsoft Windows NT Workstation 4.0SP4
- Microsoft Windows NT Workstation 4.0SP5
- Microsoft Windows NT Workstation 4.0SP6
- Microsoft Windows NT Workstation 4.0SP6a
Gravity Storm Software Service Pack Manager 2000 6.1
- Microsoft Windows 2000 Advanced Server 0.0
- Microsoft Windows 2000 Advanced Server 0.0SP1
- Microsoft Windows 2000 Advanced Server 0.0SP2
- Microsoft Windows 2000 Datacenter Server 0.0
- Microsoft Windows 2000 Datacenter Server 0.0SP1
- Microsoft Windows 2000 Datacenter Server 0.0SP2
- Microsoft Windows 2000 Professional 0.0
- Microsoft Windows 2000 Professional 0.0SP1
- Microsoft Windows 2000 Professional 0.0SP2
- Microsoft Windows 2000 Server 0.0
- Microsoft Windows 2000 Server 0.0SP1
- Microsoft Windows 2000 Server 0.0SP2
- Microsoft Windows 2000 Terminal Services 0.0
- Microsoft Windows 2000 Terminal Services 0.0SP1
- Microsoft Windows 2000 Terminal Services 0.0SP2
- Microsoft Windows NT Enterprise Server 4.0
- Microsoft Windows NT Enterprise Server 4.0SP1
- Microsoft Windows NT Enterprise Server 4.0SP2
- Microsoft Windows NT Enterprise Server 4.0SP3
- Microsoft Windows NT Enterprise Server 4.0SP4
- Microsoft Windows NT Enterprise Server 4.0SP5
- Microsoft Windows NT Enterprise Server 4.0SP6
- Microsoft Windows NT Enterprise Server 4.0SP6a
- Microsoft Windows NT Server 4.0
- Microsoft Windows NT Server 4.0SP1
- Microsoft Windows NT Server 4.0SP2
- Microsoft Windows NT Server 4.0SP3
- Microsoft Windows NT Server 4.0SP4
- Microsoft Windows NT Server 4.0SP5
- Microsoft Windows NT Server 4.0SP6
- Microsoft Windows NT Server 4.0SP6a
- Microsoft Windows NT Terminal Server 4.0
- Microsoft Windows NT Terminal Server 4.0SP1
- Microsoft Windows NT Terminal Server 4.0SP2
- Microsoft Windows NT Terminal Server 4.0SP3
- Microsoft Windows NT Terminal Server 4.0SP4
- Microsoft Windows NT Terminal Server 4.0SP5
- Microsoft Windows NT Terminal Server 4.0SP6
- Microsoft Windows NT Terminal Server 4.0SP6a
- Microsoft Windows NT Workstation 4.0
- Microsoft Windows NT Workstation 4.0SP1
- Microsoft Windows NT Workstation 4.0SP2
- Microsoft Windows NT Workstation 4.0SP3
- Microsoft Windows NT Workstation 4.0SP4
- Microsoft Windows NT Workstation 4.0SP5
- Microsoft Windows NT Workstation 4.0SP6
- Microsoft Windows NT Workstation 4.0SP6a
Gravity Storm Software Service Pack Manager 2000 6.3
- Microsoft Windows 2000 Advanced Server 0.0
- Microsoft Windows 2000 Advanced Server 0.0SP1
- Microsoft Windows 2000 Advanced Server 0.0SP2
- Microsoft Windows 2000 Datacenter Server 0.0
- Microsoft Windows 2000 Datacenter Server 0.0SP1
- Microsoft Windows 2000 Datacenter Server 0.0SP2
- Microsoft Windows 2000 Professional 0.0
- Microsoft Windows 2000 Professional 0.0SP1
- Microsoft Windows 2000 Professional 0.0SP2
- Microsoft Windows 2000 Server 0.0
- Microsoft Windows 2000 Server 0.0SP1
- Microsoft Windows 2000 Server 0.0SP2
- Microsoft Windows 2000 Terminal Services 0.0
- Microsoft Windows 2000 Terminal Services 0.0SP1
- Microsoft Windows 2000 Terminal Services 0.0SP2
- Microsoft Windows NT Enterprise Server 4.0
- Microsoft Windows NT Enterprise Server 4.0SP1
- Microsoft Windows NT Enterprise Server 4.0SP2
- Microsoft Windows NT Enterprise Server 4.0SP3
- Microsoft Windows NT Enterprise Server 4.0SP4
- Microsoft Windows NT Enterprise Server 4.0SP5
- Microsoft Windows NT Enterprise Server 4.0SP6
- Microsoft Windows NT Enterprise Server 4.0SP6a
- Microsoft Windows NT Server 4.0
- Microsoft Windows NT Server 4.0SP1
- Microsoft Windows NT Server 4.0SP2
- Microsoft Windows NT Server 4.0SP3
- Microsoft Windows NT Server 4.0SP4
- Microsoft Windows NT Server 4.0SP5
- Microsoft Windows NT Server 4.0SP6
- Microsoft Windows NT Server 4.0SP6a
- Microsoft Windows NT Terminal Server 4.0
- Microsoft Windows NT Terminal Server 4.0SP1
- Microsoft Windows NT Terminal Server 4.0SP2
- Microsoft Windows NT Terminal Server 4.0SP3
- Microsoft Windows NT Terminal Server 4.0SP4
- Microsoft Windows NT Terminal Server 4.0SP5
- Microsoft Windows NT Terminal Server 4.0SP6
- Microsoft Windows NT Terminal Server 4.0SP6a
- Microsoft Windows NT Workstation 4.0
- Microsoft Windows NT Workstation 4.0SP1
- Microsoft Windows NT Workstation 4.0SP2
- Microsoft Windows NT Workstation 4.0SP3
- Microsoft Windows NT Workstation 4.0SP4
- Microsoft Windows NT Workstation 4.0SP5
- Microsoft Windows NT Workstation 4.0SP6
- Microsoft Windows NT Workstation 4.0SP6a
- Microsoft Windows XP Home 0.0
- Microsoft Windows XP Professional 0.0 详细描述
Gravity Storm Service Pack Manager存在漏洞允许任意组读和写SYSTEM32目录。
当Gravity Storm Service Pack Manager按扎时，会建立一个隐藏的共享映射到本地驱动器，结果导致本地用户可以以读和写权限访问此共享。
如'C:\winnt\system32\repair'目录只有读权限，而没有写权限，可导致进一步攻击。
测试代码
见描述
解决方案
尚无
相关信息
'ken'@FTU" <ken_at_ftu@yahoo.com>.
参考：http://online.securityfocus.com/archive/1/263587
相关主页：http://www.securitybastion.com/index.html
|
