xfocus logo xfocus title
首页 焦点原创 安全文摘 安全工具 安全漏洞 焦点项目 焦点论坛 关于我们
English Version

Sambar Server多个跨站脚本漏洞


发布时间:2003-04-09
更新时间:2003-04-09
严重程度:
威胁程度:用户敏感信息泄露
错误类型:输入验证错误
利用方式:服务器模式

BUGTRAQ ID:7209

受影响系统
Sambar Server 5.1                                      
   -Microsoft Windows 2000 Advanced Server            
   -Microsoft Windows 2000 Advanced Server SP1        
   -Microsoft Windows 2000 Advanced Server SP2        
   -Microsoft Windows 2000 Datacenter Server          
   -Microsoft Windows 2000 Datacenter Server SP1      
   -Microsoft Windows 2000 Datacenter Server SP2      
   -Microsoft Windows 2000 Professional                
   -Microsoft Windows 2000 Professional SP1            
   -Microsoft Windows 2000 Professional SP2            
   -Microsoft Windows 2000 Server                      
   -Microsoft Windows 2000 Server SP1                  
   -Microsoft Windows 2000 Server SP2                  
   -Microsoft Windows 95                              
   -Microsoft Windows 98                              
   -Microsoft Windows 98SE                            
   -Microsoft Windows ME                              
   -Microsoft Windows NT Enterprise Server 4.0        
   -Microsoft Windows NT Enterprise Server 4.0 SP1    
   -Microsoft Windows NT Enterprise Server 4.0 SP2    
   -Microsoft Windows NT Enterprise Server 4.0 SP3    
   -Microsoft Windows NT Enterprise Server 4.0 SP4    
   -Microsoft Windows NT Enterprise Server 4.0 SP5    
   -Microsoft Windows NT Enterprise Server 4.0 SP6    
   -Microsoft Windows NT Enterprise Server 4.0 SP6a    
   -Microsoft Windows NT Server 4.0                    
   -Microsoft Windows NT Server 4.0 SP1                
   -Microsoft Windows NT Server 4.0 SP2                
   -Microsoft Windows NT Server 4.0 SP3                
   -Microsoft Windows NT Server 4.0 SP4                
   -Microsoft Windows NT Server 4.0 SP5                
   -Microsoft Windows NT Server 4.0 SP6                
   -Microsoft Windows NT Server 4.0 SP6a              
   -Microsoft Windows NT Workstation 4.0              
   -Microsoft Windows NT Workstation 4.0 SP1          
   -Microsoft Windows NT Workstation 4.0 SP2          
   -Microsoft Windows NT Workstation 4.0 SP3          
   -Microsoft Windows NT Workstation 4.0 SP4          
   -Microsoft Windows NT Workstation 4.0 SP5          
   -Microsoft Windows NT Workstation 4.0 SP6          
   -Microsoft Windows NT Workstation 4.0 SP6a          
Sambar Server 5.2 b                                    
   -Microsoft Windows 2000 Advanced Server            
   -Microsoft Windows 2000 Advanced Server SP1        
   -Microsoft Windows 2000 Advanced Server SP2        
   -Microsoft Windows 2000 Datacenter Server          
   -Microsoft Windows 2000 Datacenter Server SP1      
   -Microsoft Windows 2000 Datacenter Server SP2      
   -Microsoft Windows 2000 Professional                
   -Microsoft Windows 2000 Professional SP1            
   -Microsoft Windows 2000 Professional SP2            
   -Microsoft Windows 2000 Server                      
   -Microsoft Windows 2000 Server SP1                  
   -Microsoft Windows 2000 Server SP2                  
   -Microsoft Windows 95                              
   -Microsoft Windows 98                              
   -Microsoft Windows 98SE                            
   -Microsoft Windows ME                              
   -Microsoft Windows NT Enterprise Server 4.0        
   -Microsoft Windows NT Enterprise Server 4.0 SP1    
   -Microsoft Windows NT Enterprise Server 4.0 SP2    
   -Microsoft Windows NT Enterprise Server 4.0 SP3    
   -Microsoft Windows NT Enterprise Server 4.0 SP4    
   -Microsoft Windows NT Enterprise Server 4.0 SP5    
   -Microsoft Windows NT Enterprise Server 4.0 SP6    
   -Microsoft Windows NT Enterprise Server 4.0 SP6a    
   -Microsoft Windows NT Server 4.0                    
   -Microsoft Windows NT Server 4.0 SP1                
   -Microsoft Windows NT Server 4.0 SP2                
   -Microsoft Windows NT Server 4.0 SP3                
   -Microsoft Windows NT Server 4.0 SP4                
   -Microsoft Windows NT Server 4.0 SP5                
   -Microsoft Windows NT Server 4.0 SP6                
   -Microsoft Windows NT Server 4.0 SP6a              
   -Microsoft Windows NT Workstation 4.0              
   -Microsoft Windows NT Workstation 4.0 SP1          
   -Microsoft Windows NT Workstation 4.0 SP2          
   -Microsoft Windows NT Workstation 4.0 SP3          
   -Microsoft Windows NT Workstation 4.0 SP4          
   -Microsoft Windows NT Workstation 4.0 SP5          
   -Microsoft Windows NT Workstation 4.0 SP6          
   -Microsoft Windows NT Workstation 4.0 SP6a          
Sambar Server 5.2                                      
Sambar Server 5.3 b4
详细描述
Sambar Server没有充分过滤用户提交中混入的HTML代码,可以导致跨站脚本攻击,远程攻击者可以利用脚本代码创建一个恶意的链接,使之在用户的浏览器中执行,攻击者可能窃取目标用户基于Cookie的认证信息。

测试代码
http://[target]/netutils/ipdata.stm?ipaddr=[hostile_code]

http://[target]/netutils/whodata.stm?sitename=[hostile_code]

http://[target]/netutils/findata.stm?user=[hostile_code]

http://[target]/netutils/findata.stm?host=[hostile_code]

http://[target]/isapi/testisa.dll?check1=[hostile_code]

http://[target]/cgi-bin/environ.pl?param1=[hostile_code]

http://[target]/samples/search.dll?query=[hostile_code]&logic=AND

http://[target]/wwwping/index.stm?wwwsite=[hostile_code]

http://[target]/syshelp/stmex.stm?foo=[hostile_code]&bar=456

http://[target]/syshelp/stmex.stm?foo=123&bar=[hostile_code]

http://[target]/syshelp/cscript/showfunc.stm?func=[hostile_code]

http://[target]/syshelp/cscript/showfncs.stm?pkg=[hostile_code]

http://[target]/syshelp/cscript/showfnc.stm?pkg=[hostile_code]

http://[target]/sysuser/docmgr/ieedit.stm?path=[hostile_code]

http://[target]/sysuser/docmgr/ieedit.stm?name=[hostile_code]

http://[target]/sysuser/docmgr/edit.stm?path=[hostile_code]

http://[target]/sysuser/docmgr/edit.stm?name=[hostile_code]

http://[target]/sysuser/docmgr/iecreate.stm?path=[hostile_code]

http://[target]/sysuser/docmgr/create.stm?path=[hostile_code]

http://[target]/sysuser/docmgr/info.stm?path=[hostile_code]

http://[target]/sysuser/docmgr/info.stm?name=[hostile_code]

http://[target]/sysuser/docmgr/ftp.stm?path=[hostile_code]

http://[target]/sysuser/docmgr/htaccess.stm?path=[hostile_code]

http://[target]/sysuser/docmgr/mkdir.stm?path=[hostile_code]

http://[target]/sysuser/docmgr/rename.stm?path=[hostile_code]

http://[target]/sysuser/docmgr/rename.stm?name=[hostile_code]

http://[target]/sysuser/docmgr/search.stm?path=[hostile_code]

http://[target]/sysuser/docmgr/search.stm?query=[hostile_code]

http://[target]/sysuser/docmgr/sendmail.stm?path=[hostile_code]

http://[target]/sysuser/docmgr/sendmail.stm?name=[hostile_code]

http://[target]/sysuser/docmgr/template.stm?path=[hostile_code]

http://[target]/sysuser/docmgr/update.stm?path=[hostile_code]

http://[target]/sysuser/docmgr/update.stm?name=[hostile_code]

http://[target]/sysuser/docmgr/vccheckin.stm?path=[hostile_code]

http://[target]/sysuser/docmgr/vccheckin.stm?name=[hostile_code]

http://[target]/sysuser/docmgr/vccreate.stm?path=[hostile_code]

http://[target]/sysuser/docmgr/vccreate.stm?name=[hostile_code]

http://[target]/sysuser/docmgr/vchist.stm?path=[hostile_code]

http://[target]/sysuser/docmgr/vchist.stm?name=[hostile_code]

http://[target]/cgi-bin/testcgi.exe?[hostile_code]

解决方案
厂商还未提供解决方案。

相关信息
Gregory Le Bras <gregory.lebras@security-corporation.com>

Multiple vulnerabilities in Sambar Server
http://www.security-corporation.com/index.php?id=advisories&a=012-FR