漏洞详情

披露状态:

2014-10-21: 细节已通知厂商并且等待厂商处理中
2014-10-26: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

神器发现韵达快递某系统存在远程命令执行漏洞

详细说明:

http://video.yundasys.com:8080/login.action

Whoami: root
WebPath: /opt/avcond/jboss/webapps/ROOT
OS.Name: Linux
OS.Version: 2.6.18-128.el5
Java.Home: /opt/avcond/java
Java.Version: 1.6.0_26
OS.arch: i386
User.Name: root
User.Home: /root
User.Dir: /
Java.Class.Path: :/opt/avcond/jboss/bin/bootstrap.jar
Java.IO.Tmpdir: /opt/avcond/jboss/temp

漏洞证明:

eth0      Link encap:Ethernet  HWaddr 00:15:17:E6:01:70
inet addr:192.168.1.80 Bcast:192.168.1.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:9911503 errors:8 dropped:0 overruns:0 frame:4
TX packets:740000 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1144173278 (1.0 GiB) TX bytes:316590229 (301.9 MiB)
Base address:0x1000 Memory:81920000-81940000
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:11692653 errors:0 dropped:0 overruns:0 frame:0
TX packets:11692653 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:738642004 (704.4 MiB) TX bytes:738642004 (704.4 MiB)

修复方案:

打补丁

标签: none

评论已关闭