BUGTRAQ ID: 28081 CVE(CAN) ID: CVE-2008-1117,CVE-2008-1118 Motorola的Timbuktu Pro是一款远程控制软件，允许远程访问计算机桌面。 Timbuktu的tb2pro.exe所加载的tb2ftp.dll库在实现Notes功能期间检查目标文件名时没有正确地过滤“\”和“/”字符，允许攻击者执行目录遍历攻击，向目标机器的任意位置上传文件；Timbuktu直接从用户所发送的报文中获取了一些包含有对等端信息的字段（计算机名、用户名、IP地址等），并在目标机器的屏幕上显示这些信息，这就允许攻击者在受害用户的日志行中伪造对等端信息。 以下是反汇编的漏洞代码： /----------- .text:6063A62E mov edx, [ebp+lp] .text:6063A631 mov eax, [edx+20h] ; Packet field containing filename .text:6063A634 push eax ; EAX is also the output buffer .text:6063A635 call ds:Pascal2C ; Extract filename from packet .text:6063A63B push '\' ; Char to filter in the filename .text:6063A63D mov ecx, [ebp+lp] .text:6063A640 mov edx, [ecx+20h] .text:6063A643 push edx ; Filename obtained in 0x6063A635 .text:6063A644 call _strrchr ; Search for '\' in the filename .text:6063A649 add esp, 8 ; At this point, the pointer to the ; position of the '\' is obtained and ; will be stored in a local variable. .text:6063A64C mov [ebp+pSlashPosition], eax ; Store '\' pointer...
BUGTRAQ ID: 28081 CVE(CAN) ID: CVE-2008-1117,CVE-2008-1118 Motorola的Timbuktu Pro是一款远程控制软件，允许远程访问计算机桌面。 Timbuktu的tb2pro.exe所加载的tb2ftp.dll库在实现Notes功能期间检查目标文件名时没有正确地过滤“\”和“/”字符，允许攻击者执行目录遍历攻击，向目标机器的任意位置上传文件；Timbuktu直接从用户所发送的报文中获取了一些包含有对等端信息的字段（计算机名、用户名、IP地址等），并在目标机器的屏幕上显示这些信息，这就允许攻击者在受害用户的日志行中伪造对等端信息。 以下是反汇编的漏洞代码： /----------- .text:6063A62E mov edx, [ebp+lp] .text:6063A631 mov eax, [edx+20h] ; Packet field containing filename .text:6063A634 push eax ; EAX is also the output buffer .text:6063A635 call ds:Pascal2C ; Extract filename from packet .text:6063A63B push '\' ; Char to filter in the filename .text:6063A63D mov ecx, [ebp+lp] .text:6063A640 mov edx, [ecx+20h] .text:6063A643 push edx ; Filename obtained in 0x6063A635 .text:6063A644 call _strrchr ; Search for '\' in the filename .text:6063A649 add esp, 8 ; At this point, the pointer to the ; position of the '\' is obtained and ; will be stored in a local variable. .text:6063A64C mov [ebp+pSlashPosition], eax ; Store '\' pointer .text:6063A64F cmp [ebp+pSlashPosition], 0 ; This is the BUG !!!! .text:6063A653 jnz short loc_6063A669 ; It avoids checking '/' if ; '\' was found, so we must ; send '\' and then as much ; "../" as we want :) .text:6063A655 push '/' ; This check won't be done .text:6063A657 mov eax, [ebp+lp] ; because the '\' was found .text:6063A65A mov ecx, [eax+20h] .text:6063A65D push ecx .text:6063A65E call _strrchr .text:6063A663 add esp, 8 .text:6063A666 mov [ebp+pSlashPosition], eax .text:6063A669 loc_6063A669: .text:6063A669 cmp [ebp+pSlashPosition], 0 ; Check if a slash was ;found so .text:6063A66D jz short loc_6063A68C ; it copies past it's ;position .text:6063A66F push 200h .text:6063A674 mov edx, [ebp+pSlashPosition]; Get the '\' position and move .text:6063A677 add edx, 1 ; forward 1 byte to avoid it .text:6063A67A push edx .text:6063A67B mov eax, [ebp+lp] .text:6063A67E add eax, 4B0h .text:6063A683 push eax .text:6063A684 call ds:lstrcpynA ; From know on, the filename .text:6063A68A jmp short loc_6063A6A ; contains something like ; ../a.exe :) . . . . . - -----------/ Motorola Timbuktu Pro for Windows 8.6.5 Motorola -------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： <a href=http://www.motorola.com/ target=_blank>http://www.motorola.com/</a>
