当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0106992

漏洞标题:句酷多台服务配置不当

相关厂商:pigai.org

漏洞作者: JJ Fly

提交时间:2015-04-10 12:04

修复时间:2015-05-25 13:22

公开时间:2015-05-25 13:22

漏洞类型:系统/服务运维配置不当

危害等级:中

自评Rank:10

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-04-10: 细节已通知厂商并且等待厂商处理中
2015-04-10: 厂商已经确认,细节仅向厂商公开
2015-04-20: 细节向核心白帽子及相关领域专家公开
2015-04-30: 细节向普通白帽子公开
2015-05-10: 细节向实习白帽子公开
2015-05-25: 细节向公众公开

简要描述:

句酷多台服务配置不当

详细说明:

ip:

117.79.131.116 句酷搜索
117.79.131.100 句酷批改
117.79.131.105
100和105 目测新添加的,还没有什么信息。


1.png


2.png


漏洞证明:

# nc -vv 117.79.131.116 11211
Connection to 117.79.131.116 11211 port [tcp/*] succeeded!
stats items
STAT items:1:number 1120010
STAT items:1:age 1986081
STAT items:1:evicted 5218687
STAT items:1:outofmemory 0
STAT items:2:number 18724
STAT items:2:age 2981862
STAT items:2:evicted 55065
STAT items:2:outofmemory 0
STAT items:3:number 21843
STAT items:3:age 399950
STAT items:3:evicted 731555
STAT items:3:outofmemory 0
STAT items:4:number 113960
STAT items:4:age 3710298
STAT items:4:evicted 783918
STAT items:4:outofmemory 0
STAT items:5:number 655255
STAT items:5:age 12682182
STAT items:5:evicted 457054
STAT items:5:outofmemory 0
STAT items:6:number 10626
STAT items:6:age 13153998
STAT items:6:evicted 5022
STAT items:6:outofmemory 0
STAT items:7:number 36244
STAT items:7:age 2050179
STAT items:7:evicted 110214
STAT items:7:outofmemory 0
STAT items:8:number 683
STAT items:8:age 13917852
STAT items:8:evicted 0
STAT items:8:outofmemory 0
STAT items:9:number 427
STAT items:9:age 13894443
STAT items:9:evicted 0
STAT items:9:outofmemory 0
STAT items:10:number 15499
STAT items:10:age 2703364
STAT items:10:evicted 21082
STAT items:10:outofmemory 0
STAT items:11:number 11200
STAT items:11:age 2806584
STAT items:11:evicted 11861
STAT items:11:outofmemory 0
STAT items:12:number 10692
STAT items:12:age 2818039
STAT items:12:evicted 12502
STAT items:12:outofmemory 0
STAT items:13:number 8544
STAT items:13:age 2937391
STAT items:13:evicted 6013
STAT items:13:outofmemory 0
STAT items:14:number 7966
STAT items:14:age 2881128
STAT items:14:evicted 4793
STAT items:14:outofmemory 0
STAT items:15:number 8645
STAT items:15:age 2746059
STAT items:15:evicted 5173
STAT items:15:outofmemory 0
STAT items:16:number 9464
STAT items:16:age 2749442
STAT items:16:evicted 3999
STAT items:16:outofmemory 0
STAT items:17:number 10767
STAT items:17:age 2810183
STAT items:17:evicted 3393
STAT items:17:outofmemory 0
STAT items:18:number 6960
STAT items:18:age 2333917
STAT items:18:evicted 5448
STAT items:18:outofmemory 0
STAT items:19:number 6138
STAT items:19:age 2593848
STAT items:19:evicted 4946
STAT items:19:outofmemory 0
STAT items:20:number 3404
STAT items:20:age 2692469
STAT items:20:evicted 2937
STAT items:20:outofmemory 0
STAT items:21:number 329
STAT items:21:age 13690202
STAT items:21:evicted 0
STAT items:21:outofmemory 0
END
stats cachedump 10 10
ITEM dict:door_panel [628 b; 1414632175 s]
ITEM dict:ever_since [644 b; 1414632175 s]
ITEM dict:pioneering_spirit [657 b; 1414632175 s]
ITEM dict:At_the_same_time [656 b; 1414632175 s]
ITEM dict:胂 [617 b; 1414632175 s]
ITEM dict:welcome_guest [649 b; 1414632175 s]
ITEM dict:crack_jokes [645 b; 1414632175 s]
ITEM dict:count_as [624 b; 1414632175 s]
ITEM dict:两者 [618 b; 1414632175 s]
ITEM dict:no_wonder [656 b; 1414632175 s]
END
get dict:door_panel
VALUE dict:door_panel 1 628
a:2:{i:0;a:2:{s:5:"value";s:305:"<div style='white-space:normal; width:180px; letter-spacing:1px; color:olive'><tr><td><b>door panel</b>: </td></tr><tr><td style='font-size:12px;padding-top:10px'></td></tr><tr><td style='font-size:12px'>n. <a href='show-door panel+扉-0.html'><font color=olive><u>扉</u></font> </a><</td></tr></div>";s:5:"title";s:12:"英汉词典";}i:1;a:2:{s:5:"value";s:191:"<tr><td><div style='white-space:normal; width:180px; letter-spacing:1px; color:olive'><img src='http://chart.apis.google.com/chart?cht=p&chd=t:100&chs=200x120&chl=%E6%89%89'/></div></td></tr>";s:5:"title";s:12:"释义分布";}}
END
UE dict:door_panel 1 628

修复方案:

http://drops.wooyun.org/papers/865

版权声明:转载请注明来源 JJ Fly@乌云


漏洞回应

厂商回应:

危害等级:低

漏洞Rank:5

确认时间:2015-04-10 13:20

厂商回复:

感谢提醒,马上修复

最新状态:

暂无