当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0118546

漏洞标题:长治农商银行某服务器存在心脏出血

相关厂商:cncert国家互联网应急中心

漏洞作者: 路人甲

提交时间:2015-06-07 12:11

修复时间:2015-07-25 14:00

公开时间:2015-07-25 14:00

漏洞类型:系统/服务补丁不及时

危害等级:高

自评Rank:20

漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-06-07: 细节已通知厂商并且等待厂商处理中
2015-06-10: 厂商已经确认,细节仅向厂商公开
2015-06-20: 细节向核心白帽子及相关领域专家公开
2015-06-30: 细节向普通白帽子公开
2015-07-10: 细节向实习白帽子公开
2015-07-25: 细节向公众公开

简要描述:

**

详细说明:

http://czrcb.net/
分站存在心脏出血:https://e.czrcb.net/
121.43.71.188

: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Connection: closeReferer: https://e.czrcb.net/p2b/images/images/tender/images/tender/images/images/css/public.cssCookie: JSESSIONID=7B660A2E23DDE8E5A3056217765ECA86i9G(6_`76Nq9+,zh;q=0.8Cookie: JSESSIONID=A4D45986664E81D4CD6BD8573F28E9788OV\}`O8 Xage: zh-CN,zh;q=0.8Cookie: JSESSIONID=A4D45986664E81D4CD6BD8573F28E978aaD-DV.P845a93f701a42daf2a6ed5d48616newLoginPw=Q110SX0420&rePwd=Q110SX0420R~NAl>[+eVE85}sk(jexFgm>lEUl4+O]!:TV:O(9o~QMC,Jws  '{"maxPreRate":"input","maxPrerate":0.0};charset=UTF-8Content-Length39@ @ ~)xl@lYJ+([%.x:*TIYmZ600^{j^0*H010UUS10UUT10USalt Lake City10UThe USERTRUST Network1!0Uhttp://www.usertrust.com10UUTN - DATACorp SGC0990624185721Z190624190630Z0U10UCN10UWoSign CA Limited1*0(U!Certification Authority of WoSign0"0*H0V{k\zk#1>)o=k@_9zMT}"xKt~I(D2%Sq'gh]]pSA6fz~V_h 6$,,GYvf00,(T.vhJl.\~2^*BNYz~Zi'{T{TzQhnwRJfFgOw]VCrw9/0B7!0pXM}72:cq$7t7F`?P6zbjnj!Zip9n;qRwoBmJ4H"1?> ydd1REi*UFKJ[9(.HK&0LXDO3q)vO%//'J|EE=10-0U#0S2]NEO0UfK >0U0U004U%-0++++7`HB0U 00U 0BU;0907531http://crl.trust-provider.com/UTN-DATACorpSGC.crl0:+.0,0*+0http://ocsp.trust-provider.com0*H3q.fvj5:0%]-+_|/N"peQMU] Zj5R/"\'R9'w :o6`-")ZY{q1qwz/(1LrrxTk/eCjp0Tu@b1@b@ll l lq@l`Hl0lll`llHl lIlpllllallPPll`Hlllll@!llll ll`HlqlxlxllPxlxlQxlxlllllllllllll@&l@&lxlxl@PB}llNlNl`Ull@bl@blcllPhlPhlpenlenlpf l]p!llp!lp!l!llpl lllT@bpeQMUnUZMT \<FcKyx;Qy o\qmhaYdD:q'PFZaMn4bP\7 mpr>YEa*VB .$g-u_APXll0sl0sl@DlW/Q ll@tllEl@sl@q+ul0http://1.wosign.comQxllwl0xlaSllxlxl^0*H010UUS10UUT10USalt Lake City10UThe USERTRUST Network1!0Uhttp://www.usertrust.com10UUTN - DATACorp SGC0990624185721Z190624190630Z0U10UCN10UWoSign CA Limited1*0(U!Certification Authority of WoSign0"0*H0V{k\zk#1>)o=k@_9zMT}"xKt~I(D2%Sq'gh]]pSA6fz~V_h 6$,,GYvf00,(T.vhJl.\~2^*BNYz~Zi'{T{TzQhnwRJfFgOw]VCrw9/0B7!0pXM}72:cq$7t7F`?P6zbjnj!Zip9n;qRwoBmJ4H"1?> ydd1REi*UFKJ[9(.HK&0LXDO3q)vO%//'J|EE=10-0U#0S2]NEO0UfK >0U0U004U%-0++++7`HB0U 00U 0BU;0907531http://crl.trust-provider.com/UTN-DATACorpSGC.crl0:+.0,0*+0http://ocsp.trust-provider.com0*H3q.fvj5:0%]-+_|/N"ux8z_yzbp`spvZHqt[[{| lH|}l0nrvOp`tSRPruMptMl@@ll`allwtl@l 40l01`llDlad0la@llylIll@zdl@l@lp`pvHqQll{lp|l|l lIl`l@lQplIl4@l
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed


漏洞证明:

RT

修复方案:

**

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:5

确认时间:2015-06-10 13:59

厂商回复:

CNVD确认并复现所述漏洞情况,已经转由CNCERT下发给山西分中心,由山西分中心后续协调网站管理单位处置。

最新状态:

暂无