当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0147763

漏洞标题:某邮箱过亿数据泄漏(涉及邮箱账号/密码/用户密保等)

相关厂商:某邮箱

漏洞作者: 路人甲

提交时间:2015-10-19 16:40

修复时间:2015-12-07 16:04

公开时间:2015-12-07 16:04

漏洞类型:用户资料大量泄漏

危害等级:高

自评Rank:20

漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-10-19: 细节已通知厂商并且等待厂商处理中
2015-10-23: 厂商已经确认,细节仅向厂商公开
2015-11-02: 细节向核心白帽子及相关领域专家公开
2015-11-12: 细节向普通白帽子公开
2015-11-22: 细节向实习白帽子公开
2015-12-07: 细节向公众公开

简要描述:

数据过亿交易证明数据/包含邮箱密码密保信息/登陆ip以及用户生日等,其中密码密保均为MD5存储,解开后测试大部分邮箱依旧还可登陆

详细说明:

具体数据如下:

xsd3664764@**.**.**.**,f19053ca00fd78235ae6b478650a6af1,"dghnadgjd ",8c27bc9c074454f8622ddb6966aace63,**.**.**.**,1990-02-26
huwenhua0451@**.**.**.**,164d03a008a29c1382739ab5bac7680b,"你的名字叫什么? ",b25adbac66d31a65412a19462e4c123b,**.**.**.**,1970-01-05
"4810595@**.**.**.**,hualuoshen@**.**.**.**",dcfee42fa1811ab22be92ec7a651dd4a,"who are you? ",f944079366abad2283748a6693b0fe9b,**.**.**.**,1982-02-05
13589639787@**.**.**.**,56e62457831e7abbb9fd5a3781088d7f,,,**.**.**.**,
"11qww@**.**.**.**,maangjay@**.**.**.**",82273a6ba2126d3af24ce2d0cb0af515,"qweqweqweqwe ",15b3e8ab166870dd5840ca6338ac5de8,**.**.**.**,1988-01-01
wsh951069@**.**.**.**,b40e6232dfc32e4ad22881be20968e57,"我的儿子叫什么? ",8a553dfa272be86cc1774a1afcd5c1c8,**.**.**.**,1973-12-24
xiecghunliang@**.**.**.**,7417c39229c9f550182f4907ffa38edf,"1985815 ",6a59d1ee75e8c6d7ad8b74b7759799b8,**.**.**.**,1985-08-15
pg-0001@**.**.**.**,dc483e80a7a0bd9ef71d8cf973673924,"我最爱的人的名字? ",5042804dd27e2da7f766026bc5c4578e,**.**.**.**,1977-09-01
123_456_78919@**.**.**.**,881f75818aa84d37f5bb1657737043aa,"11111111119 ",be3e49809cb3cb8c582f16aa05c96860,**.**.**.**,1988-05-08
"qq.km@**.**.**.**,km-ai-lele521@**.**.**.**",05cf8945ee428eb10fa989f9f960e0be,"我是好人吗 ",5ac35c3b2ece60202daeae478a1c50d2,**.**.**.**,1988-06-29
lxs98417@**.**.**.**,87a65443f1540f8887055e325bfa834c,"654321 ",7e8feb2276322ecddd4423b649dfd4d9,**.**.**.**,1985-01-01
"zhuweidong_822@**.**.**.**,zhangren1226@**.**.**.**",066a92a66171e323e01eaf85378664bb,"111111 ",69d5708b75c413551e1f8087804bc429,**.**.**.**,1987-01-25
duanruiqiang558@**.**.**.**,13ddc6d1796b1e4473dcb53eb6aa6f2e,"你是谁? ",2cc674d668eadda0603e8e05a827501f,**.**.**.**,1984-12-02
lll-5230257@**.**.**.**,e10adc3949ba59abbe56e057f20f883e,"我的哥哥是谁? ",42451db3f7f11de97cb6ed58bdf60cf3,**.**.**.**,1992-10-01
"lxsjjj@**.**.**.**,lxsjjj000@**.**.**.**",07f408356020dea72fbf6f286f1345d4,"123456 ",272f51dffa9e44ced26338b1527e7274,**.**.**.**,1985-04-07
778899993@**.**.**.**,579904acc0e4c711695355c548724026,"123456 ",6a59d1ee75e8c6d7ad8b74b7759799b8,**.**.**.**,1995-06-07
"qiubo0812@**.**.**.**,qiu19840812@**.**.**.**",82e83745159f3bd206e612ca4f2e4811,"我的哥哥是谁? ",544c8c28e0a621f0fdb26c36944b417b,**.**.**.**,1984-08-13
"wenhongd@**.**.**.**,lxsn12345@**.**.**.**",2ae96d469afbd9cbab615e57844eb429,"werfwetwet ",1957fe5609453392816be2d7e3b9fc6a,**.**.**.**,1981-01-01
sinwin@**.**.**.**,2b1fb1ecfa14b94813dd33cd82842ba0,"梦想拷 ",9b1eb6b358d6d86750201131ca69a56d,**.**.**.**,1981-06-18
lzl.5628765@**.**.**.**,e6321cf2ba11c944037291870cf1e468,"我最喜欢的休闲运动是什么? ",004f59ba269f0167edfb9cacc3ce24af,**.**.**.**,1988-06-24
lxt554548193@**.**.**.**,5a316347b2ec0c0851f2f946cef9bfa6,"你叫什么名字? ",902c96f7ecf2675ad656459447481310,**.**.**.**,1995-03-23
qq368255555@**.**.**.**,8c060fe5581f5786f0f155ffee112496,"FRYGRDYDF ",72aec07d95d721a7b241a4306bf78fc2,**.**.**.**,1995-01-01
zhangqikko@**.**.**.**,77097ffae466de6ff7ec54a89bf5f181,"我是谁 ",3dc3c0cf4176733b474c7bc4678357d5,**.**.**.**,1984-09-10
13932591158@**.**.**.**,dd4e31d8a83e634ab5c32454a8967b1c,,,**.**.**.**,
"zhaozhhi@**.**.**.**,zhaozhhi@**.**.**.**",23a26d04161d7c00d2184285a4d83a95,"10 ",31dc8e8dc41024102f70d5f43abc5e39,**.**.**.**,1973-03-29
13891841383@**.**.**.**,abb42a3e90a4053d30c18b38c1d213bc,,,**.**.**.**,
"wwa@**.**.**.**,zhangqilong987@**.**.**.**",07893a5598e6126a3dde4e9ab7ba57ab,"sssssssa ",7b6cc6c95b009b8264f21e288c93ee64,**.**.**.**,1990-07-05
"xiaogao33@**.**.**.**,xiaogao136boy@**.**.**.**",daf5cac7496665ca16a6e3bfa15fde7b,"我爸手机 ",df4b346611b4fc9bddf7e7864a0d894d,**.**.**.**,1990-10-29
"guyangjing@**.**.**.**,gyjgyz@**.**.**.**",b0bbbf10dadb0cdffe49f9be7ee43613,"我的哥哥 ",a3c2b6a6f5bbe169ac725bacc71cafd8,**.**.**.**,1983-01-02
"lxyangzhong@**.**.**.**,lxyangzhong@**.**.**.**",d01ec126f1c16d555b24e1c806ad153c,"你多大年龄? ",7879b87e332d6631fb229f37ed55b23d,**.**.**.**,1987-11-30
13141294794@**.**.**.**,55807e861904c91889041169343cf2bb,,,**.**.**.**,
13992408055@**.**.**.**,8e46726fd42f39913d2349bbdb4e70c4,,,**.**.**.**,
zhangqiloverenyi@**.**.**.**,7834fde6e32c0bfafb8264dd9d03e75e,"woaizhangqi ",5baa0a1102eed1cad67ada5eb9d0c102,**.**.**.**,1992-01-01
"fh81.kiki@**.**.**.**,aesy001@**.**.**.**",826ad6b0338304c40b42644b5144f80a,"5838225 ",3afdc4c03b5335e265b4509cf02cfa8d,**.**.**.**,1985-08-01
zhangqin19851015@**.**.**.**,94fc2b832e1e5b71d99b3780f17925c8,"我的好朋友是谁 ",6afbeae508773e6ec831e4199289d052,**.**.**.**,1985-10-15
"abc4429020@**.**.**.**,abc444466@**.**.**.**",e10adc3949ba59abbe56e057f20f883e,"我我我我我我 ",9f51013985411a6c68887904bd8963cd,**.**.**.**,1989-01-01
592352484@**.**.**.**,aa8345214b4a7561eeeecdb4f653e354,"我的爱 ",eb0469d227ffb472d7f7e7d83e70ad78,**.**.**.**,1991-11-10
13017826209@**.**.**.**,92867e98879dc90e390a4bc8f2cb2a9d,,,**.**.**.**,
"[email protected],zhangqin7018@**.**.**.**",3e43fee2fb33f8499912e0ecb675f70c,"肖英肖英肖英 ",b53cfc6fa859f089b55e45df1d3677ab,**.**.**.**,1970-01-08
"lintan@**.**.**.**,zhangqinfua@**.**.**.**",87703156b9cdfa7da1054392256b4c20,"1111111 ",787890a76ce1ffacc9f6421a70230bfd,**.**.**.**,1987-10-22
"461348695@**.**.**.**,663528318@**.**.**.**",ebb23c2c2659e1586a336249bc1f2d9b,"我就读的第一所学校的名称? ",0d0d197d07285f77906e5250ce5f0b0d,**.**.**.**,1993-03-01
"jackchenqiang1989@**.**.**.**,jackchenqiang1@**.**.**.**",d4c10a17d07b6289348fe47b3892cb08,"我是谁? ",a387749e2b8ddc8a3315f70534402795,**.**.**.**,1989-06-27
"zay1300@**.**.**.**,xzxz1213@**.**.**.**",4ce02ccdecb57a8c88806919f3ddabe6,"没什么好说的 ",7136eb1392ca9c3e83e84c48e5944754,**.**.**.**,1978-03-29
"yuiopwqm@**.**.**.**,379165396@**.**.**.**",e10adc3949ba59abbe56e057f20f883e,"111111 ",8e2e90ccf85b244f307d813660c48f90,**.**.**.**,1990-01-01
abba_cd@**.**.**.**,da2188952080a5dabe486799bf0fd988,"我住在那里 ",8008d8b65654c427efde6e15bc82a4b1,**.**.**.**,1980-01-10
hongxue_8866@**.**.**.**,0ed98ccf43a306a5e6e615cb85ba7c11,"我的妹妹是谁? ",bac96827a6d5dbfded6557172a138a6c,**.**.**.**,1982-09-23
"[email protected],rongrong198743@**.**.**.**",e35d2da42b8fab718184b5739ed410db,"dianhua ",e55d5d54caf2376f88508f3463550176,**.**.**.**,1987-04-03
"username@**.**.**.**,4852146ytah@**.**.**.**",25478fda1367c0ef81cd4c7168babb4a,"123456 ",8a2a90d67766f8639363b9476bd31ac5,**.**.**.**,1993-03-07
84dj@**.**.**.**,dfb55217f8dd095cd510c0950d3852aa,"吃什么哪 ",22e18a134123aa0bd48da2d6929600f2,**.**.**.**,1984-05-20
rongxing120@**.**.**.**,9798e8221889a7fc1768879a09ab09d3,"rongxing ",40f1a95c419f2a53b01d0b7979df6982,**.**.**.**,1985-08-14
xiezewen12345@**.**.**.**,45101b093c4e8acf32a525dc231afd50,"我最喜欢的食物? ",970afedf6524f3e0c13bb51822352e4b,**.**.**.**,1985-07-19
"luyangju2010@**.**.**.**,luyangju2006@**.**.**.**",5b0859e0152d5c79c9c464b47889ec14,"你好 ",68feb721f76489a499c8bfe242ffe72f,**.**.**.**,1991-02-22
zhanghy0804@**.**.**.**,2d0bee1325dffbe41415a3f55fdbf5f2,"102884 ",7e8feb2276322ecddd4423b649dfd4d9,**.**.**.**,1984-10-28
"lineryuan@**.**.**.**,lineryuan11@**.**.**.**",aff35c6474e04d729ce1f2afe7431852,"hello?hello? ",49aaadd1e36d16372f0ebc4964ecb3f0,**.**.**.**,1978-10-09
luzhenglong1101@**.**.**.**,e15c44c0ca7aaac0ad6c9a14ce8bb330,"我的密码 ",f435780a524a9368031f6450a3897f8a,**.**.**.**,1982-11-01
"tedted3@**.**.**.**,tedted3ted@**.**.**.**",e10adc3949ba59abbe56e057f20f883e,"web?10 ",7e679c9c860d3ac633793623ec1636f2,**.**.**.**,1978-01-01
"[email protected],weikanghua123@**.**.**.**",977fb5505ecab09f0ac4c4cbd00104e6,"我的哥哥是谁? ",a7d79850004cd11823a5610c1ed32cbb,**.**.**.**,1986-01-01
"jiangsu83@**.**.**.**,aimy521zsh@**.**.**.**",826d444601fca5e7a5d44a92ac571fd8,"我最喜欢的运动员是谁? ",72f87e5254c83d12f8991893ae8f35a5,**.**.**.**,1974-01-01
mh163164@**.**.**.**,69eee85465438d9c013b14bb7210cc7d,"我的初恋日期? ",eaf527aef7085f7d614e56912d724497,**.**.**.**,1995-01-01
"504258016@**.**.**.**,whitesnow.ok@**.**.**.**",d488433fe36188c73814df48d0fb4cfe,"今年第一场下的是什么? ",ce0bdd44b7e3008ef77ee746657eec93,**.**.**.**,1984-10-01
"345219767@**.**.**.**,lhgcgxeq@**.**.**.**",121bf344cad3b410322b2df01abf23cc,"我最爱的人的名字? ",b3df92fd2f24fcb0d2cbabfe8b9c9321,**.**.**.**,1992-09-02
"username@**.**.**.**,tuanyuan1990@**.**.**.**",e10adc3949ba59abbe56e057f20f883e,"wqeqwe ",5d7512da60e0135c2edfaa9aaa405afc,**.**.**.**,1990-01-01
"kelong16@**.**.**.**,kelongha@**.**.**.**",6f7b6abf34f2e4c922c487dd36c69aca,"11111 ",2b3a3de95d9bd0b1e98b3305cb653d1d,**.**.**.**,1988-05-09
13501099550@**.**.**.**,1741542df8086e1873676cf25ce91578,,,**.**.**.**,
13047179982@**.**.**.**,b9c9be8be23ac79561b5c4819b215120,,,,
"[email protected],xiongjun-6@**.**.**.**",93cc02ef717e2c68bb65686f1f223047,"我叫什么名字 ",26c3c1929820af988d43ac0898d72c7d,**.**.**.**,1990-06-06
qbdaisy@**.**.**.**,fd6ef2e56ed827878b3cf409a97e7d65,"我一直喜欢的男生 ",7e01f04d10db6c69fc506e28441bfa65,**.**.**.**,1989-01-30
jianyanyin1@**.**.**.**,df920cd58cd53cbadd6527477a525efa,"生日 ",9478d24e6f31b6fd7f3cbd9572012c18,**.**.**.**,1987-06-14
13518933902@**.**.**.**,be4cf4d5396dc103d3262f2e4cce5510,,,,
gaoshuzhene@**.**.**.**,586294894434d03e2fa9b9f310092c3a,"你的名字叫什么 ",22f6a555a1ca5abb8669382d5c86c95d,**.**.**.**,1981-07-11
"dq5778@**.**.**.**,dq54321@**.**.**.**",d5b0054d94ac7056d775e5db2c62ea8a,"我的生日 ",9f07a5bf083c1748e6691ced1aef8d20,**.**.**.**,1981-08-23
"uzernam@**.**.**.**,mairedan1@**.**.**.**",e10adc3949ba59abbe56e057f20f883e,"我哥哥是谁? ",1c5bc6124b92a3336cbf064fad082ad9,**.**.**.**,1987-07-08
xuxiaoxiong200510@**.**.**.**,e10adc3949ba59abbe56e057f20f883e,"hi ",1bc536da1c447709dd380c8adccca079,**.**.**.**,1979-10-27
zhangyuning198709@**.**.**.**,84eacadbc09847c877b197678c15ea29,"你是谁 ",644af14a803042e06ed92c926b3e5abb,**.**.**.**,1987-09-12
"ahxhy1544@**.**.**.**,vteeywwgnui2@**.**.**.**",adaa2c3c2448b2ac6c26e7a6092f5bc5,"我是谁??? ",5bc9e1e2beafe96cc136c5eca84b191a,**.**.**.**,1980-09-26
"593149087@**.**.**.**,3740204@**.**.**.**",5a7dccdba775b92dcb9b968beeeaa0dd,"我最喜欢的歌曲? ",0ae12e3f672cb7dc755f976bd0dbe9ba,**.**.**.**,1987-12-28
"lizhishuaige@**.**.**.**,05w111@**.**.**.**",c9faf6d8983cfe4b77ea533b44ede759,"sdfsdfsdfsdfsdf ",7ab54fd2c2612ec84c193c14a47351c8,**.**.**.**,1998-01-01
flywings_succes@**.**.**.**,0c126a8eb53c8e9ea7061c8c74644b52,"我是谁? ",96c80df91bd137593fd232e79bd91f8f,**.**.**.**,1985-04-22
13178648148@**.**.**.**,c90ca88341e29f5cc095241f9abc90de,,,**.**.**.**,
"daqiao98@**.**.**.**,daqiao98@**.**.**.**",66e22d9ddcacb0027b936d367fdbcf2c,"jigjhijgihj ",1f75371b521406d32c1078b0c12cd951,**.**.**.**,1985-01-01
zhouwanwan108@**.**.**.**,a40d39693b01a8812a72e1e9f5af2133,"我爱吃什么菜 ",e4ad0ed45d25a41a2d4b4e96ce295bc2,**.**.**.**,1990-01-08
"cccwafxl@**.**.**.**,8wy3505677@**.**.**.**",0fc74b60af57dd25356ae0d6d65a18e1,"我是谁 ",65dc4652100b063fad443ccf0d1aaa8a,,1986-06-29
lyj3345482@**.**.**.**,907ae590e909c2ca813b16f83126d2f5,"A KFCOOO ",f1094d0b179c0f820f79a685bb059b03,**.**.**.**,1990-07-16
licx3201@**.**.**.**,6d7524fc13f86b3b6ce44ab1de4ff018,"我的哥哥是谁 ",7e8feb2276322ecddd4423b649dfd4d9,**.**.**.**,1982-10-10
"w_anthoney02@**.**.**.**.cn,airanna2@**.**.**.**",5379884c5ec4e06879f7400fd40be0d9,"!!!!!! ",2b3a3de95d9bd0b1e98b3305cb653d1d,**.**.**.**,1980-01-01
"zsw-cool123@**.**.**.**,gdahihgdsgds@**.**.**.**",25f9e794323b453885f5181f1b624d0b,"11111111111111111111111111 ",b2c0ec76ee73a4fa0b2ac825ca3441f7,**.**.**.**,1966-01-01
chengshuxiang100@**.**.**.**,8b752240a598a8a86af42f0e71044270,"shengri ",85e93a153960e7c3345cf0161ce96843,**.**.**.**,1983-04-01
"tosy163@**.**.**.**,hejunming2006@**.**.**.**",1e0f2320fae94a58b77ca2128cb8d365,"你的名 ",8435e9badcc6c0c6f39b33073b733ff3,**.**.**.**,1971-07-08
"jiangdongzhen@**.**.**.**,xizhi2008@**.**.**.**",c22d960d33e3a52a13a36b1aa916359e,"lancy的生日? ",309a8e1c2b345abdef48e0c049e769e4,**.**.**.**,1982-07-25
fengylf@**.**.**.**,ef0e2fa547b8ff69b2363bdf963363d2,"我的哥哥是谁? ",41e2625a2952359c2b7a0b94f57b9808,**.**.**.**,1990-01-09
chensong724@**.**.**.**,3a4e210b434ed8c8239613ec2de80f68,"我的哥哥是你妈 ",bbd34ad2fb48480a7dacbf3a6bc3ff4e,**.**.**.**,1985-07-24
"zhangdong@**.**.**.**,qq71062667@**.**.**.**",2c0acded5996d761175454adf8042195,"1989413 ",4bb4f7e307d5fe8e5d758b3ce3fc5f52,**.**.**.**,1989-04-13
"aa2216574@**.**.**.**,8wy3505682@**.**.**.**",e555c9add203b0ca0ce3b5a0536900d4,"什么呀?谁呀? ",69f6962f9a48dd3f24df8c67b27e16fc,,1990-07-29
zzhypj888@**.**.**.**,d90254b8ad13d0fab74dbe32b215ae72,"zhangchenyang ",cde1024e61e14509ba9d2c1a173b6f63,**.**.**.**,1974-12-01
8wy3505683@**.**.**.**,050745d7eaf75887e8ecfacfbb60ce03,nease,,,
"fangyao520617@**.**.**.**,chenyqiong520@**.**.**.**",a3338319d763c327bae51f68df52b98c,"我妈妈的生日? ",285d9e7fafe82ba635b8b59185f401e7,**.**.**.**,1986-02-07
"wendao1986@**.**.**.**,wendao_57@**.**.**.**",791e9a72e6dc7a0950996a4505482fcf,"liugang ",4291f1fd4c5a6ec9c0d413956e09ffe3,**.**.**.**,1986-06-17
"wpwqwqwp@**.**.**.**,2559357@**.**.**.**",4d89ac9e0830f0b3f7ffbe58321cae8f,"2559357 ",d4a6989fa3f86d6d8615c9b601f450df,**.**.**.**,1987-09-23
751651@**.**.**.**,880c03907d3c0a73c699a613edd24131,"?噶发 ",280dec841882b64d188a2a68023e98bd,**.**.**.**,1988-01-04
yangyu8685@**.**.**.**,f4190b54f36e2c8e506ea1b06765745e,"老婆的电话号码 ",79aba6358d84fa67c6a97603c12b35b4,**.**.**.**,1986-01-04


附赠截图:

1 - 副本.png


2 - 副本.png


3 - 副本.png


4 - 副本.png

漏洞证明:

163泄露数据:4.6亿
126泄露数据:7千300万

修复方案:

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:低

漏洞Rank:1

确认时间:2015-10-23 16:03

厂商回复:

最新状态:

2015-10-23:参见CNCERT公告:http://www.cert.org.cn/publish/main/11/2015/20151020212130321648804/20151020212130321648804_.html

2015-10-23:为避免风险信息披露,根据WOOYUN网站流程,先评分,不作为确认依据。