当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2012-015072

漏洞标题:激动网dns域传送漏洞

相关厂商:激动网

漏洞作者: VIP

提交时间:2012-11-21 17:23

修复时间:2012-11-26 17:24

公开时间:2012-11-26 17:24

漏洞类型:敏感信息泄露

危害等级:中

自评Rank:10

漏洞状态:漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2012-11-21: 细节已通知厂商并且等待厂商处理中
2012-11-26: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

又是一个配置不当引发的血案。。。。

详细说明:

激动网的dns服务器:ns2.joy.cn配置不当,导致dns域传送漏洞

n1.jpg


> ls joy.cn
[ns2.joy.cn]
joy.cn. NS server = ns1.joy.
joy.cn. NS server = ns2.joy.
joy.cn. A 122.227.189.192
3g A 59.151.105.154
image1.3g A 59.151.105.185
image1.3g A 59.151.123.233
pay.3g A 59.151.105.154
video1.3g A 59.175.147.67
video1.3g A 59.175.147.69
4g A 59.151.105.154
86get A 59.151.105.130
86get A 59.151.105.131
86get A 59.151.105.132
86get A 59.151.105.133
86get A 59.151.105.138
86get A 59.151.105.139
86log A 59.151.105.134
86log A 59.151.105.135
86log A 59.151.105.136
86manage A 59.151.105.137
gzcmcc.3gcdn.app A 120.197.88.84
gzcmcc.3gcdn.app A 120.197.88.85
sjzcnc.3gcdn.app A 61.55.168.51
sjzcnc.3gcdn.app A 61.55.168.52
whct.3gcdn.app A 59.175.147.67
whct.3gcdn.app A 59.175.147.69
whct1.3gcdn.app A 59.175.147.73
act.app A 122.227.189.104
pms.lan.api.app A 192.168.10.20
yunmsx.api.app A 192.168.10.20
comment.app A 122.227.189.175
comment.app A 122.227.189.210
comment.app A 122.227.189.211
admin.comment.app A 122.227.189.201
eas.app A 59.151.105.180
idcmstask.app A 61.155.146.24
mouterlog.app A 122.227.189.242
ntp.app A 59.151.105.169
pms.lan.oa.app A 192.168.10.20
oais.app A 122.227.189.172
outerlog.app A 122.227.189.242
pcs1.app A 122.227.201.89
pcs1.app A 122.227.201.90
spam.app A 122.227.189.28
uploadvideo.app A 60.190.31.137
uploadvideo.app A 60.190.31.138
weather.app A 122.227.189.200
weather.app A 122.227.189.201
asus A 122.227.189.16
cdqss A 122.227.189.156
cdqss A 122.227.189.157
cinema A 122.227.189.154
cinema A 122.227.189.155
cinemauser A 122.227.189.154
cinemauser A 122.227.189.155
city A 122.227.189.16
*.city A 122.227.189.16
clicks A 122.227.201.66
cms A 122.227.189.178
auto.cms A 122.227.189.200
data.cms A 122.227.189.180
fetch.cms A 60.12.195.4
joyunion.cms A 122.227.189.100
p.cms A 122.227.189.138
preview.cms A 122.227.189.192
preview.cms A 122.227.189.193
preview.cms A 122.227.189.194
space.cms A 122.227.189.180
tongji.cms A 122.227.189.223
videoadmin.cms A 122.227.189.180
db7.file A 222.68.221.60
pay.file A 122.227.201.229
yun2.file A 118.26.203.204
henan A 60.12.199.16
henan A 60.12.199.17
ineract A 122.227.189.136
interact A 122.227.189.135
kedou A 122.227.189.192
kedou A 122.227.189.193
kedou A 122.227.189.194
lic A 122.227.189.31
lic A 122.227.189.32
m A 59.151.105.154
caipiao.m A 221.123.177.56
club.m A 59.151.105.166
leo.m A 42.62.12.171
gz1.source.m A 120.197.88.84
gz2.source.m A 120.197.88.85
gz3.source.m A 120.197.88.104
gz4.source.m A 120.197.88.105
m5.source.m A 59.151.123.229
sjz1.source.m A 61.55.168.51
sjz2.source.m A 61.55.168.52
sjz3.source.m A 61.55.170.204
sjz4.source.m A 61.55.170.205
wh1.source.m A 59.175.147.67
wh2.source.m A 59.175.147.69
wh3.source.m A 59.175.147.77
wh4.source.m A 59.175.147.78
Test.m A 122.227.201.223
v.m A 120.197.88.98
yingchao.m A 117.135.134.111
movieparty A 122.227.189.135
movieparty A 122.227.189.136
ns1 A 61.155.146.9
ns2 A 59.151.105.163
interface.oa A 58.211.18.66
manage.oa A 58.211.18.66
old.oa A 58.211.18.66
tc.oa A 61.155.39.98
guangzhou.m.p A 120.197.88.84
guangzhou.m.p A 120.197.88.85
zhaowei.yun.rrs.p A 118.26.203.201
pay A 122.227.189.20
online.pay A 122.227.189.68
online.pay A 122.227.189.71
payment A 122.227.189.154
payment A 122.227.189.155
payuser A 122.227.189.31
payuser A 122.227.189.32
se A 122.227.189.68
se A 122.227.189.71
shbk A 122.227.189.16
soft A 122.227.189.42
toolbar A 122.227.189.208
tuan A 122.227.189.157
wap A 59.151.105.154
cbeta.y A 60.12.195.18
fbeta.y A 60.12.195.18
pbeta.y A 60.12.195.16
v.y A 202.165.178.92
space.you A 122.227.189.130

漏洞证明:

> ls joy.cn
[ns2.joy.cn]
joy.cn. NS server = ns1.joy.
joy.cn. NS server = ns2.joy.
joy.cn. A 122.227.189.192
3g A 59.151.105.154
image1.3g A 59.151.105.185
image1.3g A 59.151.123.233
pay.3g A 59.151.105.154
video1.3g A 59.175.147.67
video1.3g A 59.175.147.69
4g A 59.151.105.154
86get A 59.151.105.130
86get A 59.151.105.131
86get A 59.151.105.132
86get A 59.151.105.133
86get A 59.151.105.138
86get A 59.151.105.139
86log A 59.151.105.134
86log A 59.151.105.135
86log A 59.151.105.136
86manage A 59.151.105.137
gzcmcc.3gcdn.app A 120.197.88.84
gzcmcc.3gcdn.app A 120.197.88.85
sjzcnc.3gcdn.app A 61.55.168.51
sjzcnc.3gcdn.app A 61.55.168.52
whct.3gcdn.app A 59.175.147.67
whct.3gcdn.app A 59.175.147.69
whct1.3gcdn.app A 59.175.147.73
act.app A 122.227.189.104
pms.lan.api.app A 192.168.10.20
yunmsx.api.app A 192.168.10.20
comment.app A 122.227.189.175
comment.app A 122.227.189.210
comment.app A 122.227.189.211
admin.comment.app A 122.227.189.201
eas.app A 59.151.105.180
idcmstask.app A 61.155.146.24
mouterlog.app A 122.227.189.242
ntp.app A 59.151.105.169
pms.lan.oa.app A 192.168.10.20
oais.app A 122.227.189.172
outerlog.app A 122.227.189.242
pcs1.app A 122.227.201.89
pcs1.app A 122.227.201.90
spam.app A 122.227.189.28
uploadvideo.app A 60.190.31.137
uploadvideo.app A 60.190.31.138
weather.app A 122.227.189.200
weather.app A 122.227.189.201
asus A 122.227.189.16
cdqss A 122.227.189.156
cdqss A 122.227.189.157
cinema A 122.227.189.154
cinema A 122.227.189.155
cinemauser A 122.227.189.154
cinemauser A 122.227.189.155
city A 122.227.189.16
*.city A 122.227.189.16
clicks A 122.227.201.66
cms A 122.227.189.178
auto.cms A 122.227.189.200
data.cms A 122.227.189.180
fetch.cms A 60.12.195.4
joyunion.cms A 122.227.189.100
p.cms A 122.227.189.138
preview.cms A 122.227.189.192
preview.cms A 122.227.189.193
preview.cms A 122.227.189.194
space.cms A 122.227.189.180
tongji.cms A 122.227.189.223
videoadmin.cms A 122.227.189.180
db7.file A 222.68.221.60
pay.file A 122.227.201.229
yun2.file A 118.26.203.204
henan A 60.12.199.16
henan A 60.12.199.17
ineract A 122.227.189.136
interact A 122.227.189.135
kedou A 122.227.189.192
kedou A 122.227.189.193
kedou A 122.227.189.194
lic A 122.227.189.31
lic A 122.227.189.32
m A 59.151.105.154
caipiao.m A 221.123.177.56
club.m A 59.151.105.166
leo.m A 42.62.12.171
gz1.source.m A 120.197.88.84
gz2.source.m A 120.197.88.85
gz3.source.m A 120.197.88.104
gz4.source.m A 120.197.88.105
m5.source.m A 59.151.123.229
sjz1.source.m A 61.55.168.51
sjz2.source.m A 61.55.168.52
sjz3.source.m A 61.55.170.204
sjz4.source.m A 61.55.170.205
wh1.source.m A 59.175.147.67
wh2.source.m A 59.175.147.69
wh3.source.m A 59.175.147.77
wh4.source.m A 59.175.147.78
Test.m A 122.227.201.223
v.m A 120.197.88.98
yingchao.m A 117.135.134.111
movieparty A 122.227.189.135
movieparty A 122.227.189.136
ns1 A 61.155.146.9
ns2 A 59.151.105.163
interface.oa A 58.211.18.66
manage.oa A 58.211.18.66
old.oa A 58.211.18.66
tc.oa A 61.155.39.98
guangzhou.m.p A 120.197.88.84
guangzhou.m.p A 120.197.88.85
zhaowei.yun.rrs.p A 118.26.203.201
pay A 122.227.189.20
online.pay A 122.227.189.68
online.pay A 122.227.189.71
payment A 122.227.189.154
payment A 122.227.189.155
payuser A 122.227.189.31
payuser A 122.227.189.32
se A 122.227.189.68
se A 122.227.189.71
shbk A 122.227.189.16
soft A 122.227.189.42
toolbar A 122.227.189.208
tuan A 122.227.189.157
wap A 59.151.105.154
cbeta.y A 60.12.195.18
fbeta.y A 60.12.195.18
pbeta.y A 60.12.195.16
v.y A 202.165.178.92
space.you A 122.227.189.130

修复方案:

正确配置dns服务器

版权声明:转载请注明来源 VIP@乌云


漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2012-11-26 17:24

厂商回复:

最新状态:

暂无


漏洞评价:

评论