当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0166306

漏洞标题：交通运输部某办事平台存在命令执行漏洞（JAVA反序列化）

相关厂商：中华人民共和国交通运输部

漏洞作者： 路人甲

提交时间：2015-12-31 11:30

修复时间：2016-02-20 15:48

公开时间：2016-02-20 15:48

漏洞类型：命令执行

危害等级：高

自评Rank：10

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-12-31： 细节已通知厂商并且等待厂商处理中
2016-01-08： 厂商已经确认，细节仅向厂商公开
2016-01-18： 细节向核心白帽子及相关领域专家公开
2016-01-28： 细节向普通白帽子公开
2016-02-07： 细节向实习白帽子公开
2016-02-20： 细节向公众公开

简要描述：

中华人民共和国交通运输部某平台存在JAVA反序列化漏洞

详细说明：

平台url：
**.**.**.**
中华人民共和国交通运输部-行政许可网上办理平台

QQ截图20151229180208.jpg


存在WEBLOGIC java反序列化漏洞

漏洞证明：

ifconfig


ens160: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet **.**.**.**  netmask **.**.**.**  broadcast **.**.**.**
        inet6 fe80::250:56ff:feb8:47a6  prefixlen 64  scopeid 0x20<link>
        ether 00:50:56:b8:47:a6  txqueuelen 1000  (Ethernet)
        RX packets 19747701  bytes 24197859389 (22.5 GiB)
        RX errors 0  dropped 20  overruns 0  frame 0
        TX packets 12477557  bytes 4733819834 (4.4 GiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet **.**.**.**  netmask **.**.**.**
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 0  (Local Loopback)
        RX packets 6829717  bytes 1153942831 (1.0 GiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 6829717  bytes 1153942831 (1.0 GiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0


netstat


Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 **.**.**.**:ssh          **.**.**.**:55456        ESTABLISHED
tcp6       0      0 **.**.**.**:http         **.**.**.**:50100      FIN_WAIT2  
tcp6       0      0 **.**.**.**:http         **.**.**.**:62908     ESTABLISHED
tcp6       0      0 **.**.**.**:http         **.**.**.**:dirgis  ESTABLISHED
tcp6       0      0 **.**.**.**:http         **.**.**.**:50098      FIN_WAIT2  
tcp6       0      0 **.**.**.**:http         125.122.216.:direcpc-si ESTABLISHED
tcp6       0      0 **.**.**.**:40548        **.**.**.**:ncube-lm     ESTABLISHED
tcp6       0      0 **.**.**.**:http         **.**.**.**:50095      FIN_WAIT2  
Active UNIX domain sockets (w/o servers)
Proto RefCnt Flags       Type       State         I-Node   Path
unix  5      [ ]         DGRAM                    9257     /run/systemd/journal/socket
unix  26     [ ]         DGRAM                    9259     /dev/log
unix  2      [ ]         DGRAM                    10725    @/org/freedesktop/systemd1/notify
unix  2      [ ]         DGRAM                    13982    /run/systemd/shutdownd
unix  3      [ ]         STREAM     CONNECTED     18329    
unix  3      [ ]         STREAM     CONNECTED     28993    
unix  3      [ ]         STREAM     CONNECTED     24832    @/tmp/.ICE-unix/2995
unix  3      [ ]         STREAM     CONNECTED     24305    
unix  3      [ ]         STREAM     CONNECTED     18303    
unix  3      [ ]         STREAM     CONNECTED     18290    /var/run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     22785    
unix  3      [ ]         STREAM     CONNECTED     10928    /var/run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     25808    @/tmp/dbus-NInZA0sSzF
unix  3      [ ]         STREAM     CONNECTED     23419    /var/run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     22126    
unix  3      [ ]         STREAM     CONNECTED     22110    
unix  3      [ ]         STREAM     CONNECTED     19113    
unix  2      [ ]         DGRAM                    8766     
unix  3      [ ]         STREAM     CONNECTED     26924    
unix  3      [ ]         STREAM     CONNECTED     22152    
unix  3      [ ]         STREAM     CONNECTED     20490    /run/systemd/journal/stdout
unix  3      [ ]         STREAM     CONNECTED     17700    
unix  3      [ ]         STREAM     CONNECTED     1666356  @/tmp/.X11-unix/X0
unix  3      [ ]         STREAM     CONNECTED     27826    
unix  3      [ ]         STREAM     CONNECTED     10105    
unix  3      [ ]         STREAM     CONNECTED     23509    
unix  3      [ ]         STREAM     CONNECTED     21990    
unix  3      [ ]         STREAM     CONNECTED     27128    
unix  3      [ ]         STREAM     CONNECTED     25809    /run/user/0/pulse/native
unix  3      [ ]         STREAM     CONNECTED     10931    /var/run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     24328    
unix  3      [ ]         STREAM     CONNECTED     22167    
unix  3      [ ]         STREAM     CONNECTED     1665935  
unix  3      [ ]         STREAM     CONNECTED     24400    
unix  3      [ ]         STREAM     CONNECTED     18296    @/tmp/dbus-NInZA0sSzF
unix  3      [ ]         STREAM     CONNECTED     28920    
unix  3      [ ]         STREAM     CONNECTED     25846    
unix  3      [ ]         STREAM     CONNECTED     28988    
unix  3      [ ]         STREAM     CONNECTED     24379    
unix  3      [ ]         STREAM     CONNECTED     24235    
unix  3      [ ]         STREAM     CONNECTED     26880    @/tmp/.X11-unix/X0
unix  3      [ ]         STREAM     CONNECTED     29054    
unix  3      [ ]         STREAM     CONNECTED     24835    @/tmp/dbus-NInZA0sSzF
unix  3      [ ]         STREAM     CONNECTED     16840    
unix  3      [ ]         STREAM     CONNECTED     28865    @/tmp/dbus-NInZA0sSzF
unix  3      [ ]         STREAM     CONNECTED     22156    
unix  3      [ ]         STREAM     CONNECTED     25954    
unix  3      [ ]         STREAM     CONNECTED     23530    /var/run/NetworkManager/private
unix  3      [ ]         STREAM     CONNECTED     11853    
unix  3      [ ]         STREAM     CONNECTED     10925    /var/run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     27134    
unix  3      [ ]         STREAM     CONNECTED     28994    @/tmp/.X11-unix/X0
unix  3      [ ]         STREAM     CONNECTED     27830    
unix  2      [ ]         DGRAM                    25803    
unix  3      [ ]         STREAM     CONNECTED     8938     /run/systemd/journal/stdout
unix  3      [ ]         STREAM     CONNECTED     16266    
unix  3      [ ]         STREAM     CONNECTED     23493    @/tmp/dbus-NInZA0sSzF
unix  3      [ ]         STREAM     CONNECTED     22171    
unix  3      [ ]         STREAM     CONNECTED     20862    
unix  3      [ ]         STREAM     CONNECTED     8915     
unix  3      [ ]         STREAM     CONNECTED     24442    
unix  3      [ ]         STREAM     CONNECTED     24175    
unix  3      [ ]         STREAM     CONNECTED     24085    
unix  3      [ ]         STREAM     CONNECTED     1667145  @/tmp/dbus-Akb5N3tc
unix  3      [ ]         STREAM     CONNECTED     25827    @/tmp/dbus-qHLlNOAr
unix  3      [ ]         STREAM     CONNECTED     26873    @/tmp/.X11-unix/X0
unix  3      [ ]         STREAM     CONNECTED     26874    
unix  3      [ ]         STREAM     CONNECTED     22144    
unix  3      [ ]         STREAM     CONNECTED     29089    /var/run/dbus/system_bus_socket
unix  2      [ ]         DGRAM                    24786    
unix  3      [ ]         STREAM     CONNECTED     22134    
unix  3      [ ]         STREAM     CONNECTED     22117    
unix  3      [ ]         STREAM     CONNECTED     22103    
unix  3      [ ]         STREAM     CONNECTED     29798    
unix  3      [ ]         STREAM     CONNECTED     16929    
unix  3      [ ]         STREAM     CONNECTED     22140    
unix  3      [ ]         STREAM     CONNECTED     11440    /run/systemd/journal/stdout
unix  3      [ ]         STREAM     CONNECTED     27751    
unix  3      [ ]         STREAM     CONNECTED     10923    
unix  3      [ ]         STREAM     CONNECTED     27850    /var/run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     12197    
unix  3      [ ]         STREAM     CONNECTED     17852    /var/run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     22159    
unix  3      [ ]         STREAM     CONNECTED     25750    @/tmp/dbus-NInZA0sSzF
unix  3      [ ]         STREAM     CONNECTED     18990    
unix  3      [ ]         STREAM     CONNECTED     29850    
unix  3      [ ]         STREAM     CONNECTED     18246    
unix  3      [ ]         STREAM     CONNECTED     28780    
unix  3      [ ]         STREAM     CONNECTED     18316    
unix  3      [ ]         STREAM     CONNECTED     24380    
unix  3      [ ]         STREAM     CONNECTED     27776    @/tmp/dbus-NInZA0sSzF
unix  3      [ ]         STREAM     CONNECTED     25788    /var/run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     26677    
unix  2      [ ]         STREAM     CONNECTED     1662788  
unix  3      [ ]         STREAM     CONNECTED     24774    
unix  2      [ ]         DGRAM                    11639    
unix  3      [ ]         DGRAM                    8776     
unix  2      [ ]         DGRAM                    23219    
unix  2      [ ]         DGRAM                    1718046  
unix  3      [ ]         STREAM     CONNECTED     22138    
unix  3      [ ]         STREAM     CONNECTED     25823    @/tmp/dbus-NInZA0sSzF
unix  3      [ ]         STREAM     CONNECTED     19487    
unix  3      [ ]         STREAM     CONNECTED     29803    
unix  3      [ ]         STREAM     CONNECTED     16971    
unix  3      [ ]         STREAM     CONNECTED     17685    
unix  3      [ ]         STREAM     CONNECTED     27803    
unix  3      [ ]         STREAM     CONNECTED     19602    /var/run/dbus/system_bus_socket
unix  3      [ ]         STREAM     CONNECTED     24773    
unix  3      [ ]         STREAM     CONNECTED     29056    @/tmp/dbus-NInZA0sSzF
unix  3      [ ]         STREAM     CONNECTED     18218    @/tmp/dbus-NInZA0sSzF
unix  3      [ ]         STREAM     CONNECTED     1666354  @/tmp/dbus-fyMealUqay
unix  3      [ ]         STREAM     CONNECTED     23507    
unix  3      [ ]         STREAM     CONNECTED     24776    
unix  3      [ ]         STREAM     CONNECTED     24312    @/tmp/dbus-NInZA0.............


这个仅作测试，不再深入了

修复方案：

这个~不太懂

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：11

确认时间：2016-01-08 15:31

厂商回复：

CNVD确认并复现所述情况,已经转由CNCERT向国家上级信息安全协调机构上报,由其后续协调网站管理单位处置.

最新状态：

暂无

漏洞评价：

评价