首页 -> 安全研究
安全研究
安全漏洞
CVS Daemon RCS本地单字节缓冲区溢出漏洞
发布日期:2002-05-25
更新日期:2002-08-09
受影响系统:
CVS CVS 1.11描述:
BUGTRAQ ID: 4829
CVE(CAN) ID: CVE-2002-0844
CVS是一款免费开放源代码的版本控制系统,可使用在多种Linux和Unix操作系统下,也可以运行于Microsoft Windows操作系统。
CVS中的rcs.c代码中对缓冲区边界缺少正确充分的检查,可导致本地攻击者以cvs进程的权限在系统中执行任意代码。
cvs-1.11/src/rcs.c代码中的sscanf()实现存在典型的单字节缓冲区溢出漏洞,攻击者可以利用堆栈中的帧指针覆盖而以cvs进程的权限执行任意代码,由于info->data的数据由本地符号连接文件中获得,所以此漏洞只能本地进行利用。
问题代码如下所示:
cvs-1.11/src/rcs.c:
info = findnode (vers->other_delta, "special");
if (info != NULL)
{
/* If the size of `devtype' changes, fix the sscanf call also */
char devtype[16]; <-- 16字节
if (sscanf (info->data, "%16s %lu", <-- 应该为15,为不是16,导致单字节缓冲溢出
devtype, &devnum_long) < 2)
error (1, 0, "%s:%s has bad `special' newphrase %s",
workfile, vers->version, info->data);
devnum = devnum_long;
if (STREQ (devtype, "character"))
special_file = S_IFCHR;
else if (STREQ (devtype, "block"))
special_file = S_IFBLK;
else
error (0, 0, "%s is a special file of unsupported type `%s'",
workfile, info->data);
}
}
<*来源:david evlis reign (davidreign@hotmail.com)
链接:http://archives.neohapsis.com/archives/bugtraq/2002-05/0221.html
http://www.caldera.com/support/security/advisories/CSSA-2002-035.0.txt
*>
建议:
厂商补丁:
Caldera
-------
Caldera已经为此发布了一个安全公告(CSSA-2002-035.0)以及相应补丁:
CSSA-2002-035.0:Linux: local off by one in cvsd
链接:http://www.caldera.com/support/security/advisories/CSSA-2002-035.0.txt
补丁下载:
. OpenLinux 3.1.1 Server
软件包下载地址:
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-035.0/RPMS
软件包:
446921ba85f2f865d698060ab344d189 cvs-1.11-8.i386.rpm
11ddbffdbf9310b24364b2b91d851acc cvs-doc-ps-1.11-8.i386.rpm
安装方法:
rpm -Fvh cvs-1.11-8.i386.rpm
rpm -Fvh cvs-doc-ps-1.11-8.i386.rpm
. OpenLinux 3.1.1 Workstation
软件包下载地址:
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2002-035.0/RPMS
软件包:
d24451d87b1c7424f12bb41d4873c3df cvs-1.11-8.i386.rpm
035d93df5ab69f025f7d08a583977658 cvs-doc-ps-1.11-8.i386.rpm
安装方法:
rpm -Fvh cvs-1.11-8.i386.rpm
rpm -Fvh cvs-doc-ps-1.11-8.i386.rpm
. OpenLinux 3.1 Server
软件包下载地址:
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-035.0/RPMS
软件包:
1f3a09e4fcc1a8a0d011a6e7fcd0d810 cvs-1.11-8.i386.rpm
ff3e5b2acdd60e4b0492b212603a0d23 cvs-doc-ps-1.11-8.i386.rpm
安装方法:
rpm -Fvh cvs-1.11-8.i386.rpm
rpm -Fvh cvs-doc-ps-1.11-8.i386.rpm
. OpenLinux 3.1 Workstation
软件包下载地址:
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2002-035.0/RPMS
软件包:
cf5125e9586da6217df51051f66eb8d6 cvs-1.11-8.i386.rpm
4bce0b96a28195c75878515b6a37777d cvs-doc-ps-1.11-8.i386.rpm
安装方法:
rpm -Fvh cvs-1.11-8.i386.rpm
rpm -Fvh cvs-doc-ps-1.11-8.i386.rpm
CVS
---
目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载:
CVS Upgrade cvs-1.11.2.tar.gz
http://ccvs.cvshome.org/servlets/ProjectDownloadList?action=download&dlID=115
浏览次数:2899
严重程度:0(网友投票)
绿盟科技给您安全的保障