发布日期：2003-01-21
更新日期：2003-01-24

受影响系统：

MandrakeSoft ml85p
    - Mandrake Linux 9.0

描述：

---

CVE(CAN) ID: CVE-2003-0036

Mandrake Linux默认安装包含打印机驱动程序包，一般包括mtink、escputil、ml85p三个二进制程序。

ml85p在打开临时文件名时存在竞争条件漏洞，本地攻击者可以利用这个漏洞以超级管理员权限建立或清空系统任意文件，造成权限提升。

ml85p是Samsung ML-85G系列打印机Linux驱动程序。默认情况下ml85p以'root'权限安装，在开打临时文件时存在竞争条件问题，错误代码如下所示：

sprintf(gname,"/tmp/mlg85p%d",time(0));
    if (!(cbmf = fopen(gname,"w+"))) {

攻击者可以轻易猜测临时文件名然后连接猜测的文件到系统任意文件，如果指定连接的文件不存在，那么将以root用户建立全局可写的文件，如果存在，那么指向的文件将丢失。利用这个漏洞可以获得root用户权限。

不过默认情况下，'other'用户对ml85p没有执行权限。

<*来源：iDEFENSE Labs （labs@idefense.com）
  
  链接：http://www.idefense.com/advisory/01.21.03.txt
        http://www.linux-mandrake.com/en/security/2003/2003-010.php
*>

建议：

---

厂商补丁：

MandrakeSoft
------------
MandrakeSoft已经为此发布了一个安全公告（MDKSA-2003:010）以及相应补丁:
MDKSA-2003:010：Updated printer-drivers packages fix local vulnerabilities
链接：http://www.linux-mandrake.com/en/security/2003/2003-010.php

补丁下载：

Updated Packages:

Mandrake Linux 8.0:
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.0/RPMS/ghostscript-5.50-67.1mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.0/RPMS/ghostscript-module-SVGALIB-5.50-67.1mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.0/RPMS/ghostscript-module-X-5.50-67.1mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.0/RPMS/ghostscript-utils-5.50-67.1mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.0/SRPMS/ghostscript-5.50-67.1mdk.src.rpm

Mandrake Linux 8.1:
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.1/RPMS/cups-drivers-1.1-15.1mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.1/RPMS/foomatic-1.1-0.20010923.1mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.1/RPMS/ghostscript-6.51-24.1mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.1/RPMS/ghostscript-module-SVGALIB-6.51-24.1mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.1/RPMS/ghostscript-module-X-6.51-24.1mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.1/RPMS/libgimpprint1-4.1.99-16.1mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.1/RPMS/libgimpprint1-devel-4.1.99-16.1mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.1/RPMS/omni-0.4-11.1mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.1/RPMS/printer-filters-1.0-15.1mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.1/RPMS/printer-testpages-1.0-15.1mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.1/RPMS/printer-utils-1.0-15.1mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.1/SRPMS/printer-drivers-1.0-15.1mdk.src.rpm

Mandrake Linux 8.2:
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.2/RPMS/cups-drivers-1.1-48.2mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.2/RPMS/foomatic-1.1-0.20020323mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.2/RPMS/ghostscript-6.53-13.2mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.2/RPMS/ghostscript-module-SVGALIB-6.53-13.2mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.2/RPMS/ghostscript-module-X-6.53-13.2mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.2/RPMS/gimpprint-4.2.1-0.pre5.2mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.2/RPMS/libgimpprint1-4.2.1-0.pre5.2mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.2/RPMS/libgimpprint1-devel-4.2.1-0.pre5.2mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.2/RPMS/omni-0.6.0-2.2mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.2/RPMS/printer-filters-1.0-48.2mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.2/RPMS/printer-testpages-1.0-48.2mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.2/RPMS/printer-utils-1.0-48.2mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/8.2/SRPMS/printer-drivers-1.0-48.2mdk.src.rpm

Mandrake Linux 9.0:
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.0/RPMS/cups-drivers-1.1-84.2mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.0/RPMS/foomatic-2.0.2-20021220.2.2mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.0/RPMS/ghostscript-7.05-33.2mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.0/RPMS/ghostscript-module-X-7.05-33.2mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.0/RPMS/gimpprint-4.2.5-0.2.2mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.0/RPMS/libgimpprint1-4.2.5-0.2.2mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.0/RPMS/libgimpprint1-devel-4.2.5-0.2.2mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.0/RPMS/libijs0-0.34-24.2mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.0/RPMS/libijs0-devel-0.34-24.2mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.0/RPMS/omni-0.7.1-11.2mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.0/RPMS/printer-filters-1.0-84.2mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.0/RPMS/printer-testpages-1.0-84.2mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.0/RPMS/printer-utils-1.0-84.2mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.0/SRPMS/printer-drivers-1.0-84.2mdk.src.rpm

上述升级软件还可以在下列地址中的任意一个镜像ftp服务器上下载：
http://www.mandrakesecure.net/en/ftp.php

浏览次数：2942
严重程度：0（网友投票）