发布日期：2003-08-02
更新日期：2003-08-06

受影响系统：

Linux kernel 2.4.21 pre7
Linux kernel 2.4.21 pre4
Linux kernel 2.4.21 pre1
Linux kernel 2.4.21
Linux kernel 2.4.20
    - Mandrake Linux 9.1
    - RedHat Linux 9.0
    - Slackware Linux 9.0

描述：

---

BUGTRAQ  ID: 8330
CVE(CAN) ID: CVE-2003-0467

Netfilter是一款Linux Kernel下的防火墙构架实现。

Netfilter在部分条件下在处理NAT时存在漏洞，远程攻击者可以利用这个问题对使用NAT的系统进行拒绝服务攻击。

目前没有详细漏洞细节提供。

<*来源：Netfilter Core Team （coreteam@netfilter.org）
  
  链接：http://marc.theaimsgroup.com/?l=bugtraq&m=105985703724758&w=2
*>

建议：

---

厂商补丁：

Linux
-----
2.4.21pre7有如下补丁：

diff -urpN --exclude TAGS -X /home/rusty/devel/kernel/kernel-patches/current-dontdiff --minimal linux-2.4.21-pre7/net/ipv4/netfilter/ip_nat_helper.c working-2.4.21-pre7-sackadjust/net/ipv4/netfilter/ip_nat_helper.c
--- linux-2.4.21-pre7/net/ipv4/netfilter/ip_nat_helper.c 2003-04-06 15:26:48.000000000 +1000
+++ working-2.4.21-pre7-sackadjust/net/ipv4/netfilter/ip_nat_helper.c 2003-04-14 23:18:38.000000000 +1000
-366,54 +365,49  sack_adjust(struct tcphdr *tcph,
}
                          
  
-/* TCP SACK sequence number adjustment, return 0 if sack found and adjusted */
-static inline int
+/* TCP SACK sequence number adjustment. */
+static inline void
ip_nat_sack_adjust(struct sk_buff *skb,
- struct ip_conntrack *ct,
- enum ip_conntrack_info ctinfo)
+ struct ip_conntrack *ct,
+ enum ip_conntrack_info ctinfo)
{
- struct iphdr *iph;
         struct tcphdr *tcph;
- unsigned char *ptr;
- int length, dir, sack_adjusted = 0;
+ unsigned char *ptr, *optend;
+ unsigned int dir;
  
- iph = skb->nh.iph;
- tcph = (void *)iph + iph->ihl*4;
- length = (tcph->doff*4)-sizeof(struct tcphdr);
+ tcph = (void *)skb->nh.iph + skb->nh.iph->ihl*4;
+ optend = (unsigned char *)tcph + tcph->doff*4;
         ptr = (unsigned char *)(tcph+1);
  
         dir = CTINFO2DIR(ctinfo);
  
- while (length > 0) {
- int opcode = *ptr++;
+ while (ptr < optend) {
+ int opcode = ptr[0];
                 int opsize;
  
                 switch (opcode) {
                 case TCPOPT_EOL:
- return !sack_adjusted;
+ return;
                 case TCPOPT_NOP:
- length--;
+ ptr++;
                         continue;
                 default:
- opsize = *ptr++;
- if (opsize > length) /* no partial opts */
- return !sack_adjusted;
+ opsize = ptr[1];
+ /* no partial opts */
+ if (ptr + opsize > optend || opsize < 2)
+ return;
                         if (opcode == TCPOPT_SACK) {
                                 /* found SACK */
                                 if((opsize >= (TCPOLEN_SACK_BASE
                                                +TCPOLEN_SACK_PERBLOCK)) &&
                                    !((opsize - TCPOLEN_SACK_BASE)
                                      % TCPOLEN_SACK_PERBLOCK))
- sack_adjust(tcph, ptr-2,
+ sack_adjust(tcph, ptr,
                                                     &ct->nat.info.seq[!dir]);
-
- sack_adjusted = 1;
                         }
- ptr += opsize-2;
- length -= opsize;
+ ptr += opsize;
                 }
         }
- return !sack_adjusted;
}
  
/* TCP sequence number adjustment */

浏览次数：3139
严重程度：1（网友投票）