发布日期：2004-07-03
更新日期：2004-07-08

受影响系统：

Pavuk Pavuk 0.928r1
Pavuk Pavuk 0.9pl28i
    - Debian Linux 3.0

不受影响系统：

Pavuk Pavuk 0.928r2

描述：

---

BUGTRAQ  ID: 10633
CVE(CAN) ID: CVE-2004-0456

Pavuk是一款文件下载程序。

Pavuk不正确处理过长的HTTP应答，远程攻击者可以利用这个漏洞以pavuk进程权限在系统上执行任意指令。

通过恶意服务器发送超长的HTTP 305应答给pavuk程序，可导致发生基于堆栈的缓冲区溢出，精心构建应答数据可能以pavuk进程权限在系统上执行任意指令。

<*来源：Debian Security Advisory
  
  链接：http://www.debian.org/security/2004/dsa-527
*>

建议：

---

厂商补丁：

Debian
------
Debian已经为此发布了一个安全公告（DSA-527-1）以及相应补丁:
DSA-527-1：DSA-527-1 pavuk -- buffer overflow
链接：http://www.debian.org/security/2004/dsa-527

补丁下载：

Pavuk Pavuk 0.9pl28i:

Debian Upgrade pavuk_0.9pl28-1woody1_alpha.deb
http://security.debian.org/pool/updates/main/p/pavuk/pavuk_0.9pl28-1woody1_alpha.deb
Debian GNU/Linux 3.0 (woody)

Debian Upgrade pavuk_0.9pl28-1woody1_arm.deb
http://security.debian.org/pool/updates/main/p/pavuk/pavuk_0.9pl28-1woody1_arm.deb
Debian GNU/Linux 3.0 (woody)

Debian Upgrade pavuk_0.9pl28-1woody1_i386.deb
http://security.debian.org/pool/updates/main/p/pavuk/pavuk_0.9pl28-1woody1_i386.deb
Debian GNU/Linux 3.0 (woody)

Debian Upgrade pavuk_0.9pl28-1woody1_ia64.deb
http://security.debian.org/pool/updates/main/p/pavuk/pavuk_0.9pl28-1woody1_ia64.deb
Debian GNU/Linux 3.0 (woody)

Debian Upgrade pavuk_0.9pl28-1woody1_hppa.deb
http://security.debian.org/pool/updates/main/p/pavuk/pavuk_0.9pl28-1woody1_hppa.deb
Debian GNU/Linux 3.0 (woody)

Debian Upgrade pavuk_0.9pl28-1woody1_m68k.deb
http://security.debian.org/pool/updates/main/p/pavuk/pavuk_0.9pl28-1woody1_m68k.deb
Debian GNU/Linux 3.0 (woody)

Debian Upgrade pavuk_0.9pl28-1woody1_mips.deb
http://security.debian.org/pool/updates/main/p/pavuk/pavuk_0.9pl28-1woody1_mips.deb
Debian GNU/Linux 3.0 (woody)

Debian Upgrade pavuk_0.9pl28-1woody1_mipsel.deb
http://security.debian.org/pool/updates/main/p/pavuk/pavuk_0.9pl28-1woody1_mipsel.deb
Debian GNU/Linux 3.0 (woody)

Debian Upgrade pavuk_0.9pl28-1woody1_powerpc.deb
http://security.debian.org/pool/updates/main/p/pavuk/pavuk_0.9pl28-1woody1_powerpc.deb
Debian GNU/Linux 3.0 (woody)

Debian Upgrade pavuk_0.9pl28-1woody1_s390.deb
http://security.debian.org/pool/updates/main/p/pavuk/pavuk_0.9pl28-1woody1_s390.deb
Debian GNU/Linux 3.0 (woody)

Debian Upgrade pavuk_0.9pl28-1woody1_sparc.deb
http://security.debian.org/pool/updates/main/p/pavuk/pavuk_0.9pl28-1woody1_sparc.deb
Debian GNU/Linux 3.0 (woody)

浏览次数：3176
严重程度：0（网友投票）