发布日期：2004-08-31
更新日期：2004-09-23

受影响系统：

CDRTools CDRTools 2.0.3
CDRTools CDRTools 2.0.1a18
CDRTools CDRTools 2.0.1
CDRTools CDRTools 2.0

描述：

---

BUGTRAQ  ID: 11075
CVE(CAN) ID: CVE-2004-0806

CDRTools是一款基于Linux的刻录工具。

CDRecord对RSH环境变量处理不正确，本地攻击者可以利用这个漏洞进行特权提升攻击。

由于CDRecord执行RSH环境变量指定的应用程序时不正确的实现安全控制，攻击者可以利用环境变量获得超级用户特权。

<*来源：newbug Tseng （newbug@chroot.org）
  
  链接：http://marc.theaimsgroup.com/?l=bugtraq&m=105286031812533&w=2
        http://www.linux-mandrake.com/en/security/2004/2004-091.php
*>

建议：

---

厂商补丁：

MandrakeSoft
------------
MandrakeSoft已经为此发布了一个安全公告（MDKSA-2004:091）以及相应补丁:
MDKSA-2004:091：Updated cdrecord packages fix local root vulnerability
链接：http://www.linux-mandrake.com/en/security/2004/2004-091.php

补丁下载：

Updated Packages:

Mandrakelinux 10.0:
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/10.0/RPMS/cdrecord-2.01-0.a28.2.100mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/10.0/RPMS/cdrecord-cdda2wav-2.01-0.a28.2.100mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/10.0/RPMS/cdrecord-devel-2.01-0.a28.2.100mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/10.0/RPMS/mkisofs-2.01-0.a28.2.100mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/10.0/SRPMS/cdrecord-2.01-0.a28.2.100mdk.src.rpm

Mandrakelinux 10.0/AMD64:
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/10.0/RPMS/cdrecord-2.01-0.a28.2.100mdk.amd64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/10.0/RPMS/cdrecord-cdda2wav-2.01-0.a28.2.100mdk.amd64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/10.0/RPMS/cdrecord-devel-2.01-0.a28.2.100mdk.amd64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/10.0/RPMS/mkisofs-2.01-0.a28.2.100mdk.amd64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/10.0/SRPMS/cdrecord-2.01-0.a28.2.100mdk.src.rpm

Mandrakelinux 9.2:
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.2/RPMS/cdrecord-2.01-0.a18.2.1.92mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.2/RPMS/cdrecord-cdda2wav-2.01-0.a18.2.1.92mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.2/RPMS/cdrecord-devel-2.01-0.a18.2.1.92mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.2/RPMS/mkisofs-2.01-0.a18.2.1.92mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.2/SRPMS/cdrecord-2.01-0.a18.2.1.92mdk.src.rpm

Mandrakelinux 9.2/AMD64:
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/9.2/RPMS/cdrecord-2.01-0.a18.2.1.92mdk.amd64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/9.2/RPMS/cdrecord-cdda2wav-2.01-0.a18.2.1.92mdk.amd64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/9.2/RPMS/cdrecord-devel-2.01-0.a18.2.1.92mdk.amd64.rpm

上述升级软件还可以在下列地址中的任意一个镜像ftp服务器上下载：
http://www.mandrakesecure.net/en/ftp.php

RedHat
------
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

Fedora Upgrade cdrecord-2.01-0.a19.2.FC1.1.x86_64.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/1/
RedHat Fedora Core 1

Fedora Upgrade cdrecord-devel-2.01-0.a19.2.FC1.1.x86_64.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/1/
RedHat Fedora Core 1

Fedora Upgrade mkisofs-2.01-0.a19.2.FC1.1.x86_64.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/1/
RedHat Fedora Core 1

Fedora Upgrade cdda2wav-2.01-0.a19.2.FC1.1.x86_64.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/1/
RedHat Fedora Core 1

Fedora Upgrade cdrtools-debuginfo-2.01-0.a19.2.FC1.1.x86_64.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/1/
RedHat Fedora Core 1

Fedora Upgrade cdrecord-2.01-0.a19.2.FC1.1.i386.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/1/
RedHat Fedora Core 1

Fedora Upgrade cdrecord-devel-2.01-0.a19.2.FC1.1.i386.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/1/
RedHat Fedora Core 1

Fedora Upgrade mkisofs-2.01-0.a19.2.FC1.1.i386.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/1/
RedHat Fedora Core 1

Fedora Upgrade cdda2wav-2.01-0.a19.2.FC1.1.i386.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/1/
RedHat Fedora Core 1

Fedora Upgrade cdrtools-debuginfo-2.01-0.a19.2.FC1.1.i386.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/1/
RedHat Fedora Core 1

Fedora Upgrade cdrecord-2.01-0.a27.4.FC2.3.x86_64.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/
RedHat Fedora Core 2

Fedora Upgrade cdrecord-devel-2.01-0.a27.4.FC2.3.x86_64.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/
RedHat Fedora Core 2

Fedora Upgrade mkisofs-2.01-0.a27.4.FC2.3.x86_64.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/
RedHat Fedora Core 2

Fedora Upgrade cdda2wav-2.01-0.a27.4.FC2.3.x86_64.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/
RedHat Fedora Core 2

Fedora Upgrade cdrtools-debuginfo-2.01-0.a27.4.FC2.3.x86_64.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/
RedHat Fedora Core 2

Fedora Upgrade cdrecord-2.01-0.a27.4.FC2.3.i386.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/
RedHat Fedora Core 2

Fedora Upgrade cdrecord-devel-2.01-0.a27.4.FC2.3.i386.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/
RedHat Fedora Core 2

Fedora Upgrade mkisofs-2.01-0.a27.4.FC2.3.i386.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/
RedHat Fedora Core 2

Fedora Upgrade cdda2wav-2.01-0.a27.4.FC2.3.i386.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/
RedHat Fedora Core 2

Fedora Upgrade cdrtools-debuginfo-2.01-0.a27.4.FC2.3.i386.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/
RedHat Fedora Core 2

浏览次数：2926
严重程度：0（网友投票）