首页 -> 安全研究
安全研究
安全漏洞
Zlib压缩库解压拒绝服务漏洞
发布日期:2005-07-21
更新日期:2005-07-29
受影响系统:
zlib zlib 1.2.2不受影响系统:
zlib zlib 1.2.1
zlib zlib 1.2.3描述:
BUGTRAQ ID: 14340
CVE(CAN) ID: CVE-2005-1849
zlib是很多应用程序都在使用的压缩库,可提供数据压缩/解压例程。
Zlib中存在拒绝服务漏洞,攻击者可能利用此漏洞进行拒绝服务攻击。
起因是函数库没有正确的处理解压例程的意外输入。由于错误的指定了解压时所使用的某些值,在打开无效的文件时可能导致函数库崩溃。
<*来源:Markus Oberhumer
链接:http://www.debian.org/security/2005/dsa-763
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:18.zlib.asc
http://security.gentoo.org/glsa/glsa-200507-19.xml
http://lwn.net/Alerts/144583/?format=printable
*>
建议:
厂商补丁:
Debian
------
Debian已经为此发布了一个安全公告(DSA-763-1)以及相应补丁:
DSA-763-1:New zlib packages fix buffer overflow
链接:http://www.debian.org/security/2005/dsa-763
补丁下载:
Source archives:
http://security.debian.org/pool/updates/main/z/zlib/zlib_1.2.2.orig.tar.gz
Size/MD5 checksum: 430700 d43dabe3d374e299f2631c5fc5ce31f5
http://security.debian.org/pool/updates/main/z/zlib/zlib_1.2.2-4.sarge.2.dsc
Size/MD5 checksum: 807 e3fa0febf789e5c758d43476199825fd
http://security.debian.org/pool/updates/main/z/zlib/zlib_1.2.2-4.sarge.2.diff.gz
Size/MD5 checksum: 14718 e733bcc48ade3c675bc62a2554e2a453
alpha architecture (DEC Alpha)
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-dev_1.2.2-4.sarge.2_alpha.deb
Size/MD5 checksum: 533980 950f2426191fd20fa1a0a1d975c5285d
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-udeb_1.2.2-4.sarge.2_alpha.udeb
Size/MD5 checksum: 57220 1d97d651c5fb317b435ca4b4e03df7f0
http://security.debian.org/pool/updates/main/z/zlib/zlib1g_1.2.2-4.sarge.2_alpha.deb
Size/MD5 checksum: 82078 804c8d3a9b53373fa8693ea4b5db059e
http://security.debian.org/pool/updates/main/z/zlib/zlib-bin_1.2.2-4.sarge.2_alpha.deb
Size/MD5 checksum: 30566 128b7f15f363185d05471bdd99fd4039
arm architecture (ARM)
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-udeb_1.2.2-4.sarge.2_arm.udeb
Size/MD5 checksum: 42196 cec7d515976e1269116df86d58976ef1
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-dev_1.2.2-4.sarge.2_arm.deb
Size/MD5 checksum: 498234 80358e0e95f2be93600919065d31515c
http://security.debian.org/pool/updates/main/z/zlib/zlib1g_1.2.2-4.sarge.2_arm.deb
Size/MD5 checksum: 66728 0f055650a3092f0782bd00e10c78a64d
http://security.debian.org/pool/updates/main/z/zlib/zlib-bin_1.2.2-4.sarge.2_arm.deb
Size/MD5 checksum: 25286 6a7931194287cc37f44f3a050ca1e945
hppa architecture (HP PA RISC)
http://security.debian.org/pool/updates/main/z/zlib/zlib1g_1.2.2-4.sarge.2_hppa.deb
Size/MD5 checksum: 70420 cb03981137f73dd2fb9a2a2cc40f2d18
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-udeb_1.2.2-4.sarge.2_hppa.udeb
Size/MD5 checksum: 45430 7344c8007baae367ba7c8c4c72cfda68
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-dev_1.2.2-4.sarge.2_hppa.deb
Size/MD5 checksum: 512584 920721beba8dd6edc1c476b83bba74a0
http://security.debian.org/pool/updates/main/z/zlib/zlib-bin_1.2.2-4.sarge.2_hppa.deb
Size/MD5 checksum: 29308 bd0d18dbaf6e9edaabcbce52528cc195
i386 architecture (Intel ia32)
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-udeb_1.2.2-4.sarge.2_i386.udeb
Size/MD5 checksum: 38402 764ca5f9b9f9fa58c776678225ea8a4b
http://security.debian.org/pool/updates/main/z/zlib/zlib1g_1.2.2-4.sarge.2_i386.deb
Size/MD5 checksum: 63080 f1d25909fcc26fb653ff92083e3c6b1c
http://security.debian.org/pool/updates/main/z/zlib/zlib-bin_1.2.2-4.sarge.2_i386.deb
Size/MD5 checksum: 25780 857be9a5220d54c222ded9c4faff6a22
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-dev_1.2.2-4.sarge.2_i386.deb
Size/MD5 checksum: 488024 dd74347cf85d778238ada4e5b42f8642
ia64 architecture (Intel ia64)
http://security.debian.org/pool/updates/main/z/zlib/zlib1g_1.2.2-4.sarge.2_ia64.deb
Size/MD5 checksum: 93462 6ed01ecbd1f214aa7fee259285944ea7
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-dev_1.2.2-4.sarge.2_ia64.deb
Size/MD5 checksum: 553666 a54eb90a0ac7ffef0460aed3d7f558c7
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-udeb_1.2.2-4.sarge.2_ia64.udeb
Size/MD5 checksum: 68610 56f859f0d990f5b9869dc999c3d0230d
http://security.debian.org/pool/updates/main/z/zlib/zlib-bin_1.2.2-4.sarge.2_ia64.deb
Size/MD5 checksum: 39258 7f0813ae8c8c9208d7ff68139c984f08
m68k architecture (Motorola Mc680x0)
http://security.debian.org/pool/updates/main/z/zlib/zlib-bin_1.2.2-4.sarge.2_m68k.deb
Size/MD5 checksum: 24078 8e79779625dd37e03839668cf9946fc4
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-udeb_1.2.2-4.sarge.2_m68k.udeb
Size/MD5 checksum: 34184 e7e987a0190218c343005f0e08ab130d
http://security.debian.org/pool/updates/main/z/zlib/zlib1g_1.2.2-4.sarge.2_m68k.deb
Size/MD5 checksum: 58884 c453ee8596ab35f83913a1a5652c6a7f
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-dev_1.2.2-4.sarge.2_m68k.deb
Size/MD5 checksum: 486102 29f51d071a8d50feb22ea66351039521
mips architecture (MIPS (Big Endian))
http://security.debian.org/pool/updates/main/z/zlib/zlib1g_1.2.2-4.sarge.2_mips.deb
Size/MD5 checksum: 68822 bf7815238c0cb6f79f0296d89b2fe9a8
http://security.debian.org/pool/updates/main/z/zlib/zlib-bin_1.2.2-4.sarge.2_mips.deb
Size/MD5 checksum: 31564 3ad12bca5cbd9e9818f5bc592813e149
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-udeb_1.2.2-4.sarge.2_mips.udeb
Size/MD5 checksum: 44064 3dd3202a819d9f0cceda522e22c72d0a
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-dev_1.2.2-4.sarge.2_mips.deb
Size/MD5 checksum: 510282 8c2496dd52057a439d363b113245ad6e
mipsel architecture (MIPS (Little Endian))
http://security.debian.org/pool/updates/main/z/zlib/zlib1g_1.2.2-4.sarge.2_mipsel.deb
Size/MD5 checksum: 69152 9e2754cc95ad0981969a683317e098cb
http://security.debian.org/pool/updates/main/z/zlib/zlib-bin_1.2.2-4.sarge.2_mipsel.deb
Size/MD5 checksum: 31538 7b2548f4afb248be93d4dfbb3e76ff93
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-dev_1.2.2-4.sarge.2_mipsel.deb
Size/MD5 checksum: 509596 630a54c28569edbb2137831993d58e9e
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-udeb_1.2.2-4.sarge.2_mipsel.udeb
Size/MD5 checksum: 44320 3f8f84d2c70973d46af65ef9a4a0cc07
powerpc architecture (PowerPC)
http://security.debian.org/pool/updates/main/z/zlib/zlib-bin_1.2.2-4.sarge.2_powerpc.deb
Size/MD5 checksum: 30008 543bcd8e27d7899d2df07dd2ba9fabf6
http://security.debian.org/pool/updates/main/z/zlib/zlib1g_1.2.2-4.sarge.2_powerpc.deb
Size/MD5 checksum: 69670 9bc554e8b2783e93c80c7545b267dac0
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-dev_1.2.2-4.sarge.2_powerpc.deb
Size/MD5 checksum: 522700 14660718b619efe6022e70be92cfb297
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-udeb_1.2.2-4.sarge.2_powerpc.udeb
Size/MD5 checksum: 44796 a4469df0bfa2c207a5670cf72d6618a8
s390 architecture (IBM S/390)
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-udeb_1.2.2-4.sarge.2_s390.udeb
Size/MD5 checksum: 42554 8e3b601e51c37543f487e7bfdbdd0fae
http://security.debian.org/pool/updates/main/z/zlib/zlib-bin_1.2.2-4.sarge.2_s390.deb
Size/MD5 checksum: 27226 edd658b54958ac949e03b18a16c16701
http://security.debian.org/pool/updates/main/z/zlib/zlib1g_1.2.2-4.sarge.2_s390.deb
Size/MD5 checksum: 67080 1573e6dac04a89f6112bb49841f67907
http://security.debian.org/pool/updates/main/z/zlib/lib64z1_1.2.2-4.sarge.2_s390.deb
Size/MD5 checksum: 52628 16afd72e2349e5d142cf6f4650a93478
http://security.debian.org/pool/updates/main/z/zlib/lib64z1-dev_1.2.2-4.sarge.2_s390.deb
Size/MD5 checksum: 55560 f06d56fab2f10b1b66924d6c3797a51b
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-dev_1.2.2-4.sarge.2_s390.deb
Size/MD5 checksum: 539004 e503ff8b0920cf33003f
补丁安装方法:
1. 手工安装补丁包:
首先,使用下面的命令来下载补丁软件:
# wget url (url是补丁下载链接地址)
然后,使用下面的命令来安装补丁:
# dpkg -i file.deb (file是相应的补丁名)
2. 使用apt-get自动安装补丁包:
首先,使用下面的命令更新内部数据库:
# apt-get update
然后,使用下面的命令安装更新软件包:
# apt-get upgrade
FreeBSD
-------
FreeBSD已经为此发布了一个安全公告(FreeBSD-SA-05:18)以及相应补丁:
FreeBSD-SA-05:18:Buffer overflow in zlib
链接:ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:18.zlib.asc
补丁下载:
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:18/zlib.patch
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:18/zlib.patch.asc
RedHat
------
RedHat已经为此发布了一个安全公告(RHSA-2005:584-01)以及相应补丁:
RHSA-2005:584-01:Important: zlib security update
链接:http://lwn.net/Alerts/144583/?format=printable
Gentoo
------
Gentoo已经为此发布了一个安全公告(GLSA-200507-19)以及相应补丁:
GLSA-200507-19:zlib: Buffer overflow
链接:http://security.gentoo.org/glsa/glsa-200507-19.xml
所有zlib用户都应升级到最新版本:
# emerge --sync
# emerge --ask --oneshot --verbose ">=sys-libs/zlib-1.2.3"
zlib
----
目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载:
http://www.zlib.net/zlib-1.2.3.tar.gz
浏览次数:4276
严重程度:0(网友投票)
绿盟科技给您安全的保障