发布日期：2008-11-25
更新日期：2008-12-29

受影响系统：

Diginum Zaptel 1.4.x
Diginum Zaptel 1.2.x

描述：

---

BUGTRAQ  ID: 32575
CVE(CAN) ID: CVE-2008-5396,CVE-2008-5744

zaptel软件包是用于配置Zapata电话内核驱动的用户工具。

由于对ZT_SPANCONFIG ioctl相关的sync字段缺少检查，导致Zaptel中的torisa.c驱动的torisa_spanconfig()函数和dahdi/tor2.c驱动的tor2_spanconfig()函数存在数组索引错误。dialout组中的本地用户可以通过写入/dev/zap/ctl覆盖内核内存中的整数值，导致拒绝服务或获得权限提升。

<*来源：Tzafrir Cohen （tzafrir.cohen@xorcom.com）
  
  链接：https://bugzilla.redhat.com/show_bug.cgi?format=multiple&id=475446
        http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507459
        http://bugs.digium.com/print_bug_page.php?bug_id=13954
        http://secunia.com/advisories/32947/
        http://www.debian.org/security/2009/dsa-1699
*>

建议：

---

厂商补丁：

Debian
------
Debian已经为此发布了一个安全公告（DSA-1699-1）以及相应补丁:
DSA-1699-1：New zaptel packages fix privilege escalation
链接：http://www.debian.org/security/2009/dsa-1699

补丁下载：
Source archives:

http://security.debian.org/pool/updates/main/z/zaptel/zaptel_1.2.11.dfsg-1+etch1.diff.gz
Size/MD5 checksum:   112903 deb886bbf7ec5183a8b8f2acdb282aca
http://security.debian.org/pool/updates/main/z/zaptel/zaptel_1.2.11.dfsg.orig.tar.gz
Size/MD5 checksum:  1192239 a8b32a69e6c6dd1caf526eef4d0c4487
http://security.debian.org/pool/updates/main/z/zaptel/zaptel_1.2.11.dfsg-1+etch1.dsc
Size/MD5 checksum:     1273 a76cdc21eb9bcecf25dcd5815f65fc2d

Architecture independent packages:

http://security.debian.org/pool/updates/main/z/zaptel/zaptel-source_1.2.11.dfsg-1+etch1_all.deb
Size/MD5 checksum:   928098 804dbf80db1756a21d25e78b339d04c6

alpha architecture (DEC Alpha)

http://security.debian.org/pool/updates/main/z/zaptel/libtonezone-dev_1.2.11.dfsg-1+etch1_alpha.deb
Size/MD5 checksum:    28412 da608a05b2dc20dc78ac7869d96ac8d9
http://security.debian.org/pool/updates/main/z/zaptel/libtonezone1_1.2.11.dfsg-1+etch1_alpha.deb
Size/MD5 checksum:    27152 dc847d4d989985cc64de8cf5ddc9c278
http://security.debian.org/pool/updates/main/z/zaptel/zaptel_1.2.11.dfsg-1+etch1_alpha.deb
Size/MD5 checksum:   118832 52a926c91d66dc696ceb1adcde3e8766

amd64 architecture (AMD x86_64 (AMD64))

http://security.debian.org/pool/updates/main/z/zaptel/zaptel_1.2.11.dfsg-1+etch1_amd64.deb
Size/MD5 checksum:   112450 b97b640e292ec75039d88a149048bf37
http://security.debian.org/pool/updates/main/z/zaptel/libtonezone1_1.2.11.dfsg-1+etch1_amd64.deb
Size/MD5 checksum:    26040 4644fc0debb57cb63d0ecd2a065628d2
http://security.debian.org/pool/updates/main/z/zaptel/libtonezone-dev_1.2.11.dfsg-1+etch1_amd64.deb
Size/MD5 checksum:    26898 a816ba6f8001ce15f21436e55086c0ba

arm architecture (ARM)

http://security.debian.org/pool/updates/main/z/zaptel/zaptel_1.2.11.dfsg-1+etch1_arm.deb
Size/MD5 checksum:   111358 1ea716a259d884d2f60587e0c0bff0d5
http://security.debian.org/pool/updates/main/z/zaptel/libtonezone1_1.2.11.dfsg-1+etch1_arm.deb
Size/MD5 checksum:    26418 53817f46e87cdffc0ff1f7f552f0abcd
http://security.debian.org/pool/updates/main/z/zaptel/libtonezone-dev_1.2.11.dfsg-1+etch1_arm.deb
Size/MD5 checksum:    26830 2b3cfe526622aef8c8a013ed488a3618

i386 architecture (Intel ia32)

http://security.debian.org/pool/updates/main/z/zaptel/libtonezone-dev_1.2.11.dfsg-1+etch1_i386.deb
Size/MD5 checksum:    27560 c83b30d1fa4c97736612490b4a3315a5
http://security.debian.org/pool/updates/main/z/zaptel/libtonezone1_1.2.11.dfsg-1+etch1_i386.deb
Size/MD5 checksum:    26514 9512ab4bcdefd131908e5dcba7544054
http://security.debian.org/pool/updates/main/z/zaptel/zaptel_1.2.11.dfsg-1+etch1_i386.deb
Size/MD5 checksum:   109262 0be95fc29308efcbc541d4666caf77c4

ia64 architecture (Intel ia64)

http://security.debian.org/pool/updates/main/z/zaptel/libtonezone-dev_1.2.11.dfsg-1+etch1_ia64.deb
Size/MD5 checksum:    28766 58c733396e6c7306917ae9afba6ad500
http://security.debian.org/pool/updates/main/z/zaptel/zaptel_1.2.11.dfsg-1+etch1_ia64.deb
Size/MD5 checksum:   136616 f09671965e51b3a0c6151735b5a470bc
http://security.debian.org/pool/updates/main/z/zaptel/libtonezone1_1.2.11.dfsg-1+etch1_ia64.deb
Size/MD5 checksum:    28400 8c55b47382faede9b16afd6ecca8f883

mips architecture (MIPS (Big Endian))

http://security.debian.org/pool/updates/main/z/zaptel/zaptel_1.2.11.dfsg-1+etch1_mips.deb
Size/MD5 checksum:   112786 bb7b9050df100c78fb21227a4bcdd4bb
http://security.debian.org/pool/updates/main/z/zaptel/libtonezone1_1.2.11.dfsg-1+etch1_mips.deb
Size/MD5 checksum:    26088 550da9590e11841dba8652209fe24e7c
http://security.debian.org/pool/updates/main/z/zaptel/libtonezone-dev_1.2.11.dfsg-1+etch1_mips.deb
Size/MD5 checksum:    27218 f6ae1b88b22c6dd2ff2376adc739c13c

powerpc architecture (PowerPC)

http://security.debian.org/pool/updates/main/z/zaptel/libtonezone-dev_1.2.11.dfsg-1+etch1_powerpc.deb
Size/MD5 checksum:    27432 6b94c97d24e9caa31b6f091f1e7aa4fe
http://security.debian.org/pool/updates/main/z/zaptel/libtonezone1_1.2.11.dfsg-1+etch1_powerpc.deb
Size/MD5 checksum:    28420 f1eae93d4742fe5786465bea8a8599f0
http://security.debian.org/pool/updates/main/z/zaptel/zaptel_1.2.11.dfsg-1+etch1_powerpc.deb
Size/MD5 checksum:   113630 09a921631b767f79b652808ca49e6831

s390 architecture (IBM S/390)

http://security.debian.org/pool/updates/main/z/zaptel/zaptel_1.2.11.dfsg-1+etch1_s390.deb
Size/MD5 checksum:   114156 247c08c3342bcac8a41b6211d69581a9
http://security.debian.org/pool/updates/main/z/zaptel/libtonezone-dev_1.2.11.dfsg-1+etch1_s390.deb
Size/MD5 checksum:    27532 8fefbe0635e726df678199120adc28c2
http://security.debian.org/pool/updates/main/z/zaptel/libtonezone1_1.2.11.dfsg-1+etch1_s390.deb
Size/MD5 checksum:    26946 908083d23841896ce931c625ea6f632e

sparc architecture (Sun SPARC/UltraSPARC)

http://security.debian.org/pool/updates/main/z/zaptel/libtonezone1_1.2.11.dfsg-1+etch1_sparc.deb
Size/MD5 checksum:    26758 306a85a06dad10720e3783e9b3566a4e
http://security.debian.org/pool/updates/main/z/zaptel/libtonezone-dev_1.2.11.dfsg-1+etch1_sparc.deb
Size/MD5 checksum:    27776 4f8098832f55f4b13900cf8f684bf68b
http://security.debian.org/pool/updates/main/z/zaptel/zaptel_1.2.11.dfsg-1+etch1_sparc.deb
Size/MD5 checksum:   111288 c8e4caf317b017bf3987f34c656c9434

补丁安装方法：

1. 手工安装补丁包：

  首先，使用下面的命令来下载补丁软件：
  # wget url  (url是补丁下载链接地址)

  然后，使用下面的命令来安装补丁：  
  # dpkg -i file.deb (file是相应的补丁名)

2. 使用apt-get自动安装补丁包：

   首先，使用下面的命令更新内部数据库：
   # apt-get update
  
   然后，使用下面的命令安装更新软件包：
   # apt-get upgrade

Diginum
-------
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

http://svn.digium.com/view/zaptel?view=rev&revision=4587
http://svn.digium.com/view/zaptel?view=rev&revision=4588
http://svn.digium.com/view/dahdi?view=rev&revision=5590

浏览次数：2779
严重程度：0（网友投票）