发布日期：2009-04-17
更新日期：2009-04-21

受影响系统：

cTorrent cTorrent 1.3.4

描述：

---

BUGTRAQ  ID: 34584
CVE(CAN) ID: CVE-2009-1759

CTorrent是用C/C++编写的FreeBSD和Linux平台的BT客户端。

CTorrent的btfiles.cpp文件中的btFiles::BuildFromMI()函数中存在栈溢出漏洞。如果用户受骗打开了特制的torrent种子文件的话，就可以触发这个溢出，导致执行任意代码。

<*来源：Michael Brooks
  
  链接：http://secunia.com/advisories/34752/
        http://www.debian.org/security/2009/dsa-1817
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

http://milw0rm.com/exploits/8470

建议：

---

厂商补丁：

Debian
------
Debian已经为此发布了一个安全公告（DSA-1817-1）以及相应补丁:
DSA-1817-1：New ctorrent packages fix arbitrary code execution
链接：http://www.debian.org/security/2009/dsa-1817

补丁下载：
Source archives:

http://security.debian.org/pool/updates/main/c/ctorrent/ctorrent_1.3.4-dnh3.2-1+lenny1.diff.gz
Size/MD5 checksum:     6427 a8eb130df614638863d1de39f80aeb3c
http://security.debian.org/pool/updates/main/c/ctorrent/ctorrent_1.3.4-dnh3.2-1+lenny1.dsc
Size/MD5 checksum:     1132 2159a81d35c934811cc4b65a5d51c63e
http://security.debian.org/pool/updates/main/c/ctorrent/ctorrent_1.3.4-dnh3.2.orig.tar.gz
Size/MD5 checksum:   201651 8c4605ea3a1f6d09da593c25b5ab7dbd

alpha architecture (DEC Alpha)

http://security.debian.org/pool/updates/main/c/ctorrent/ctorrent_1.3.4-dnh3.2-1+lenny1_alpha.deb
Size/MD5 checksum:   124858 5fce08bb15b4706ae4dc25c20a9da7b4

amd64 architecture (AMD x86_64 (AMD64))

http://security.debian.org/pool/updates/main/c/ctorrent/ctorrent_1.3.4-dnh3.2-1+lenny1_amd64.deb
Size/MD5 checksum:   112618 34ca707d68325c7b3939338d0b0ca7c2

arm architecture (ARM)

http://security.debian.org/pool/updates/main/c/ctorrent/ctorrent_1.3.4-dnh3.2-1+lenny1_arm.deb
Size/MD5 checksum:   111212 8e4c1fa0ef849a48d3a87e5f68543520

armel architecture (ARM EABI)

http://security.debian.org/pool/updates/main/c/ctorrent/ctorrent_1.3.4-dnh3.2-1+lenny1_armel.deb
Size/MD5 checksum:   109968 60648ec18a34e50b483fbbf3dacba958

hppa architecture (HP PA RISC)

http://security.debian.org/pool/updates/main/c/ctorrent/ctorrent_1.3.4-dnh3.2-1+lenny1_hppa.deb
Size/MD5 checksum:   126318 e784df9d63ad73e20cc295f9afd3a436

i386 architecture (Intel ia32)

http://security.debian.org/pool/updates/main/c/ctorrent/ctorrent_1.3.4-dnh3.2-1+lenny1_i386.deb
Size/MD5 checksum:   107962 d17a52c0f1c4f78cb912159719eaca5d

ia64 architecture (Intel ia64)

http://security.debian.org/pool/updates/main/c/ctorrent/ctorrent_1.3.4-dnh3.2-1+lenny1_ia64.deb
Size/MD5 checksum:   161648 179939230644da247cc342e8b2695df4

mips architecture (MIPS (Big Endian))

http://security.debian.org/pool/updates/main/c/ctorrent/ctorrent_1.3.4-dnh3.2-1+lenny1_mips.deb
Size/MD5 checksum:   123522 efe46dd5e1f6604d01e4e9dccedae3d6

mipsel architecture (MIPS (Little Endian))

http://security.debian.org/pool/updates/main/c/ctorrent/ctorrent_1.3.4-dnh3.2-1+lenny1_mipsel.deb
Size/MD5 checksum:   124204 5af9aa2d675d420684e78250663098a1

powerpc architecture (PowerPC)

http://security.debian.org/pool/updates/main/c/ctorrent/ctorrent_1.3.4-dnh3.2-1+lenny1_powerpc.deb
Size/MD5 checksum:   123882 ee2163a4290b1c617e5b0a90caa7b4c4

s390 architecture (IBM S/390)

http://security.debian.org/pool/updates/main/c/ctorrent/ctorrent_1.3.4-dnh3.2-1+lenny1_s390.deb
Size/MD5 checksum:   115012 fcb29b56a042601293a48ae9a406fc0b

sparc architecture (Sun SPARC/UltraSPARC)

http://security.debian.org/pool/updates/main/c/ctorrent/ctorrent_1.3.4-dnh3.2-1+lenny1_sparc.deb
Size/MD5 checksum:   111682 149c6237664380b0d6c6cb74a3006e0d

补丁安装方法：

1. 手工安装补丁包：

  首先，使用下面的命令来下载补丁软件：
  # wget url  (url是补丁下载链接地址)

  然后，使用下面的命令来安装补丁：  
  # dpkg -i file.deb (file是相应的补丁名)

2. 使用apt-get自动安装补丁包：

   首先，使用下面的命令更新内部数据库：
   # apt-get update
  
   然后，使用下面的命令安装更新软件包：
   # apt-get upgrade

浏览次数：2801
严重程度：0（网友投票）