安全研究
安全漏洞
GNU Gzip动态Huffman解压远程代码执行漏洞
发布日期：2010-01-20
更新日期：2010-01-22
受影响系统：
GNU gzip 1.x不受影响系统：
GNU gzip 1.4描述：
BUGTRAQ ID: 37888
CVE ID: CVE-2009-2624
gzip是一款非常流行的文件压缩工具。
gzip的inflate.c文件中的huft_build()函数解压动态Huffman代码中数据块时存在输入验证错误，用户受骗解压了特制文档就可能触发死循环或导致执行任意代码。
<*来源：Thiemo Nagel
链接：http://secunia.com/advisories/38132/
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507263
http://www.ubuntu.com/usn/USN-889-1
http://www.debian.org/security/2010/dsa-1974
*>
测试方法：
警 告
以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
建议：
厂商补丁：
Debian
------
Debian已经为此发布了一个安全公告（DSA-1974-1）以及相应补丁:
DSA-1974-1：New gzip packages fix arbitrary code execution
链接：http://www.debian.org/security/2010/dsa-1974
补丁下载：
Source archives:
http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.5-15+etch1.dsc
Size/MD5 checksum: 573 4a4c81d72ed695f7e0b710fa7da00201
http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.5-15+etch1.diff.gz
Size/MD5 checksum: 62547 34c6cab73195a3b9e2b187636cf69dc2
http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.5.orig.tar.gz
Size/MD5 checksum: 331550 3d6c191dfd2bf307014b421c12dc8469
alpha architecture (DEC Alpha)
http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.5-15+etch1_alpha.deb
Size/MD5 checksum: 84202 2677656b86d648a05b54ba0c03028eb1
amd64 architecture (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.5-15+etch1_amd64.deb
Size/MD5 checksum: 76988 86e571b7bf22e4924c5d7f82306ab064
arm architecture (ARM)
http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.5-15+etch1_arm.deb
Size/MD5 checksum: 79428 7e71e302f090a62f52b7f6f5d35b627b
hppa architecture (HP PA RISC)
http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.5-15+etch1_hppa.deb
Size/MD5 checksum: 81616 02d1712f3f62de9f05810cd3a1660d77
i386 architecture (Intel ia32)
http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.5-15+etch1_i386.deb
Size/MD5 checksum: 74324 ac441b57b7423d65985acaef2e40df9f
ia64 architecture (Intel ia64)
http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.5-15+etch1_ia64.deb
Size/MD5 checksum: 96216 89b544a5f93d7607e1608d7856fa70e8
mipsel architecture (MIPS (Little Endian))
http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.5-15+etch1_mipsel.deb
Size/MD5 checksum: 82266 ff332d05f508dad0d3067dd713bee839
powerpc architecture (PowerPC)
http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.5-15+etch1_powerpc.deb
Size/MD5 checksum: 79722 1e117918ab793443c9da0af6f137e7a7
s390 architecture (IBM S/390)
http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.5-15+etch1_s390.deb
Size/MD5 checksum: 80602 4c5accebc99f8b263cef9500a94ae2ca
sparc architecture (Sun SPARC/UltraSPARC)
http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.5-15+etch1_sparc.deb
Size/MD5 checksum: 77262 f440c798c3fe592896286047b643116d
Debian GNU/Linux 5.0 alias lenny
- --------------------------------
Debian (stable)
- ---------------
Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.
Source archives:
http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.12-6+lenny1.diff.gz
Size/MD5 checksum: 14580 7dac4e2e855b89ec335605722da16bd0
http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.12.orig.tar.gz
Size/MD5 checksum: 462169 b5bac2d21840ae077e0217bc5e4845b1
http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.12-6+lenny1.dsc
Size/MD5 checksum: 1024 40c1d638034b3c9be692af4057a9499c
Architecture independent packages:
http://security.debian.org/pool/updates/main/g/gzip/gzip-win32_1.3.12-6+lenny1_all.deb
Size/MD5 checksum: 68438 858f1373aa128793538f5e5f6e283e24
alpha architecture (DEC Alpha)
http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.12-6+lenny1_alpha.deb
Size/MD5 checksum: 112736 2afbb523626d0793acf7e1cb4be21938
amd64 architecture (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.12-6+lenny1_amd64.deb
Size/MD5 checksum: 106024 68119c7d80f94457b2f241cb90bd3aee
arm architecture (ARM)
http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.12-6+lenny1_arm.deb
Size/MD5 checksum: 108462 b8daebe8a54750428f6028612297e76b
armel architecture (ARM EABI)
http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.12-6+lenny1_armel.deb
Size/MD5 checksum: 106906 14e79925acc936699aaa8ccee0b6d04d
hppa architecture (HP PA RISC)
http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.12-6+lenny1_hppa.deb
Size/MD5 checksum: 111448 7e94ea327492912e21b360e45ab324d5
i386 architecture (Intel ia32)
http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.12-6+lenny1_i386.deb
Size/MD5 checksum: 102866 4cef436339090cd800efb7e6bb92b14b
ia64 architecture (Intel ia64)
http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.12-6+lenny1_ia64.deb
Size/MD5 checksum: 123250 c38a5a05f04fa731340c254028d240c3
mipsel architecture (MIPS (Little Endian))
http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.12-6+lenny1_mipsel.deb
Size/MD5 checksum: 109266 5e17c751ddc3a65085f005dddcf6426c
powerpc architecture (PowerPC)
http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.12-6+lenny1_powerpc.deb
Size/MD5 checksum: 109502 3ae2e1dfc3b13d0ed4574103aca3904d
s390 architecture (IBM S/390)
http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.12-6+lenny1_s390.deb
Size/MD5 checksum: 108896 e7b03509583f7cbed875359a2595a3a0
sparc architecture (Sun SPARC/UltraSPARC)
http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.12-6+lenny1_sparc.deb
Size/MD5 checksum: 106462 f166981469f7fd047ceabe5f26832638
补丁安装方法：
1. 手工安装补丁包：
首先，使用下面的命令来下载补丁软件：
# wget url (url是补丁下载链接地址)
然后，使用下面的命令来安装补丁：
# dpkg -i file.deb (file是相应的补丁名)
2. 使用apt-get自动安装补丁包：
首先，使用下面的命令更新内部数据库：
# apt-get update
然后，使用下面的命令安装更新软件包：
# apt-get upgrade
GNU
---
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：
http://git.savannah.gnu.org/cgit/gzip.git/commit/?id=39a362ae9d9b007473381dba5032f4dfc1744cf2
Ubuntu
------
Ubuntu已经为此发布了一个安全公告（USN-889-1）以及相应补丁:
USN-889-1：gzip vulnerabilities
链接：http://www.ubuntu.com/usn/USN-889-1
浏览次数：3169
严重程度：0（网友投票）
绿盟科技给您安全的保障