漏洞信息详情

Rlpr msg()函数多个安全漏洞

• CNNVD编号：CNNVD-200412-034
• 危害等级： 高危
  
• CVE编号： CVE-2004-0454
• 漏洞类型： 输入验证
• 发布时间： 2004-06-19
• 威胁类型： 本地
• 更新时间： 2005-10-20
• 厂        商： rlpr
• 漏洞来源： Jaguar

漏洞简介

rlpr是一款不使用/etc/printcap的lpd打印工具。 rlpr包含的msg()函数存在格式串和缓冲区溢出问题，本地或远程攻击者可以利用这个漏洞以rlprd进程权限执行任意指令。 问题一是msg()调用syslog函数记录时没有进行任何过滤，提交格式串数据可能破坏内存信息。另外msg()函数对输入缺少充分缓冲区边界检查，可导致缓冲区溢出攻击。精心构建提交数据可能以rlprd进程(远程)或者root(本地)权限执行任意指令。

漏洞公告

厂商补丁： Debian ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

rlpr rlpr 2.0 2:

Debian Upgrade rlpr_2.02-7woody1_alpha.deb

http://security.debian.org/pool/updates/main/r/rlpr/rlpr_2.02-7woody1_alpha.deb

Debian GNU/Linux 3.0 (woody)

Debian Upgrade rlpr_2.02-7woody1_arm.deb

http://security.debian.org/pool/updates/main/r/rlpr/rlpr_2.02-7woody1_arm.deb

Debian GNU/Linux 3.0 (woody)

Debian Upgrade rlpr_2.02-7woody1_i386.deb

http://security.debian.org/pool/updates/main/r/rlpr/rlpr_2.02-7woody1_i386.deb

Debian GNU/Linux 3.0 (woody)

Debian Upgrade rlpr_2.02-7woody1_ia64.deb

http://security.debian.org/pool/updates/main/r/rlpr/rlpr_2.02-7woody1_ia64.deb

Debian GNU/Linux 3.0 (woody)

Debian Upgrade rlpr_2.02-7woody1_hppa.deb

http://security.debian.org/pool/updates/main/r/rlpr/rlpr_2.02-7woody1_hppa.deb

Debian GNU/Linux 3.0 (woody)

Debian Upgrade rlpr_2.02-7woody1_m68k.deb

http://security.debian.org/pool/updates/main/r/rlpr/rlpr_2.02-7woody1_m68k.deb

Debian GNU/Linux 3.0 (woody)

Debian Upgrade rlpr_2.02-7woody1_mips.deb

http://security.debian.org/pool/updates/main/r/rlpr/rlpr_2.02-7woody1_mips.deb

Debian GNU/Linux 3.0 (woody)

Debian Upgrade rlpr_2.02-7woody1_mipsel.deb

http://security.debian.org/pool/updates/main/r/rlpr/rlpr_2.02-7woody1_mipsel.deb

Debian GNU/Linux 3.0 (woody)

Debian Upgrade rlpr_2.02-7woody1_powerpc.deb

http://security.debian.org/pool/updates/main/r/rlpr/rlpr_2.02-7woody1_powerpc.deb

Debian GNU/Linux 3.0 (woody)

Debian Upgrade rlpr_2.02-7woody1_s390.deb

http://security.debian.org/pool/updates/main/r/rlpr/rlpr_2.02-7woody1_s390.deb

Debian GNU/Linux 3.0 (woody)

Debian Upgrade rlpr_2.02-7woody1_sparc.deb

http://security.debian.org/pool/updates/main/r/rlpr/rlpr_2.02-7woody1_sparc.deb

Debian GNU/Linux 3.0 (woody)

参考网址

来源: XF 名称: rlpr-msg-bo(16454) 链接:http://xforce.iss.net/xforce/xfdb/16454 来源: BID 名称: 10578 链接:http://www.securityfocus.com/bid/10578 来源: DEBIAN 名称: DSA-524 链接:http://www.debian.org/security/2004/dsa-524

受影响实体

• Rlpr Rlpr:2.0  
• Rlpr Rlpr:2.0.1  
• Rlpr Rlpr:2.0.2  
• Rlpr Rlpr:2.0.3  
• Rlpr Rlpr:2.0.4  

补丁

暂无