漏洞信息详情
Rlpr msg()函数多个安全漏洞
- CNNVD编号:CNNVD-200412-033
- 危害等级: 超危
- CVE编号: CVE-2004-0393
- 漏洞类型: 输入验证
- 发布时间: 2004-06-19
- 威胁类型: 远程
- 更新时间: 2005-10-20
- 厂 商: rlpr
- 漏洞来源: Jaguar
漏洞简介
rlpr是一款不使用/etc/printcap的lpd打印工具。 rlpr包含的msg()函数存在格式串和缓冲区溢出问题,本地或远程攻击者可以利用这个漏洞以rlprd进程权限执行任意指令。 问题一是msg()调用syslog函数记录时没有进行任何过滤,提交格式串数据可能破坏内存信息。另外msg()函数对输入缺少充分缓冲区边界检查,可导致缓冲区溢出攻击。精心构建提交数据可能以rlprd进程(远程)或者root(本地)权限执行任意指令。
漏洞公告
厂商补丁: Debian ------ 目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载:
rlpr rlpr 2.0 2:
Debian Upgrade rlpr_2.02-7woody1_alpha.deb
http://security.debian.org/pool/updates/main/r/rlpr/rlpr_2.02-7woody1_alpha.deb
Debian GNU/Linux 3.0 (woody)
Debian Upgrade rlpr_2.02-7woody1_arm.deb
http://security.debian.org/pool/updates/main/r/rlpr/rlpr_2.02-7woody1_arm.deb
Debian GNU/Linux 3.0 (woody)
Debian Upgrade rlpr_2.02-7woody1_i386.deb
http://security.debian.org/pool/updates/main/r/rlpr/rlpr_2.02-7woody1_i386.deb
Debian GNU/Linux 3.0 (woody)
Debian Upgrade rlpr_2.02-7woody1_ia64.deb
http://security.debian.org/pool/updates/main/r/rlpr/rlpr_2.02-7woody1_ia64.deb
Debian GNU/Linux 3.0 (woody)
Debian Upgrade rlpr_2.02-7woody1_hppa.deb
http://security.debian.org/pool/updates/main/r/rlpr/rlpr_2.02-7woody1_hppa.deb
Debian GNU/Linux 3.0 (woody)
Debian Upgrade rlpr_2.02-7woody1_m68k.deb
http://security.debian.org/pool/updates/main/r/rlpr/rlpr_2.02-7woody1_m68k.deb
Debian GNU/Linux 3.0 (woody)
Debian Upgrade rlpr_2.02-7woody1_mips.deb
http://security.debian.org/pool/updates/main/r/rlpr/rlpr_2.02-7woody1_mips.deb
Debian GNU/Linux 3.0 (woody)
Debian Upgrade rlpr_2.02-7woody1_mipsel.deb
http://security.debian.org/pool/updates/main/r/rlpr/rlpr_2.02-7woody1_mipsel.deb
Debian GNU/Linux 3.0 (woody)
Debian Upgrade rlpr_2.02-7woody1_powerpc.deb
http://security.debian.org/pool/updates/main/r/rlpr/rlpr_2.02-7woody1_powerpc.deb
Debian GNU/Linux 3.0 (woody)
Debian Upgrade rlpr_2.02-7woody1_s390.deb
http://security.debian.org/pool/updates/main/r/rlpr/rlpr_2.02-7woody1_s390.deb
Debian GNU/Linux 3.0 (woody)
Debian Upgrade rlpr_2.02-7woody1_sparc.deb
http://security.debian.org/pool/updates/main/r/rlpr/rlpr_2.02-7woody1_sparc.deb
Debian GNU/Linux 3.0 (woody)
参考网址
来源: XF 名称: rlpr-msg-format-string(16453) 链接:http://xforce.iss.net/xforce/xfdb/16453 来源: BID 名称: 10578 链接:http://www.securityfocus.com/bid/10578 来源: DEBIAN 名称: DSA-524 链接:http://www.debian.org/security/2004/dsa-524 来源: BUGTRAQ 名称: 20040624 Rlpr Advisory 链接:http://marc.theaimsgroup.com/?l=bugtraq&m=108810992313652&w=2 来源: BID 名称: 10578 链接:http://www.securityfocus.com/bid/10578
受影响实体
- Rlpr Rlpr:2.0
- Rlpr Rlpr:2.0.1
- Rlpr Rlpr:2.0.2
- Rlpr Rlpr:2.0.3
- Rlpr Rlpr:2.0.4
补丁
暂无
![weinxin](http://zone.ci/zone_ci_images/zone.ci.png)
评论