漏洞信息详情

Smarty 'libs/plugins/function.math.php' 安全绕过漏洞

• CNNVD编号：CNNVD-200905-230
• 危害等级： 高危
  
• CVE编号： CVE-2009-1669
• 漏洞类型： 输入验证
• 发布时间： 2009-05-18
• 威胁类型： 远程
• 更新时间： 2009-06-10
• 厂        商： smarty
• 漏洞来源： Nine:Situations:Gr...

漏洞简介

Smarty是一款被称为\"模板引擎\"，的工具，用\"模板/演示框架\"来形容更准确，它提供了编程模板与丰富的工具来实现自动化设计应用程序的表示层任务。

Smarty 2.6.22版本的libs/plugins/function.math.php中的smarty_function_math函数会允许见机行事的攻击者可以借助数学函数的方程属性中的外壳元字符，执行任意指令。

漏洞公告

目前厂商已经发布了升级补丁以修复这个安全问题，补丁下载链接：

Ubuntu Ubuntu Linux 8.04 LTS powerpc

Ubuntu moodle_1.8.2-1ubuntu4.2_all.deb

http://security.ubuntu.com/ubuntu/pool/main/m/moodle/moodle_1.8.2-1ubuntu4.2_all.deb

Ubuntu Ubuntu Linux 8.10 powerpc

Ubuntu moodle_1.8.2-1.2ubuntu2.1_all.deb

http://security.ubuntu.com/ubuntu/pool/main/m/moodle/moodle_1.8.2-1.2ubuntu2.1_all.deb

Ubuntu Ubuntu Linux 8.04 LTS sparc

Ubuntu moodle_1.8.2-1ubuntu4.2_all.deb

http://security.ubuntu.com/ubuntu/pool/main/m/moodle/moodle_1.8.2-1ubuntu4.2_all.deb

Ubuntu Ubuntu Linux 8.10 i386

Ubuntu moodle_1.8.2-1.2ubuntu2.1_all.deb

http://security.ubuntu.com/ubuntu/pool/main/m/moodle/moodle_1.8.2-1.2ubuntu2.1_all.deb

Ubuntu Ubuntu Linux 8.04 LTS amd64

Ubuntu moodle_1.8.2-1ubuntu4.2_all.deb

http://security.ubuntu.com/ubuntu/pool/main/m/moodle/moodle_1.8.2-1ubuntu4.2_all.deb

Ubuntu Ubuntu Linux 9.04 sparc

Ubuntu smarty_2.6.22-1ubuntu1.1_all.deb

http://security.ubuntu.com/ubuntu/pool/main/s/smarty/smarty_2.6.22-1ubuntu1.1_all.deb

Ubuntu Ubuntu Linux 9.04 powerpc

Ubuntu smarty_2.6.22-1ubuntu1.1_all.deb

http://security.ubuntu.com/ubuntu/pool/main/s/smarty/smarty_2.6.22-1ubuntu1.1_all.deb

Ubuntu Ubuntu Linux 8.04 LTS lpia

Ubuntu moodle_1.8.2-1ubuntu4.2_all.deb

http://security.ubuntu.com/ubuntu/pool/main/m/moodle/moodle_1.8.2-1ubuntu4.2_all.deb

Ubuntu Ubuntu Linux 8.10 lpia

Ubuntu moodle_1.8.2-1.2ubuntu2.1_all.deb

http://security.ubuntu.com/ubuntu/pool/main/m/moodle/moodle_1.8.2-1.2ubuntu2.1_all.deb

Ubuntu Ubuntu Linux 9.04 i386

Ubuntu smarty_2.6.22-1ubuntu1.1_all.deb

http://security.ubuntu.com/ubuntu/pool/main/s/smarty/smarty_2.6.22-1ubuntu1.1_all.deb

Ubuntu Ubuntu Linux 8.10 sparc

Ubuntu moodle_1.8.2-1.2ubuntu2.1_all.deb

http://security.ubuntu.com/ubuntu/pool/main/m/moodle/moodle_1.8.2-1.2ubuntu2.1_all.deb

Ubuntu Ubuntu Linux 9.04 lpia

Ubuntu smarty_2.6.22-1ubuntu1.1_all.deb

http://security.ubuntu.com/ubuntu/pool/main/s/smarty/smarty_2.6.22-1ubuntu1.1_all.deb

Ubuntu Ubuntu Linux 8.04 LTS i386

Ubuntu moodle_1.8.2-1ubuntu4.2_all.deb

http://security.ubuntu.com/ubuntu/pool/main/m/moodle/moodle_1.8.2-1ubuntu4.2_all.deb

Ubuntu Ubuntu Linux 9.04 amd64

Ubuntu smarty_2.6.22-1ubuntu1.1_all.deb

http://security.ubuntu.com/ubuntu/pool/main/s/smarty/smarty_2.6.22-1ubuntu1.1_all.deb

Ubuntu Ubuntu Linux 8.10 amd64

Ubuntu moodle_1.8.2-1.2ubuntu2.1_all.deb

http://security.ubuntu.com/ubuntu/pool/main/m/moodle/moodle_1.8.2-1.2ubuntu2.1_all.deb

参考网址

来源: FEDORA

名称: FEDORA-2009-5520

链接:https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01287.HTML

来源: FEDORA

名称: FEDORA-2009-5516

链接:https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01283.HTML

来源: FEDORA

名称: FEDORA-2009-5525

链接:https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01274.HTML

来源: XF

名称: smarty-smartyfunctionmath-cmd-execution(50457)

链接:http://xforce.iss.net/xforce/xfdb/50457

来源: UBUNTU

名称: USN-791-3

链接:http://www.ubuntu.com/usn/usn-791-3

来源: BID

名称: 34918

链接:http://www.securityfocus.com/bid/34918

来源: MILW0RM

名称: 8659

链接:http://www.milw0rm.com/exploits/8659

来源: SECUNIA

名称: 35219

链接:http://secunia.com/advisories/35219

来源: SECUNIA

名称: 35072

链接:http://secunia.com/advisories/35072

来源: OSVDB

名称: 54380

链接:http://osvdb.org/54380

受影响实体

• Smarty Smarty:2.6.22  

补丁

暂无