Neon WebDAV客户端库ne_rfc1036_parse函数堆溢出漏洞※台州理想网

Neon WebDAV客户端库ne_rfc1036_parse函数堆溢出漏洞

作者：不详　　时间：2004-11-19 9:35:20　　来自：台州理想网　　责任编辑：　　阅读次数：

　　台州理想网(tzlx.Net)依法保护知识产权，如果我们的文章有涉及或侵犯您的有关权益，请即时与我们联系，注明网址及文章，我们会即时处理或删除，感谢您的合作！

查看:[大字中等还原] 自动滚屏[左键停止] 或者双击自动滚屏

受影响系统：
Neon Client Library 0.24.5
Neon Client Library 0.24.4
Neon Client Library 0.24.3
Neon Client Library 0.24.2
Neon Client Library 0.24.1
Neon Client Library 0.24
Neon Client Library 0.23.8
Neon Client Library 0.23.7
Neon Client Library 0.23.6
Neon Client Library 0.23.5
Neon Client Library 0.23.4
Neon Client Library 0.23.3
Neon Client Library 0.23.2
Neon Client Library 0.23.1
Neon Client Library 0.23
Neon Client Library 0.19.3
- Debian Linux 3.0
不受影响系统：
Neon Client Library 0.24.6
描述：
--------------------------------------------------------------------------------
BUGTRAQ ID: 10385
CVE(CAN) ID: CAN-2004-0398

neon是一款HTTP和WebDAV客户端库。

Neon WebDAV客户端库不正确检查用户提供的数据，远程攻击者可以利用这个漏洞对调用库的应用程序进行基于堆的溢出。

问题存在于ne_rfc1036_parse()函数中，提交特殊的日期字符串给ne_rfc1036_parse()可触发sscanf()字符串溢出堆中的静态变量，成功利用此漏洞可能以调用此库的应用程序进程权限执行任意指令。

<*来源：Stefan Esser （s.esser@ematters.de）

链接：http://security.e-matters.de/advisories/062004.html?SID=384b888de96e3bce19306db8577fca26
http://www.debian.org/security/2002/dsa-506
http://www.debian.org/security/2002/dsa-507
http://www.linux-mandrake.com/en/security/2004/2004-049.php
*>

建议：
--------------------------------------------------------------------------------
厂商补丁：

Debian
------
Debian已经为此发布了一个安全公告（DSA-507-1）以及相应补丁:
DSA-507-1：New cadaver packages fix buffer overflow
链接：http://www.debian.org/security/2002/dsa-507

补丁下载：

Source archives:

http://security.debian.org/pool/updates/main/c/cadaver/cadaver_0.18.0-1woody3.dsc
Size/MD5 checksum: 668 cc085f1e27ca315d3443c7e536c9b349
http://security.debian.org/pool/updates/main/c/cadaver/cadaver_0.18.0-1woody3.diff.gz
Size/MD5 checksum: 1674 d60b429cc57107856ffd180f3cb2836f
http://security.debian.org/pool/updates/main/c/cadaver/cadaver_0.18.0.orig.tar.gz
Size/MD5 checksum: 405643 40fc8cf38c71b2f74692a91ba891845b

Alpha architecture:

http://security.debian.org/pool/updates/main/c/cadaver/cadaver_0.18.0-1woody3_alpha.deb
Size/MD5 checksum: 102242 3b45e150425b73405453f03c2e45f63b

ARM architecture:

http://security.debian.org/pool/updates/main/c/cadaver/cadaver_0.18.0-1woody3_arm.deb
Size/MD5 checksum: 83448 1a8f45defcd34ef51b3cb678e3106d27

Intel IA-32 architecture:

http://security.debian.org/pool/updates/main/c/cadaver/cadaver_0.18.0-1woody3_i386.deb
Size/MD5 checksum: 81472 e5476b51ea6efbcff662258effdfd5ee

Intel IA-64 architecture:

http://security.debian.org/pool/updates/main/c/cadaver/cadaver_0.18.0-1woody3_ia64.deb
Size/MD5 checksum: 125782 7b7dbd87a96e73ef3116c22c406d4bbb

HP Precision architecture:

http://security.debian.org/pool/updates/main/c/cadaver/cadaver_0.18.0-1woody3_hppa.deb
Size/MD5 checksum: 96250 f37a834f4a1cb9e80d36e50188e1bddf

Motorola 680x0 architecture:

http://security.debian.org/pool/updates/main/c/cadaver/cadaver_0.18.0-1woody3_m68k.deb
Size/MD5 checksum: 77522 c1c630fba52ac06d9e54a35d31922fb6

Big endian MIPS architecture:

http://security.debian.org/pool/updates/main/c/cadaver/cadaver_0.18.0-1woody3_mips.deb
Size/MD5 checksum: 95090 e74a612892d09b1e80fdc2129497bc6a

Little endian MIPS architecture:

http://security.debian.org/pool/updates/main/c/cadaver/cadaver_0.18.0-1woody3_mipsel.deb
Size/MD5 checksum: 94924 51eae2cf3b195cb7f25ec7b685bf18d2

PowerPC architecture:

http://security.debian.org/pool/updates/main/c/cadaver/cadaver_0.18.0-1woody3_powerpc.deb
Size/MD5 checksum: 87566 43894c27a77b6e5e64224aec283f1a39

IBM S/390 architecture:

http://security.debian.org/pool/updates/main/c/cadaver/cadaver_0.18.0-1woody3_s390.deb
Size/MD5 checksum: 84718 3787dd1d00c5b415822b3ec9763bbec9

Sun Sparc architecture:

http://security.debian.org/pool/updates/main/c/cadaver/cadaver_0.18.0-1woody3_sparc.deb
Size/MD5 checksum: 84288 13421f421d7a8f712b7047d6d69de01c

补丁安装方法：

1. 手工安装补丁包：

首先，使用下面的命令来下载补丁软件：
# wget url (url是补丁下载链接地址)

然后，使用下面的命令来安装补丁：
# dpkg -i file.deb (file是相应的补丁名)

2. 使用apt-get自动安装补丁包：

首先，使用下面的命令更新内部数据库：
# apt-get update

然后，使用下面的命令安装更新软件包：
# apt-get upgrade

MandrakeSoft
------------
MandrakeSoft已经为此发布了一个安全公告（MDKSA-2004:049）以及相应补丁:
MDKSA-2004:049：Updated libneon packages fix heap variable overflow issues
链接：http://www.linux-mandrake.com/en/security/2004/2004-049.php

补丁下载：

Updated Packages:

Mandrakelinux 10.0:
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/10.0/RPMS/libneon0.24-0.24.5-0.2.100mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/10.0/RPMS/libneon0.24-devel-0.24.5-0.2.100mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/10.0/RPMS/libneon0.24-static-devel-0.24.5-0.2.100mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/10.0/SRPMS/libneon-0.24.5-0.2.100mdk.src.rpm

Mandrakelinux 10.0/AMD64:
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/10.0/RPMS/lib64neon0.24-0.24.5-0.2.100mdk.amd64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/10.0/RPMS/lib64neon0.24-devel-0.24.5-0.2.100mdk.amd64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/10.0/RPMS/lib64neon0.24-static-devel-0.24.5-0.2.100mdk.amd64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/10.0/SRPMS/libneon-0.24.5-0.2.100mdk.src.rpm

Mandrakelinux 9.2:
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.2/RPMS/libneon0.24-0.24.5-0.2.92mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.2/RPMS/libneon0.24-devel-0.24.5-0.2.92mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.2/RPMS/libneon0.24-static-devel-0.24.5-0.2.92mdk.i586.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.2/SRPMS/libneon-0.24.5-0.2.92mdk.src.rpm

Mandrakelinux 9.2/AMD64:
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/9.2/RPMS/lib64neon0.24-0.24.5-0.2.92mdk.amd64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/9.2/RPMS/lib64neon0.24-devel-0.24.5-0.2.92mdk.amd64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/9.2/RPMS/lib64neon0.24-static-devel-0.24.5-0.2.92mdk.amd64.rpm
ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/amd64/9.2/SRPMS/libneon-0.24.5-0.2.92mdk.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

A list of FTP mirrors can be obtained from:

http://www.mandrakesecure.net/en/ftp.php

上述升级软件还可以在下列地址中的任意一个镜像ftp服务器上下载：
http://www.mandrakesecure.net/en/ftp.php

Neon
----
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

Neon Upgrade neon-0.24.6.tar.gz
http://www.webdav.org/neon/neon-0.24.6.tar.gz