Rasterbar libtorrent库目录遍历漏洞

发表评论 (0) 查看评论

受影响系统：

Rasterbar Software libtorrent <= 0.14.3

不受影响系统：

Rasterbar Software libtorrent 0.14.4

描述：

BUGTRAQ ID: 35262
CVE(CAN) ID: CVE-2009-1760

libtorrent是很多桌面应用和嵌入式设备都在使用的开源C++ bittorrent库。

libtorrent没有正确的过滤多文件模式的路径名，在src/torrent_info.cpp中对目录组件所执行的唯一检查就是对“..”的检查:

184:    for (int i = 0, end(p->list_size()); i < end; ++i)
185:    {
186:        if (p->list_at(i)->type() != lazy_entry::string_t)
187:            return false;
188:        std::string path_element = p->list_at(i)->string_value();
189:        if (path_element != "..")
190:            target.path /= path_element;
191:    }

如果攻击者在.torrent文件的路径元素中包含了目录遍历序列的话，就可以创建或覆盖任意文件。

<*来源：Dimitris Glynos

  链接：http://secunia.com/advisories/35277/
        http://census-labs.com/news/2009/06/08/libtorrent-rasterbar/
        http://www.debian.org/security/2009/dsa-1815
*>

建议：

厂商补丁：

Debian
——
Debian已经为此发布了一个安全公告（DSA-1815-1）以及相应补丁:
DSA-1815-1：New libtorrent-rasterbar packages fix denial of
链接：http://www.debian.org/security/2009/dsa-1815

补丁下载：

Source archives:

http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar_0.13.1-2+lenny1.diff.gz
Size/MD5 checksum:     5295 ad26ec230cfb51e8b1a11053c631e23a
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar_0.13.1.orig.tar.gz
Size/MD5 checksum:  1469775 9d6b112fedc5861402647ff72e95dba0
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar_0.13.1-2+lenny1.dsc
Size/MD5 checksum:     1688 615d598da6448acb06a5564b5af98504

Architecture independent packages:

http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-doc_0.13.1-2+lenny1_all.deb
Size/MD5 checksum: 494718 2ff3232090c18212dceab0c240ad5b6a

alpha architecture (DEC Alpha)

http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dev_0.13.1-2+lenny1_alpha.deb
Size/MD5 checksum:  2847180 bdc11c81ec50ef9c87e473a5adedef4d
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar0_0.13.1-2+lenny1_alpha.deb
Size/MD5 checksum:  1191354 7fc10d95bb5fb39218ef46a4e0256aa0
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dbg_0.13.1-2+lenny1_alpha.deb
Size/MD5 checksum:  7486406 be3e0f535a318d69bd8d8f84987c00c9

amd64 architecture (AMD x86_64 (AMD64))

http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar0_0.13.1-2+lenny1_amd64.deb
Size/MD5 checksum:   991572 8bfc1c7c2a0e715830b6b869d6700826
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dev_0.13.1-2+lenny1_amd64.deb
Size/MD5 checksum:  1958800 6f925903c79b0c09c861cfafc154fddb
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dbg_0.13.1-2+lenny1_amd64.deb
Size/MD5 checksum:  7578292 b5fda43c6ef50c504a11362f34efba69

arm architecture (ARM)

http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar0_0.13.1-2+lenny1_arm.deb
Size/MD5 checksum:  1083396 265b8b109918bdb5a7cbd7a93a98f906
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dbg_0.13.1-2+lenny1_arm.deb
Size/MD5 checksum:  7278890 4f175b83c43250504e3e6e927b1aa95b
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dev_0.13.1-2+lenny1_arm.deb
Size/MD5 checksum:  2081302 f75e702139b6e6df8282ca8db807358a

armel architecture (ARM EABI)