受影响系统:
Rasterbar Software libtorrent <= 0.14.3
不受影响系统:
Rasterbar Software libtorrent 0.14.4
描述:
BUGTRAQ ID: 35262
CVE(CAN) ID: CVE-2009-1760
libtorrent是很多桌面应用和嵌入式设备都在使用的开源C++ bittorrent库。
libtorrent没有正确的过滤多文件模式的路径名,在src/torrent_info.cpp中对目录组件所执行的唯一检查就是对“..”的检查:
184: for (int i = 0, end(p->list_size()); i < end; ++i)
185: {
186: if (p->list_at(i)->type() != lazy_entry::string_t)
187: return false;
188: std::string path_element = p->list_at(i)->string_value();
189: if (path_element != "..")
190: target.path /= path_element;
191: }
如果攻击者在.torrent文件的路径元素中包含了目录遍历序列的话,就可以创建或覆盖任意文件。
<*来源:Dimitris Glynos
链接:http://secunia.com/advisories/35277/
http://census-labs.com/news/2009/06/08/libtorrent-rasterbar/
http://www.debian.org/security/2009/dsa-1815
*>
建议:
厂商补丁:
Debian
——
Debian已经为此发布了一个安全公告(DSA-1815-1)以及相应补丁:
DSA-1815-1:New libtorrent-rasterbar packages fix denial of
链接:http://www.debian.org/security/2009/dsa-1815
补丁下载:
Source archives:
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar_0.13.1-2+lenny1.diff.gz
Size/MD5 checksum: 5295 ad26ec230cfb51e8b1a11053c631e23a
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar_0.13.1.orig.tar.gz
Size/MD5 checksum: 1469775 9d6b112fedc5861402647ff72e95dba0
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar_0.13.1-2+lenny1.dsc
Size/MD5 checksum: 1688 615d598da6448acb06a5564b5af98504
Architecture independent packages:
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-doc_0.13.1-2+lenny1_all.deb
Size/MD5 checksum: 494718 2ff3232090c18212dceab0c240ad5b6a
alpha architecture (DEC Alpha)
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dev_0.13.1-2+lenny1_alpha.deb
Size/MD5 checksum: 2847180 bdc11c81ec50ef9c87e473a5adedef4d
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar0_0.13.1-2+lenny1_alpha.deb
Size/MD5 checksum: 1191354 7fc10d95bb5fb39218ef46a4e0256aa0
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dbg_0.13.1-2+lenny1_alpha.deb
Size/MD5 checksum: 7486406 be3e0f535a318d69bd8d8f84987c00c9
amd64 architecture (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar0_0.13.1-2+lenny1_amd64.deb
Size/MD5 checksum: 991572 8bfc1c7c2a0e715830b6b869d6700826
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dev_0.13.1-2+lenny1_amd64.deb
Size/MD5 checksum: 1958800 6f925903c79b0c09c861cfafc154fddb
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dbg_0.13.1-2+lenny1_amd64.deb
Size/MD5 checksum: 7578292 b5fda43c6ef50c504a11362f34efba69
arm architecture (ARM)
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar0_0.13.1-2+lenny1_arm.deb
Size/MD5 checksum: 1083396 265b8b109918bdb5a7cbd7a93a98f906
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dbg_0.13.1-2+lenny1_arm.deb
Size/MD5 checksum: 7278890 4f175b83c43250504e3e6e927b1aa95b
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dev_0.13.1-2+lenny1_arm.deb
Size/MD5 checksum: 2081302 f75e702139b6e6df8282ca8db807358a
armel architecture (ARM EABI)
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar0_0.13.1-2+lenny1_armel.deb
Size/MD5 checksum: 863962 d3e22f0d17881578c94ff18577c7b0ff
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dev_0.13.1-2+lenny1_armel.deb
Size/MD5 checksum: 2114218 28a9d8dd167a77c1c350c5f0c26656bb
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dbg_0.13.1-2+lenny1_armel.deb
Size/MD5 checksum: 7401594 096572e6a80d8e2629893d2eda7b06b2
hppa architecture (HP PA RISC)
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar0_0.13.1-2+lenny1_hppa.deb
Size/MD5 checksum: 1131024 69724d35147d2cb2d47f47b1dd2d09f2
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dev_0.13.1-2+lenny1_hppa.deb
Size/MD5 checksum: 2188616 48986004e631fcb30dc617dd09d6bb7e
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dbg_0.13.1-2+lenny1_hppa.deb
Size/MD5 checksum: 7447584 9c0ef400fb8a6af2fed8e57572749e82
i386 architecture (Intel ia32)
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dbg_0.13.1-2+lenny1_i386.deb
Size/MD5 checksum: 7466610 561fa4b4cc308ab89142ba8745144839
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar0_0.13.1-2+lenny1_i386.deb
Size/MD5 checksum: 986646 fbae1919d47696f1160191896ee51fe2
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dev_0.13.1-2+lenny1_i386.deb
Size/MD5 checksum: 1837994 706c48fe6df16cf87954938079b83bbd
ia64 architecture (Intel ia64)
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dev_0.13.1-2+lenny1_ia64.deb
Size/MD5 checksum: 2839510 0784e971e672f0d3508735b58b0190e0
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dbg_0.13.1-2+lenny1_ia64.deb
Size/MD5 checksum: 7867400 ef973715edcbbcc5739c959bc1a616e7
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar0_0.13.1-2+lenny1_ia64.deb
Size/MD5 checksum: 1408300 465e116873aeb20eb4d3307f11e23a1f
mips architecture (MIPS (Big Endian))
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dev_0.13.1-2+lenny1_mips.deb
Size/MD5 checksum: 2042000 a7da44aa33d55dd1720f03ff5578265b
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar0_0.13.1-2+lenny1_mips.deb
Size/MD5 checksum: 923072 f228766d2143c5678b568a7317427a7d
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dbg_0.13.1-2+lenny1_mips.deb
Size/MD5 checksum: 7563768 7269489934ef49530520be1f58d37137
mipsel architecture (MIPS (Little Endian))
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dbg_0.13.1-2+lenny1_mipsel.deb
Size/MD5 checksum: 7357426 4c6e09de92323c4edfc2e9d1697b88d4
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar0_0.13.1-2+lenny1_mipsel.deb
Size/MD5 checksum: 915480 5f6dcdcd4ebcf05c993ae8961172f8c3
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dev_0.13.1-2+lenny1_mipsel.deb
Size/MD5 checksum: 2022654 d370a93c7711c996b40e679c75b9e450
powerpc architecture (PowerPC)
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dev_0.13.1-2+lenny1_powerpc.deb
Size/MD5 checksum: 2009160 ffe50b547f76cc3715a696ec446c4a96
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dbg_0.13.1-2+lenny1_powerpc.deb
Size/MD5 checksum: 7771456 cf4a135f1dad2440449cc0a6e3ea2863
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar0_0.13.1-2+lenny1_powerpc.deb
Size/MD5 checksum: 1046364 d68326739c445096bebf71b8da2fb9ab
s390 architecture (IBM S/390)
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dbg_0.13.1-2+lenny1_s390.deb
Size/MD5 checksum: 7523480 b51f62f23c283f3ec6992b234946a585
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar0_0.13.1-2+lenny1_s390.deb
Size/MD5 checksum: 945680 55899bdfa3d12f96dcc8a3bca4688429
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dev_0.13.1-2+lenny1_s390.deb
Size/MD5 checksum: 1877984 57a4674260e40426e3b12f2d1e2e500f
sparc architecture (Sun SPARC/UltraSPARC)
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dbg_0.13.1-2+lenny1_sparc.deb
Size/MD5 checksum: 7366596 36c4f6f9964750a32ce7278bf4d04da2
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar0_0.13.1-2+lenny1_sparc.deb
Size/MD5 checksum: 1145234 ff7d341f351f65144621eed3f9a3cf86
http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dev_0.13.1-2+lenny1_sparc.deb
Size/MD5 checksum: 1734368 064c9bfed79ac652c89db16fb1b74357
补丁安装方法:
1. 手工安装补丁包:
首先,使用下面的命令来下载补丁软件:
# wget url (url是补丁下载链接地址)
然后,使用下面的命令来安装补丁:
# dpkg -i file.deb (file是相应的补丁名)
2. 使用apt-get自动安装补丁包:
首先,使用下面的命令更新内部数据库:
# apt-get update
然后,使用下面的命令安装更新软件包:
# apt-get upgrade
Rasterbar Software
——————
目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载:
0 条评论。