OpenBSD缓冲区溢出漏洞

漏洞信息详情

OpenBSD缓冲区溢出漏洞

CNNVD编号：CNNVD-200907-004
危害等级：中危-->
危害等级：中危
CVE编号： CVE-2009-0689
漏洞类型：缓冲区溢出
发布时间： 2009-06-26
威胁类型：远程
更新时间： 2021-07-14
厂商： mozilla
漏洞来源： Maksymilian Arciem...

漏洞简介

OpenBSD是加拿大OpenBSD（Openbsd）项目组的一套跨平台的、基于BSD的类UNIX操作系统。

OpenBSD、NetBSD、FreeBSD的dtoa实现中存在缓冲区溢出漏洞。在src/lib/libc/gdtoa/gdtoaimp.h中：

- ---gdtoaimp.h---

...

＃define Kmax 15

...

- ---gdtoaimp.h---

最大的Kmax长度为15，如果提供了更大的值(如17)，程序就会溢出freelist数组，bss为0x1。

以NetBSD为例：

- ---gdtoaimp.h---

...

＃define Kmax (sizeof(size_t) ＜＜ 3)

...

- ---gdtoaimp.h---

程序在misc.c中崩溃：

- --- src/lib/libc/gdtoa/misc.c ---

if ( (rv = freelist[k]) !=0) {

freelist[k] = rv-＞next;

}

else {

x = 1 ＜＜ k;

＃ifdef Omit_Private_Memory

rv = (Bigint *)MALLOC(sizeof(Bigint) + (x-1)*sizeof(ULong));

＃else

len = (sizeof(Bigint) + (x-1)*sizeof(ULong) + sizeof(double) - 1)

/sizeof(double);

if ((double *)(pmem_next - private_mem + len) ＜= (double *)PRIVATE_mem)

{

rv = (Bigint*)(void *)pmem_next;

pmem_next += len;

}

else

rv = (Bigint*)MALLOC(len*sizeof(double));

＃endif

if (rv == NULL)

return NULL;

rv-＞k = k;

rv-＞maxwds = x;

}

- --- src/lib/libc/gdtoa/misc.c ---

这里

rv-＞k = k;

或

freelist[k] = rv-＞next;

漏洞公告

目前厂商已经发布了升级补丁以修复这个安全问题，补丁下载链接：

Ubuntu Ubuntu Linux 9.10 sparc

Ubuntu kdelibs-data_3.5.10.dfsg.1-2ubuntu7.2_all.deb

http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs-data_3.5 .10.dfsg.1-2ubuntu7.2_all.deb

Ubuntu kdelibs-dbg_3.5.10.dfsg.1-2ubuntu7.2_sparc.deb

http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs-dbg_3.5.10.dfsg.1- 2ubuntu7.2_sparc.deb

Ubuntu kdelibs_3.5.10.dfsg.1-2ubuntu7.2_all.deb

http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs_3.5.10.d fsg.1-2ubuntu7.2_all.deb

Ubuntu Ubuntu Linux 8.04 LTS powerpc

Ubuntu kdelibs-data_3.5.10-0ubuntu1~hardy1.5_all.deb

http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs-data_3.5 .10-0ubuntu1~hardy1.5_all.deb

Ubuntu kdelibs-dbg_3.5.10-0ubuntu1~hardy1.5_powerpc.deb

http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs-dbg_3.5.10-0ubuntu 1~hardy1.5_powerpc.deb

Ubuntu kdelibs_3.5.10-0ubuntu1~hardy1.5_all.deb

http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs_3.5.10-0 ubuntu1~hardy1.5_all.deb

Ubuntu Ubuntu Linux 8.10 powerpc

Ubuntu kdelibs-data_3.5.10-0ubuntu6.4_all.deb

http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs-data_3.5 .10-0ubuntu6.4_all.deb

Ubuntu kdelibs-dbg_3.5.10-0ubuntu6.4_powerpc.deb

http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs-dbg_3.5.10-0ubuntu 6.4_powerpc.deb

Ubuntu Ubuntu Linux 8.04 LTS sparc

Ubuntu kdelibs-data_3.5.10-0ubuntu1~hardy1.5_all.deb

http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs-data_3.5 .10-0ubuntu1~hardy1.5_all.deb

Ubuntu kdelibs-dbg_3.5.10-0ubuntu1~hardy1.5_sparc.deb

http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs-dbg_3.5.10-0ubuntu 1~hardy1.5_sparc.deb

Ubuntu Ubuntu Linux 8.10 i386

Ubuntu kdelibs-data_3.5.10-0ubuntu6.4_all.deb

http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs-data_3.5 .10-0ubuntu6.4_all.deb

Ubuntu kdelibs-dbg_3.5.10-0ubuntu6.4_i386.deb

Ubuntu Ubuntu Linux 9.10 powerpc

Ubuntu kdelibs-data_3.5.10.dfsg.1-2ubuntu7.2_all.deb

http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs-data_3.5 .10.dfsg.1-2ubuntu7.2_all.deb

Ubuntu kdelibs-dbg_3.5.10.dfsg.1-2ubuntu7.2_powerpc.deb

http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs-dbg_3.5.10.dfsg.1- 2ubuntu7.2_powerpc.deb

Ubuntu kdelibs_3.5.10.dfsg.1-2ubuntu7.2_all.deb

http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs_3.5.10.d fsg.1-2ubuntu7.2_all.deb

Ubuntu kdelibs4-dev_3.5.10.dfsg.1-2ubuntu7.2_powerpc.deb

http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs4-dev_3.5.10.dfsg.1 -2ubuntu7.2_powerpc.deb

MandrakeSoft Linux Mandrake 2008.0 x86_64

Mandriva arts-1.5.10-0.1mdv2008.0.x86_64.rpm