|
|
L2TPD随机数种子产生机制不强壮漏洞
发布时间：2002-08-21
更新时间：2002-08-21
严重程度：中
威胁程度：其它
错误类型：设计错误
利用方式：服务器模式
BUGTRAQ ID：5451
受影响系统l2tpd l2tpd 0.62
l2tpd l2tpd 0.63
l2tpd l2tpd 0.64
l2tpd l2tpd 0.65
l2tpd l2tpd 0.66
l2tpd l2tpd 0.67
+ Debian Linux 3.0 详细描述
l2tpd是第二曾通道协议守护进程，由RFC2661所定义的协议实现。
部分l2tpd版本在调用rand()函数之前，随机数生成器没有进行初始化，导致可预测随机号码，可用于会话ID，challenge / response机制，导致攻击者利用这个漏洞预测l2tpd行为，使攻击者可以通过MIM攻击或者在合法连接中插入任意数据。
测试代码
无
解决方案
升级程序：
l2tpd l2tpd 0.62:
l2tpd Upgrade l2tpd-0.68.tar.gz
http://www.l2tpd.org/downloads/l2tpd-0.68.tar.gz
l2tpd l2tpd 0.63:
l2tpd Upgrade l2tpd-0.68.tar.gz
http://www.l2tpd.org/downloads/l2tpd-0.68.tar.gz
l2tpd l2tpd 0.64:
l2tpd Upgrade l2tpd-0.68.tar.gz
http://www.l2tpd.org/downloads/l2tpd-0.68.tar.gz
l2tpd l2tpd 0.65:
l2tpd Upgrade l2tpd-0.68.tar.gz
http://www.l2tpd.org/downloads/l2tpd-0.68.tar.gz
l2tpd l2tpd 0.66:
l2tpd Upgrade l2tpd-0.68.tar.gz
http://www.l2tpd.org/downloads/l2tpd-0.68.tar.gz
l2tpd l2tpd 0.67:
l2tpd Upgrade l2tpd-0.68.tar.gz
http://www.l2tpd.org/downloads/l2tpd-0.68.tar.gz
Debian Upgrade l2tpd_0.67-1.1_alpha.deb
http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.1_alpha.deb
Debian Upgrade l2tpd_0.67-1.1_arm.deb
http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.1_arm.deb
Debian Upgrade l2tpd_0.67-1.1_i386.deb
http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.1_i386.deb
Debian Upgrade l2tpd_0.67-1.1_ia64.deb
http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.1_ia64.deb
Debian Upgrade l2tpd_0.67-1.1_hppa.deb
http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.1_hppa.deb
Debian Upgrade l2tpd_0.67-1.1_m68k.deb
http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.1_m68k.deb
Debian Upgrade l2tpd_0.67-1.1_mips.deb
http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.1_mips.deb
Debian Upgrade l2tpd_0.67-1.1_mipsel.deb
http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.1_mipsel.deb
Debian Upgrade l2tpd_0.67-1.1_powerpc.deb
http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.1_powerpc.deb
Debian Upgrade l2tpd_0.67-1.1_s390.deb
http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.1_s390.deb
Debian Upgrade l2tpd_0.67-1.1_sparc.deb
http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.1_sparc.deb
相关信息
Jeff Mcadams <jeffm@iglou.com>.
参考：http://online.securityfocus.com/advisories/4383
http://online.securityfocus.com/archive/1/287139
相关主页：http://www.l2tpd.org/
|
