KDE Network RESLISA存在缓冲区溢出发布时间：2002-11-22 更新时间：2002-11-22 严重程度：高 威胁程度：本地管理员权限 错误类型：边界检查错误 利用方式：服务器模式 BUGTRAQ ID：6157 CVE(CAN) ID：CAN-2002-1247 受影响系统 KDE KDE 2.0详细描述 KDE是UNIX图形桌面环境，kdenetwork包含LAN浏览器实现LISa，用于查询网络中的CIFS和其他服务，LISa包含"lisa"模块和"resLISa"程序。 "resLISa"程序没有正确检查LOGNAME环境变量，攻击者可以设置超长值的LOGNAME环境变量，执行"resLISa"程序而导致缓冲溢出，由于"resLISa"程序由SETUID ROOT安装，可以获得ROOT权限。 测试代码 $ LOGNAME=`perl -e 'print "A"x5000'` $ `which reslisa` -c . 解决方案 补丁下载： KDE KDE 2.0: KDE KDE 2.1: KDE KDE 2.2: KDE klisa 2.2.2: Debian Upgrade klisa_2.2.2-14.2_sparc.deb http://security.debian.org/pool/updates/main/k/kdenetwork/klisa_2.2.2-14.2_sparc.deb Debian Upgrade klisa_2.2.2-14.2_s390.deb http://security.debian.org/pool/updates/main/k/kdenetwork/klisa_2.2.2-14.2_s390.deb Debian Upgrade klisa_2.2.2-14.2_powerpc.deb http://security.debian.org/pool/updates/main/k/kdenetwork/klisa_2.2.2-14.2_powerpc.deb Debian Upgrade klisa_2.2.2-14.2_mipsel.deb http://security.debian.org/pool/updates/main/k/kdenetwork/klisa_2.2.2-14.2_mipsel.deb Debian Upgrade klisa_2.2.2-14.2_mips.deb http://security.debian.org/pool/updates/main/k/kdenetwork/klisa_2.2.2-14.2_mips.deb Debian Upgrade klisa_2.2.2-14.2_m68k.deb http://security.debian.org/pool/updates/main/k/kdenetwork/klisa_2.2.2-14.2_m68k.deb Debian Upgrade klisa_2.2.2-14.2_hppa.deb http://security.debian.org/pool/updates/main/k/kdenetwork/klisa_2.2.2-14.2_hppa.deb Debian Upgrade klisa_2.2.2-14.2_ia64.deb http://security.debian.org/pool/updates/main/k/kdenetwork/klisa_2.2.2-14.2_ia64.deb Debian Upgrade klisa_2.2.2-14.2_i386.deb http://security.debian.org/pool/updates/main/k/kdenetwork/klisa_2.2.2-14.2_i386.deb Debian Upgrade klisa_2.2.2-14.2_arm.deb http://security.debian.org/pool/updates/main/k/kdenetwork/klisa_2.2.2-14.2_arm.deb Debian Upgrade klisa_2.2.2-14.2_alpha.deb http://security.debian.org/pool/updates/main/k/kdenetwork/klisa_2.2.2-14.2_alpha.deb KDE KDE 3.0: KDE Upgrade KDE 3.0.5 http://download.kde.org/stable/3.0.5/ KDE KDE 3.0.1: KDE Upgrade KDE 3.0.5 http://download.kde.org/stable/3.0.5/ KDE KDE 3.0.2: KDE Upgrade KDE 3.0.5 http://download.kde.org/stable/3.0.5/ KDE KDE 3.0.3 a: KDE Upgrade KDE 3.0.5 http://download.kde.org/stable/3.0.5/ KDE KDE 3.0.3: KDE Upgrade KDE 3.0.5 http://download.kde.org/stable/3.0.5/ KDE KDE 3.0.4: KDE Upgrade KDE 3.0.5 http://download.kde.org/stable/3.0.5/ LISa LISa 0.1: LISa Upgrade lisa-0.2.2.tar.bz2 http://lisa-home.sourceforge.net/src/lisa-0.2.2.tar.bz2 LISa LISa 0.1.2: LISa Upgrade lisa-0.2.2.tar.bz2 http://lisa-home.sourceforge.net/src/lisa-0.2.2.tar.bz2 相关信息 参考：http://online.securityfocus.com/advisories/4678 http://online.securityfocus.com/advisories/4660 http://online.securityfocus.com/archive/1/299309 http://online.securityfocus.com/archive/1/299481 相关主页：http://lisa-home.sourceforge.net/ |
