Eterm PATH_ENV缓冲区溢出漏洞发布时间：2003-05-17 更新时间：2003-06-12 严重程度：高 威胁程度：本地管理员权限 错误类型：边界检查错误 利用方式：服务器模式 BUGTRAQ ID：7708 CVE(CAN) ID：CAN-2003-0382 受影响系统 Eterm Eterm 0.9.1详细描述 Eterm对环境变量PATH_ENV缺乏边界检查，本地攻击者精心构建PATH_ENV环境变量可以执行shellcode代码获得utmp setuid/setgid甚至root的访问权限。 解决方案 Eterm Eterm 0.9.2: Debian Upgrade eterm_0.9.2-0pre2002042903.2_alpha.deb http://security.debian.org/pool/updates/main/e/eterm/eterm_0.9.2-0pre2002042903.2_alpha.deb Debian GNU/Linux 3.0 alias woody. Debian Upgrade eterm_0.9.2-0pre2002042903.2_arm.deb http://security.debian.org/pool/updates/main/e/eterm/eterm_0.9.2-0pre2002042903.2_arm.deb Debian GNU/Linux 3.0 alias woody. Debian Upgrade eterm_0.9.2-0pre2002042903.2_i386.deb http://security.debian.org/pool/updates/main/e/eterm/eterm_0.9.2-0pre2002042903.2_i386.deb Debian GNU/Linux 3.0 alias woody. Debian Upgrade eterm_0.9.2-0pre2002042903.2_ia64.deb http://security.debian.org/pool/updates/main/e/eterm/eterm_0.9.2-0pre2002042903.2_ia64.deb Debian GNU/Linux 3.0 alias woody. Debian Upgrade eterm_0.9.2-0pre2002042903.2_hppa.deb http://security.debian.org/pool/updates/main/e/eterm/eterm_0.9.2-0pre2002042903.2_hppa.deb Debian GNU/Linux 3.0 alias woody. Debian Upgrade eterm_0.9.2-0pre2002042903.2_m68k.deb http://security.debian.org/pool/updates/main/e/eterm/eterm_0.9.2-0pre2002042903.2_m68k.deb Debian GNU/Linux 3.0 alias woody. Debian Upgrade eterm_0.9.2-0pre2002042903.2_mips.deb http://security.debian.org/pool/updates/main/e/eterm/eterm_0.9.2-0pre2002042903.2_mips.deb Debian GNU/Linux 3.0 alias woody. Debian Upgrade eterm_0.9.2-0pre2002042903.2_mipsel.deb http://security.debian.org/pool/updates/main/e/eterm/eterm_0.9.2-0pre2002042903.2_mipsel.deb Debian GNU/Linux 3.0 alias woody. Debian Upgrade eterm_0.9.2-0pre2002042903.2_powerpc.deb http://security.debian.org/pool/updates/main/e/eterm/eterm_0.9.2-0pre2002042903.2_powerpc.deb Debian GNU/Linux 3.0 alias woody. Debian Upgrade eterm_0.9.2-0pre2002042903.2_s390.deb http://security.debian.org/pool/updates/main/e/eterm/eterm_0.9.2-0pre2002042903.2_s390.deb Debian GNU/Linux 3.0 alias woody. Debian Upgrade eterm_0.9.2-0pre2002042903.2_sparc.deb http://security.debian.org/pool/updates/main/e/eterm/eterm_0.9.2-0pre2002042903.2_sparc.deb Debian GNU/Linux 3.0 alias woody. 相关信息 bazarr <bazarr@ziplip.com> http://online.securityfocus.com/advisories/5459 http://www.eterm.org/ |
