CVE-2002-1091
CVSS7.5
发布时间 :2002-10-04 00:00:00
修订时间 :2016-10-17 22:23:37
NMCOS    

[原文]Netscape 6.2.3 and earlier, and Mozilla 1.0.1, allow remote attackers to corrupt heap memory and execute arbitrary code via a GIF image with a zero width.


[CNNVD]多种Web浏览器零宽度GIF图象导致内存破坏漏洞(CNNVD-200210-120)

        
        Netscape、Mozilla和Opera是流行的Web浏览器。
        多种Web浏览器在处理GIF图象文件时存在问题,远程攻击者可以利用这个漏洞进行拒绝服务攻击或者以用户进程权限执行任意指令。
        多种WEB浏览器在处理宽度设置为零值的GIF图象文件时不正确,可导致覆盖堆结构中的信息,攻击者可以构建包含恶意GIF图象文件的WEB页面,当用户点击查看的时候覆盖堆结构,写内存任意,而导致WEB客户端崩溃,或者以用户进程权限在系统上执行任意指令。
        由于对种浏览器都存在这个漏洞,所以这个漏洞很可能是由于某个用于对GIF图象着色的库造成的(如libungif),不过没有得到证实。
        

- CVSS (基础分值)

CVSS分值: 7.5 [严重(HIGH)]
机密性影响: [--]
完整性影响: [--]
可用性影响: [--]
攻击复杂度: [--]
攻击向量: [--]
身份认证: [--]

- CPE (受影响的平台与产品)

cpe:/a:opera_software:opera_web_browser:5.12
cpe:/a:opera_software:opera_web_browser:6.0
cpe:/a:mozilla:mozilla:0.9.9Mozilla Mozilla 0.9.9
cpe:/a:mozilla:mozilla:0.9.7Mozilla Mozilla 0.9.7
cpe:/a:mozilla:mozilla:0.9.8Mozilla Mozilla Browser 0.9.8
cpe:/a:mozilla:mozilla:1.0Mozilla Mozilla 1.0
cpe:/a:netscape:navigator:6.2.3Netscape Netscape 6.2.3
cpe:/a:netscape:navigator:6.2.2Netscape Netscape 6.2.2
cpe:/a:netscape:navigator:6.2Netscape Netscape 6.2
cpe:/a:opera_software:opera_web_browser:6.0.1
cpe:/a:mozilla:mozilla:0.9.5Mozilla Mozilla Browser 0.9.5
cpe:/a:mozilla:mozilla:0.9.6Mozilla Mozilla Browser 0.9.6
cpe:/a:netscape:navigator:6.2.1Netscape Netscape 6.2.1

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1091
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2002-1091
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200210-120
(官方数据源) CNNVD

- 其它链接及资源

http://bugzilla.mozilla.org/show_bug.cgi?id=157989
(UNKNOWN)  CONFIRM  http://bugzilla.mozilla.org/show_bug.cgi?id=157989
http://crash.ihug.co.nz/~Sneuro/zerogif/
(UNKNOWN)  MISC  http://crash.ihug.co.nz/~Sneuro/zerogif/
http://marc.info/?l=bugtraq&m=103134051120770&w=2
(UNKNOWN)  BUGTRAQ  20020906 zero-width gif: exploit PoC for NS6.2.3 (fixed in 7.0) [Was: GIFs
http://www.iss.net/security_center/static/10058.php
(VENDOR_ADVISORY)  XF  netscape-zero-gif-bo(10058)
http://www.mandrakesoft.com/security/advisories?name=MDKSA-2002:075
(UNKNOWN)  MANDRAKE  MDKSA-2002:075
http://www.redhat.com/support/errata/RHSA-2002-192.html
(VENDOR_ADVISORY)  REDHAT  RHSA-2002:192
http://www.redhat.com/support/errata/RHSA-2003-046.html
(UNKNOWN)  REDHAT  RHSA-2003:046
http://www.securityfocus.com/bid/5665
(VENDOR_ADVISORY)  BID  5665

- 漏洞信息

多种Web浏览器零宽度GIF图象导致内存破坏漏洞
高危 边界条件错误
2002-10-04 00:00:00 2005-05-16 00:00:00
远程  
        
        Netscape、Mozilla和Opera是流行的Web浏览器。
        多种Web浏览器在处理GIF图象文件时存在问题,远程攻击者可以利用这个漏洞进行拒绝服务攻击或者以用户进程权限执行任意指令。
        多种WEB浏览器在处理宽度设置为零值的GIF图象文件时不正确,可导致覆盖堆结构中的信息,攻击者可以构建包含恶意GIF图象文件的WEB页面,当用户点击查看的时候覆盖堆结构,写内存任意,而导致WEB客户端崩溃,或者以用户进程权限在系统上执行任意指令。
        由于对种浏览器都存在这个漏洞,所以这个漏洞很可能是由于某个用于对GIF图象着色的库造成的(如libungif),不过没有得到证实。
        

- 公告与补丁

        临时解决方法:
        如果您不能立刻安装补丁或者升级,CNNVD建议您采取以下措施以降低威胁:
        * 设置浏览器不启动自动装载部分图象类型如GIF。
        厂商补丁:
        Mozilla
        -------
        目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载:
        Mozilla Upgrade Mozilla 1.1
        
        http://www.mozilla.org/releases/

        Netscape
        --------
        目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载:
        Netscape Upgrade Netscape 7.0
        
        http://channels.netscape.com/ns/browsers/download.jsp

- 漏洞信息

15383
Multiple Browser Zero Width GIF Arbitrary Code Execution
Loss of Integrity
Vendor Verified

- 漏洞描述

Unknown or Incomplete

- 时间线

2002-09-06 Unknow
Unknow Unknow

- 解决方案

Unknown or Incomplete

- 相关参考

- 漏洞作者

Unknown or Incomplete

- 漏洞信息

Multiple Browser Zero Width GIF Image Memory Corruption Vulnerability
Boundary Condition Error 5665
Yes No
2002-09-06 12:00:00 2009-07-11 03:56:00
Discovery of this issue is credited to zen-parse <zen-parse@gmx.net>.

- 受影响的程序版本

Opera Software Opera Web Browser 6.0.1
Opera Software Opera Web Browser 6.0
Opera Software Opera Web Browser 5.12
Netscape Netscape 6.2.3
Netscape Netscape 6.2.2
Netscape Netscape 6.2.1
- Apple Mac OS 9 9.2.1
- Apple Mac OS 9 9.2
- Apple Mac OS 9 9.1
- Apple Mac OS 9 9.0.4
- Apple Mac OS 9 9.0
- Apple Mac OS X 10.1.2
- Apple Mac OS X 10.1.1
- Apple Mac OS X 10.1
- Apple Mac OS X 10.0.4
- Apple Mac OS X 10.0.3
- Apple Mac OS X 10.0.2
- Apple Mac OS X 10.0.1
- Apple Mac OS X 10.0
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows ME
- Microsoft Windows NT 4.0 SP6a
- Microsoft Windows NT 4.0 SP5
- Microsoft Windows NT 4.0 SP4
- Microsoft Windows NT 4.0 SP3
- Microsoft Windows NT 4.0 SP2
- Microsoft Windows NT 4.0 SP1
- Microsoft Windows NT 4.0
Netscape Netscape 6.2
- Apple Mac OS 9 9.2.1
- Apple Mac OS 9 9.2
- Apple Mac OS 9 9.1
- Apple Mac OS 9 9.0.4
- Apple Mac OS 9 9.0
- Apple Mac OS X 10.1.2
- Apple Mac OS X 10.1.1
- Apple Mac OS X 10.1
- Apple Mac OS X 10.0.4
- Apple Mac OS X 10.0.3
- Apple Mac OS X 10.0.2
- Apple Mac OS X 10.0.1
- Apple Mac OS X 10.0
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows ME
- Microsoft Windows NT 4.0 SP6a
- Microsoft Windows NT 4.0 SP5
- Microsoft Windows NT 4.0 SP4
- Microsoft Windows NT 4.0 SP3
- Microsoft Windows NT 4.0 SP2
- Microsoft Windows NT 4.0 SP1
- Microsoft Windows NT 4.0
Mozilla Browser 1.0
+ Mandriva Linux Mandrake 8.2 ppc
+ Mandriva Linux Mandrake 8.2
+ RedHat Linux 8.0 i386
+ RedHat Linux 8.0
Mozilla Browser 0.9.9
- FreeBSD FreeBSD 4.5
- FreeBSD FreeBSD 4.4
- FreeBSD FreeBSD 4.3
- FreeBSD FreeBSD 4.2
- FreeBSD FreeBSD 4.1.1
+ RedHat Linux 7.3 i386
+ RedHat Linux 7.3
+ RedHat Linux 7.2 i686
+ RedHat Linux 7.2 i586
+ RedHat Linux 7.2 i386
+ RedHat Linux 7.2
Mozilla Browser 0.9.8
- Apple Mac OS 9 9.2.2
- Apple Mac OS 9 9.2.1
- Apple Mac OS 9 9.2.1
- Apple Mac OS 9 9.2
- Apple Mac OS 9 9.2
- Apple Mac OS 9 9.1
- Apple Mac OS 9 9.1
- Apple Mac OS 9 9.0.4
- Apple Mac OS 9 9.0.4
- Apple Mac OS 9 9.0
- Apple Mac OS 9 9.0
- Apple Mac OS X 10.1.2
- Apple Mac OS X 10.1.2
- Apple Mac OS X 10.1.1
- Apple Mac OS X 10.1.1
- Apple Mac OS X 10.1
- Apple Mac OS X 10.1
- Apple Mac OS X 10.1
- Apple Mac OS X 10.1
- Apple Mac OS X 10.0.4
- Apple Mac OS X 10.0.4
- Apple Mac OS X 10.0.3
- Apple Mac OS X 10.0.3
- Apple Mac OS X 10.0.2
- Apple Mac OS X 10.0.2
- Apple Mac OS X 10.0.1
- Apple Mac OS X 10.0.1
- Apple Mac OS X 10.0
- Apple Mac OS X 10.0
- Microsoft Windows 95
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows 98
- Microsoft Windows ME
- Microsoft Windows ME
- Microsoft Windows NT 4.0 SP6a
- Microsoft Windows NT 4.0 SP6a
- Microsoft Windows NT 4.0 SP6
- Microsoft Windows NT 4.0 SP6
- Microsoft Windows NT 4.0 SP5
- Microsoft Windows NT 4.0 SP5
- Microsoft Windows NT 4.0 SP4
- Microsoft Windows NT 4.0 SP4
- Microsoft Windows NT 4.0 SP3
- Microsoft Windows NT 4.0 SP3
- Microsoft Windows NT 4.0 SP2
- Microsoft Windows NT 4.0 SP2
- Microsoft Windows NT 4.0 SP1
- Microsoft Windows NT 4.0 SP1
- Microsoft Windows NT 4.0
- Microsoft Windows NT 4.0
- Microsoft Windows XP 0
Mozilla Browser 0.9.7
- Apple Mac OS 9 9.2.1
- Apple Mac OS 9 9.2.1
- Apple Mac OS 9 9.2
- Apple Mac OS 9 9.2
- Apple Mac OS 9 9.1
- Apple Mac OS 9 9.1
- Apple Mac OS 9 9.0.4
- Apple Mac OS 9 9.0.4
- Apple Mac OS 9 9.0
- Apple Mac OS 9 9.0
- Apple Mac OS X 10.1.2
- Apple Mac OS X 10.1.2
- Apple Mac OS X 10.1.1
- Apple Mac OS X 10.1.1
- Apple Mac OS X 10.1
- Apple Mac OS X 10.1
- Apple Mac OS X 10.0.4
- Apple Mac OS X 10.0.4
- Apple Mac OS X 10.0.3
- Apple Mac OS X 10.0.3
- Apple Mac OS X 10.0.2
- Apple Mac OS X 10.0.2
- Apple Mac OS X 10.0.1
- Apple Mac OS X 10.0.1
- Apple Mac OS X 10.0
- Apple Mac OS X 10.0
- Microsoft Windows 95
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows 98
- Microsoft Windows ME
- Microsoft Windows ME
- Microsoft Windows NT 4.0 SP6a
- Microsoft Windows NT 4.0 SP6a
- Microsoft Windows NT 4.0 SP5
- Microsoft Windows NT 4.0 SP5
- Microsoft Windows NT 4.0 SP4
- Microsoft Windows NT 4.0 SP4
- Microsoft Windows NT 4.0 SP3
- Microsoft Windows NT 4.0 SP3
- Microsoft Windows NT 4.0 SP2
- Microsoft Windows NT 4.0 SP2
- Microsoft Windows NT 4.0 SP1
- Microsoft Windows NT 4.0 SP1
- Microsoft Windows NT 4.0
- Microsoft Windows NT 4.0
- Microsoft Windows XP 0
Mozilla Browser 0.9.6
- Apple Mac OS 9 9.2
- Apple Mac OS 9 9.2
- Apple Mac OS 9 9.1
- Apple Mac OS 9 9.1
- Apple Mac OS 9 9.0
- Apple Mac OS 9 9.0
- Be BeOS 5.0
- Be BeOS 5.0
- BSDI BSD/OS 4.2
- BSDI BSD/OS 4.2
- Compaq OpenVMS 7.3 Alpha
- Compaq OpenVMS 7.3 Alpha
- Compaq OpenVMS 7.2 -2 Alpha
- Compaq OpenVMS 7.2 -2 Alpha
- Compaq OpenVMS 7.1 -2 Alpha
- FreeBSD FreeBSD 4.0
- FreeBSD FreeBSD 4.0
- IBM AIX 4.3.3
- IBM AIX 4.3.3
- Microsoft Windows 2000 Professional SP2
- Microsoft Windows 2000 Professional SP2
- Microsoft Windows 2000 Professional SP1
- Microsoft Windows 2000 Professional SP1
- Microsoft Windows 2000 Professional
- Microsoft Windows 2000 Professional
- Microsoft Windows 95
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows 98
- Microsoft Windows ME
- Microsoft Windows ME
- Microsoft Windows NT 4.0 SP6a
- Microsoft Windows NT 4.0 SP6a
- Microsoft Windows NT 4.0 SP6
- Microsoft Windows NT 4.0 SP6
- Microsoft Windows NT 4.0 SP5
- Microsoft Windows NT 4.0 SP5
- Microsoft Windows NT 4.0 SP4
- Microsoft Windows NT 4.0 SP4
- Microsoft Windows NT 4.0 SP3
- Microsoft Windows NT 4.0 SP3
- Microsoft Windows NT 4.0 SP2
- Microsoft Windows NT 4.0 SP2
- Microsoft Windows NT 4.0 SP1
- Microsoft Windows NT 4.0 SP1
- Microsoft Windows NT 4.0
- Microsoft Windows NT 4.0
- RedHat Linux 7.0 sparc
- RedHat Linux 7.0 sparc
- RedHat Linux 7.0 i386
- RedHat Linux 7.0 i386
- RedHat Linux 7.0 alpha
- RedHat Linux 7.0 alpha
- RedHat Linux 6.0 sparc
- RedHat Linux 6.0 sparc
- RedHat Linux 6.0 alpha
- RedHat Linux 6.0 alpha
- RedHat Linux 6.0
- RedHat Linux 6.0
- SGI IRIX 6.5
- SGI IRIX 6.5
- Sun Solaris 2.8
- Sun Solaris 2.8
- Sun Solaris 2.7
- Sun Solaris 2.7
Mozilla Browser 0.9.5
- Apple Mac OS 9 9.2.1
- Apple Mac OS 9 9.2.1
- Apple Mac OS 9 9.2
- Apple Mac OS 9 9.2
- Apple Mac OS 9 9.1
- Apple Mac OS 9 9.1
- Apple Mac OS 9 9.0.4
- Apple Mac OS 9 9.0.4
- Apple Mac OS 9 9.0
- Apple Mac OS 9 9.0
- Apple Mac OS X 10.1.2
- Apple Mac OS X 10.1.2
- Apple Mac OS X 10.1.1
- Apple Mac OS X 10.1
- Apple Mac OS X 10.1
- Apple Mac OS X 10.0.4
- Apple Mac OS X 10.0.4
- Apple Mac OS X 10.0.3
- Apple Mac OS X 10.0.3
- Apple Mac OS X 10.0.2
- Apple Mac OS X 10.0.2
- Apple Mac OS X 10.0.1
- Apple Mac OS X 10.0.1
- Apple Mac OS X 10.0
- Apple Mac OS X 10.0
- Microsoft Windows 95
- Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows 98
- Microsoft Windows ME
- Microsoft Windows ME
- Microsoft Windows NT 4.0 SP6a
- Microsoft Windows NT 4.0 SP6a
- Microsoft Windows NT 4.0 SP5
- Microsoft Windows NT 4.0 SP5
- Microsoft Windows NT 4.0 SP4
- Microsoft Windows NT 4.0 SP4
- Microsoft Windows NT 4.0 SP3
- Microsoft Windows NT 4.0 SP3
- Microsoft Windows NT 4.0 SP2
- Microsoft Windows NT 4.0 SP2
- Microsoft Windows NT 4.0 SP1
- Microsoft Windows NT 4.0 SP1
- Microsoft Windows NT 4.0
- Microsoft Windows NT 4.0
- Microsoft Windows XP 0
Galeon Galeon Browser 1.2.6
Galeon Galeon Browser 1.2.5
Galeon Galeon Browser 1.2.4
Netscape Netscape 7.0
Mozilla Browser 1.1
Galeon Galeon Browser 1.2.7

- 不受影响的程序版本

Netscape Netscape 7.0
Mozilla Browser 1.1
Galeon Galeon Browser 1.2.7

- 漏洞讨论

Multiple web browsers are prone to memory corruption when handling GIF image files with a width field set to zero. Browsers reported to be affected are Netscape, Mozilla and Opera on Linux platforms. Other browsers and platforms may also be affected.

It may be possible to exploit this issue to cause a denial of service or potentially execute arbitrary code.

As multiple browsers are affected, this vulnerability may be due to a common issue in a library used to render GIF images (such as libungif). This possibility has not yet been confirmed.

- 漏洞利用

A proof-of-concept is provided at the following location:

http://crash.ihug.co.nz/~Sneuro/zerogif/

- 解决方案

Conectiva has released a security advisory containing fixes. Users are advised to upgrade their Mozilla and Galeon packages as soon as possible.

Netscape has addressed the issue in version 7.0. This issue is also reported to be addressed in Mozilla 1.1.


Mozilla Browser 0.9.5

Mozilla Browser 0.9.6

Mozilla Browser 0.9.7

Mozilla Browser 0.9.8

Mozilla Browser 0.9.9

Mozilla Browser 1.0

Galeon Galeon Browser 1.2.4

Galeon Galeon Browser 1.2.5

Galeon Galeon Browser 1.2.6

Netscape Netscape 6.2

Netscape Netscape 6.2.1

Netscape Netscape 6.2.2

Netscape Netscape 6.2.3

- 相关参考

     

     

    关于SCAP中文社区

    SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

    版权声明

    CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站