CVE-2004-0235
CVSS6.4
发布时间 :2004-08-18 00:00:00
修订时间 :2016-10-17 22:42:10
NMCOP    

[原文]Multiple directory traversal vulnerabilities in LHA 1.14 allow remote attackers or local users to create arbitrary files via an LHA archive containing filenames with (1) .. sequences or (2) absolute pathnames with double leading slashes ("//absolute/path").


[CNNVD]LHA缓冲区溢出/目录遍历漏洞(CNNVD-200408-176)

        
        LHa是一款基于控制台的解压缩程序。
        LHa存在两个缓冲区溢出和两个目录遍历问题,远程攻击者可以利用这些漏洞以进程权限在系统上执行任意指令或破坏系统。
        缓冲区溢出发生在测试(t)或者展开(x)操作时,对超长文件名或目录名进行解析时,get_header()函数会发生缓冲区溢出。精心构建文件名或目录名可以进程权限执行任意指令。
        另外就是对相对路径没有任何保护,可简单使用LHA建立路径类似"../../../../../etc/cron.d/evil"的压缩包,虽然对绝对路径有保护,但可使用类似"//etc/cron.d/evil"的路径形式绕过。攻击者可以构建简单包当LHA操作时破坏系统文件。
        

- CVSS (基础分值)

CVSS分值: 6.4 [中等(MEDIUM)]
机密性影响: [--]
完整性影响: [--]
可用性影响: [--]
攻击复杂度: [--]
攻击向量: [--]
身份认证: [--]

- CPE (受影响的平台与产品)

cpe:/a:clearswift:mailsweeper:4.3.4
cpe:/a:clearswift:mailsweeper:4.3.3
cpe:/a:redhat:lha:1.14i-9::i386
cpe:/a:f-secure:f-secure_anti-virus:4.52::linux_servers
cpe:/a:f-secure:f-secure_for_firewalls:6.20
cpe:/a:rarlab:winrar:3.20
cpe:/a:f-secure:f-secure_anti-virus:4.51::linux_servers
cpe:/a:clearswift:mailsweeper:4.1
cpe:/a:clearswift:mailsweeper:4.0
cpe:/a:f-secure:f-secure_anti-virus:6.21::ms_exchange
cpe:/a:f-secure:f-secure_anti-virus:4.60::samba_servers
cpe:/a:f-secure:f-secure_anti-virus:4.52::linux_workstations
cpe:/a:f-secure:f-secure_anti-virus:5.52::client_security
cpe:/a:sgi:propack:2.4SGI ProPack 2.4
cpe:/a:f-secure:f-secure_anti-virus:4.51::linux_workstations
cpe:/a:f-secure:internet_gatekeeper:6.32
cpe:/a:f-secure:internet_gatekeeper:6.31
cpe:/a:clearswift:mailsweeper:4.3
cpe:/a:clearswift:mailsweeper:4.2
cpe:/a:f-secure:f-secure_anti-virus:5.41::mimesweeper
cpe:/a:f-secure:f-secure_anti-virus:5.42::windows_servers
cpe:/a:f-secure:f-secure_anti-virus:5.41::windows_servers
cpe:/a:f-secure:f-secure_anti-virus:5.42::mimesweeper
cpe:/a:f-secure:f-secure_anti-virus:4.51::linux_gateways
cpe:/a:f-secure:f-secure_anti-virus:4.52::linux_gateways
cpe:/a:f-secure:f-secure_internet_security:2003
cpe:/a:f-secure:f-secure_anti-virus:2003
cpe:/a:f-secure:f-secure_anti-virus:2004
cpe:/a:sgi:propack:3.0SGI ProPack 3.0
cpe:/a:f-secure:f-secure_anti-virus:5.42::workstations
cpe:/a:f-secure:f-secure_anti-virus:5.41::workstations
cpe:/a:clearswift:mailsweeper:4.3.8
cpe:/a:winzip:winzip:9.0WinZip 9.0
cpe:/a:clearswift:mailsweeper:4.3.13
cpe:/a:clearswift:mailsweeper:4.3.6_sp1
cpe:/a:clearswift:mailsweeper:4.3.7
cpe:/a:clearswift:mailsweeper:4.3.10
cpe:/a:clearswift:mailsweeper:4.3.6
cpe:/a:clearswift:mailsweeper:4.3.11
cpe:/a:clearswift:mailsweeper:4.3.5
cpe:/a:f-secure:f-secure_internet_security:2004
cpe:/a:f-secure:f-secure_personal_express:4.6
cpe:/a:stalker:cgpmcafee:3.2
cpe:/a:f-secure:f-secure_personal_express:4.7
cpe:/a:f-secure:f-secure_personal_express:4.5
cpe:/o:redhat:fedora_core:core_1.0
cpe:/a:tsugio_okamoto:lha:1.17
cpe:/a:tsugio_okamoto:lha:1.14
cpe:/a:f-secure:f-secure_anti-virus:5.5::client_security
cpe:/a:tsugio_okamoto:lha:1.15

- OVAL (用于检测的技术细节)

oval:org.mitre.oval:def:978Multiple Directory Traversal Vulnerabilities in LHA
oval:org.mitre.oval:def:10409Multiple directory traversal vulnerabilities in LHA 1.14 allow remote attackers or local users to create arbitrary files via an LHA archive ...
*OVAL详细的描述了检测该漏洞的方法,你可以从相关的OVAL定义中找到更多检测该漏洞的技术细节。

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0235
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2004-0235
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200408-176
(官方数据源) CNNVD

- 其它链接及资源

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000840
(UNKNOWN)  CONECTIVA  CLA-2004:840
http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/020776.html
(UNKNOWN)  FULLDISC  20040501 LHa buffer overflows and directory traversal problems
http://marc.info/?l=bugtraq&m=108422737918885&w=2
(UNKNOWN)  BUGTRAQ  20040510 [Ulf Harnhammar]: LHA Advisory + Patch
http://security.gentoo.org/glsa/glsa-200405-02.xml
(UNKNOWN)  GENTOO  GLSA-200405-02
http://www.debian.org/security/2004/dsa-515
(UNKNOWN)  DEBIAN  DSA-515
http://www.redhat.com/archives/fedora-announce-list/2004-May/msg00005.html
(UNKNOWN)  FEDORA  FEDORA-2004-119
http://www.redhat.com/support/errata/RHSA-2004-178.html
(UNKNOWN)  REDHAT  RHSA-2004:178
http://www.redhat.com/support/errata/RHSA-2004-179.html
(UNKNOWN)  REDHAT  RHSA-2004:179
http://www.securityfocus.com/bid/10243
(VENDOR_ADVISORY)  BID  10243
http://xforce.iss.net/xforce/xfdb/16013
(VENDOR_ADVISORY)  XF  lha-directory-traversal(16013)
https://bugzilla.fedora.us/show_bug.cgi?id=1833
(UNKNOWN)  FEDORA  FLSA:1833

- 漏洞信息

LHA缓冲区溢出/目录遍历漏洞
中危 未知
2004-08-18 00:00:00 2006-09-20 00:00:00
远程  
        
        LHa是一款基于控制台的解压缩程序。
        LHa存在两个缓冲区溢出和两个目录遍历问题,远程攻击者可以利用这些漏洞以进程权限在系统上执行任意指令或破坏系统。
        缓冲区溢出发生在测试(t)或者展开(x)操作时,对超长文件名或目录名进行解析时,get_header()函数会发生缓冲区溢出。精心构建文件名或目录名可以进程权限执行任意指令。
        另外就是对相对路径没有任何保护,可简单使用LHA建立路径类似"../../../../../etc/cron.d/evil"的压缩包,虽然对绝对路径有保护,但可使用类似"//etc/cron.d/evil"的路径形式绕过。攻击者可以构建简单包当LHA操作时破坏系统文件。
        

- 公告与补丁

        暂无数据

- 漏洞信息 (F33241)

lha.txt (PacketStormID:F33241)
2004-05-04 00:00:00
Ulf Harnhammar  
advisory,overflow
CVE-2004-0234,CVE-2004-0235
[点击下载]

LHa versions 1.14d to 1.14i and 1.17 suffer from buffer overflows and directory traversal flaws.

------------------------------------------------------------------------

LHa buffer overflows and directory traversal problems

PROGRAM: LHa (Unix version)
VENDOR: various people
VULNERABLE VERSIONS: 1.14d to 1.14i
                     1.17 (Linux binary)
                     possibly others
IMMUNE VERSIONS: 1.14i with my patch applied
                 1.14h with my patch applied
LHa 1.14: http://www2m.biglobe.ne.jp/~dolphin/lha/lha.htm
          http://www2m.biglobe.ne.jp/~dolphin/lha/prog/
LHa 1.17: http://www.infor.kanazawa-it.ac.jp/~ishii/lhaunix/
REFERENCES: CAN-2004-0234 (buffer overflows)
            CAN-2004-0235 (directory traversal)

* DESCRIPTION *

LHa is a console-based program for packing and unpacking LHarc
archives.

It is one of the packages in Red Hat Linux, Fedora Core, SUSE
Linux, Debian GNU/Linux (non-free), Mandrakelinux, Slackware Linux,
Gentoo Linux, Yellow Dog Linux, Conectiva Linux and ALT Linux.
It is also included in the port/package collections for FreeBSD,
OpenBSD and NetBSD.

* OVERVIEW *

LHa has two stack-based buffer overflows and two directory traversal
problems. They can be abused by malicious people in many different
ways: some mail virus scanners require LHa and run it automatically
on attached files in e-mail messages. Some web applications allow
uploading and unpacking of LHarc archives. Some people set up their
web browsers to start LHa automatically after downloading an LHarc
archive. Finally, social engineering is probably quite effective
in this case.

* TECHNICAL DETAILS *

a) two stack-based buffer overflows

The buffer overflows in LHa occur when testing (t) or extracting
(x) archives where the archive contents have too long filenames
or directory names. The cause of the problem is the function
get_header() in header.c. This function first reads the lengths of
filenames or directory names from the archive, and then it reads
that many bytes to a char array (one for filenames and one for
directory names) without checking if the array is big enough.

By exploiting this bug, you get control over several registers
including EIP, as you can see in this session capture:

$ lha t buf_oflow.lha
LHa: Error: Unknown information UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUU
Segmentation fault
$ lha x buf_oflow.lha
LHa: Error: Unknown information UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUU
Segmentation fault
$ gdb lha
GNU gdb Red Hat Linux (5.3post-0.20021129.18rh)
Copyright 2003 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and
you are welcome to change it and/or distribute copies of it under
certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for
details.
This GDB was configured as "i386-redhat-linux-gnu"...
(gdb) r x buf_oflow.lha
Starting program: /usr/bin/lha x buf_oflow.lha
LHa: Error: Unknown information UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUU

Program received signal SIGSEGV, Segmentation fault.
0x55555555 in ?? ()
(gdb) bt
#0 0x55555555 in ?? ()
Cannot access memory at address 0x55555555
(gdb) i r
eax 0x4001e4a0 1073865888
ecx 0xffffffe0 -32
edx 0x24 36
ebx 0x55555555 1431655765
esp 0xbfffdd50 0xbfffdd50
ebp 0x55555555 0x55555555
esi 0x55555555 1431655765
edi 0x55555555 1431655765
eip 0x55555555 0x55555555
eflags 0x210282 2163330
cs 0x23 35
ss 0x2b 43
ds 0x2b 43
es 0x2b 43
fs 0x0 0
gs 0x33 51
(gdb) r t buf_oflow.lha
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /usr/bin/lha t buf_oflow.lha
LHa: Error: Unknown information UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUU

Program received signal SIGSEGV, Segmentation fault.
0x55555555 in ?? ()
(gdb) bt
#0 0x55555555 in ?? ()
Cannot access memory at address 0x55555555
(gdb) i r
eax 0x4001e4a0 1073865888
ecx 0xffffffe0 -32
edx 0x24 36
ebx 0x55555555 1431655765
esp 0xbfffe6d0 0xbfffe6d0
ebp 0x55555555 0x55555555
esi 0x55555555 1431655765
edi 0x55555555 1431655765
eip 0x55555555 0x55555555
eflags 0x210286 2163334
cs 0x23 35
ss 0x2b 43
ds 0x2b 43
es 0x2b 43
fs 0x0 0
gs 0x33 51
(gdb) q
The program is running. Exit anyway? (y or n) y
$

b) two directory traversal problems

LHa has directory traversal problems, both with absolute paths
and relative paths. There is no protection against relative paths
at all, so you can simply use the lha binary to create an archive
with paths like "../../../../../etc/cron.d/evil". There is some
simple protection against absolute paths, namely skipping the first
character if it is a slash, but again you can simply use the binary
to create archives with paths like "//etc/cron.d/evil".

* ATTACHED FILES *

I have written a patch against version 1.14i that corrects all
four problems. The patch is included as an attachment, together
with some test archives.

* TIMELINE *

18 Apr: contacted the vendor-sec list and the LHa 1.14 author
18 Apr: tried to contact the LHa 1.17 author with a web form and
        a guessed e-mail address which bounced
19 Apr: reply from the vendor-sec list with CVE references
30 Apr: Red Hat released their advisory
01 May: I release this advisory

// Ulf Harnhammar
Advogato diary :: http://www.advogato.org/person/metaur/
idiosynkratisk (Swedish electropop zine) :: http://idiosynkratisk.tk/
Debian Security Audit Project :: http://shellcode.org/Audit/

------------------------------------------------------------------------
    

- 漏洞信息

5755
LHA Arbitrary File Access
Remote / Network Access Information Disclosure
Loss of Confidentiality
Exploit Public

- 漏洞描述

LHA contains a flaw that allows a remote attacker to view arbitrary files on the system. The issue is due to the program not properly sanitizing user input, specifically traversal style attacks (../../) which will allow a remote attacker to view arbitrary files on the system, resulting in a loss of confidentiality.

- 时间线

2004-05-01 Unknow
2004-05-01 Unknow

- 解决方案

Currently, there are no known workarounds or upgrades to correct this issue. Consult your vendor for an appropriate patch.

- 相关参考

- 漏洞作者

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站