XPilot服务器远程缓冲区溢出漏洞

漏洞信息详情

XPilot服务器远程缓冲区溢出漏洞

• CNNVD编号：CNNVD-200204-016
• 危害等级： 高危
  
  
• CVE编号：
  CVE-2002-0179
  
• 漏洞类型：
  
  
  边界条件错误
  
• 发布时间：
  
  2002-04-22
  
• 威胁类型：
  
  
  远程
  
• 更新时间：
  
  2005-09-14
  
• 厂        商：
  
  xpilot
• 漏洞来源：
  Wichert Akkerman※ …

XPilot是一款多用户2D即时策略游戏，可运行再多种Linux操作系统下。
XPilot由于对用户提交的数据缺少正确的检查，可导致缓冲区溢出。
攻击者可以对XPilot服务器进行缓冲区溢出攻击，并以XPilot进程的权限在目标系统上执行任意命令。
没有更详细的漏洞描述。

临时解决方法：
如果您不能立刻安装补丁或者升级，CNNVD建议您采取以下措施以降低威胁：

* 暂时没有合适的临时解决方法。
厂商补丁：
Debian
——
Debian已经为此发布了一个安全公告(DSA-127-1)以及相应补丁:

DSA-127-1：buffer overflow in xpilot-server

链接：http://www.debian.org/security/2002/dsa-127” target=”_blank”>
http://www.debian.org/security/2002/dsa-127

补丁下载：

Source archives:

http://security.debian.org/dists/stable/updates/main/source/xpilot_4.1.0-4.U.4alpha2.4.potato1.diff.gz” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/source/xpilot_4.1.0-4.U.4alpha2.4.potato1.diff.gz

http://security.debian.org/dists/stable/updates/main/source/xpilot_4.1.0-4.U.4alpha2.4.potato1.dsc” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/source/xpilot_4.1.0-4.U.4alpha2.4.potato1.dsc

http://security.debian.org/dists/stable/updates/main/source/xpilot_4.1.0.orig.tar.gz” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/source/xpilot_4.1.0.orig.tar.gz

Architecture independent archives:

http://security.debian.org/dists/stable/updates/main/binary-all/xpilot_4.1.0-4.U.4alpha2.4.potato1_all.deb” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/binary-all/xpilot_4.1.0-4.U.4alpha2.4.potato1_all.deb

Alpha architecture:

http://security.debian.org/dists/stable/updates/main/binary-alpha/xpilot-client-nas_4.1.0-4.U.4alpha2.4.potato1_alpha.deb” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/binary-alpha/xpilot-client-nas_4.1.0-4.U.4alpha2.4.potato1_alpha.deb

http://security.debian.org/dists/stable/updates/main/binary-alpha/xpilot-client-nosound_4.1.0-4.U.4alpha2.4.potato1_alpha.deb” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/binary-alpha/xpilot-client-nosound_4.1.0-4.U.4alpha2.4.potato1_alpha.deb

http://security.debian.org/dists/stable/updates/main/binary-alpha/xpilot-client-rplay_4.1.0-4.U.4alpha2.4.potato1_alpha.deb” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/binary-alpha/xpilot-client-rplay_4.1.0-4.U.4alpha2.4.potato1_alpha.deb

http://security.debian.org/dists/stable/updates/main/binary-alpha/xpilot-server_4.1.0-4.U.4alpha2.4.potato1_alpha.deb” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/binary-alpha/xpilot-server_4.1.0-4.U.4alpha2.4.potato1_alpha.deb

Intel IA-32 architecture:

http://security.debian.org/dists/stable/updates/main/binary-i386/xpilot-client-nas_4.1.0-4.U.4alpha2.4.potato1_i386.deb” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/binary-i386/xpilot-client-nas_4.1.0-4.U.4alpha2.4.potato1_i386.deb

http://security.debian.org/dists/stable/updates/main/binary-i386/xpilot-client-nosound_4.1.0-4.U.4alpha2.4.potato1_i386.deb” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/binary-i386/xpilot-client-nosound_4.1.0-4.U.4alpha2.4.potato1_i386.deb

http://security.debian.org/dists/stable/updates/main/binary-i386/xpilot-client-rplay_4.1.0-4.U.4alpha2.4.potato1_i386.deb” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/binary-i386/xpilot-client-rplay_4.1.0-4.U.4alpha2.4.potato1_i386.deb

http://security.debian.org/dists/stable/updates/main/binary-i386/xpilot-server_4.1.0-4.U.4alpha2.4.potato1_i386.deb” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/binary-i386/xpilot-server_4.1.0-4.U.4alpha2.4.potato1_i386.deb

Motorola 680×0 architecture:

http://security.debian.org/dists/stable/updates/main/binary-m68k/xpilot-client-nas_4.1.0-4.U.4alpha2.4.potato1_m68k.deb” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/binary-m68k/xpilot-client-nas_4.1.0-4.U.4alpha2.4.potato1_m68k.deb

http://security.debian.org/dists/stable/updates/main/binary-m68k/xpilot-client-nosound_4.1.0-4.U.4alpha2.4.potato1_m68k.deb” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/binary-m68k/xpilot-client-nosound_4.1.0-4.U.4alpha2.4.potato1_m68k.deb

http://security.debian.org/dists/stable/updates/main/binary-m68k/xpilot-client-rplay_4.1.0-4.U.4alpha2.4.potato1_m68k.deb” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/binary-m68k/xpilot-client-rplay_4.1.0-4.U.4alpha2.4.potato1_m68k.deb

http://security.debian.org/dists/stable/updates/main/binary-m68k/xpilot-server_4.1.0-4.U.4alpha2.4.potato1_m68k.deb” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/binary-m68k/xpilot-server_4.1.0-4.U.4alpha2.4.potato1_m68k.deb

PowerPC architecture:

http://security.debian.org/dists/stable/updates/main/binary-powerpc/xpilot-client-nas_4.1.0-4.U.4alpha2.4.potato1_powerpc.deb” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/binary-powerpc/xpilot-client-nas_4.1.0-4.U.4alpha2.4.potato1_powerpc.deb

http://security.debian.org/dists/stable/updates/main/binary-powerpc/xpilot-client-nosound_4.1.0-4.U.4alpha2.4.potato1_powerpc.deb” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/binary-powerpc/xpilot-client-nosound_4.1.0-4.U.4alpha2.4.potato1_powerpc.deb

http://security.debian.org/dists/stable/updates/main/binary-powerpc/xpilot-client-rplay_4.1.0-4.U.4alpha2.4.potato1_powerpc.deb” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/binary-powerpc/xpilot-client-rplay_4.1.0-4.U.4alpha2.4.potato1_powerpc.deb

http://security.debian.org/dists/stable/updates/main/binary-powerpc/xpilot-server_4.1.0-4.U.4alpha2.4.potato1_powerpc.deb” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/binary-powerpc/xpilot-server_4.1.0-4.U.4alpha2.4.potato1_powerpc.deb

Sun Sparc architecture:

http://security.debian.org/dists/stable/updates/main/binary-sparc/xpilot-client-nas_4.1.0-4.U.4alpha2.4.potato1_sparc.deb” target=”_blank”>
http://security.debian.org/dists/stable/updates/main/binary-sparc/xpilot-client-nas_4.1.0-4.U.4alpha2.4.potato1_sparc.deb

http://security.debian.org/dists/stable/updates/m” target=”_blank”>
http://security.debian.org/dists/stable/updates/m

补丁安装方法：

1. 手工安装补丁包：

首先，使用下面的命令来下载补丁软件：

# wget url (url是补丁下载链接地址)

然后，使用下面的命令来安装补丁：

# dpkg -i file.deb (file是相应的补丁名)

2. 使用apt-get自动安装补丁包：

首先，使用下面的命令更新内部数据库：

# apt-get update

然后，使用下面的命令安装更新软件包：

# apt-get upgrade

来源: DEBIAN
名称: DSA-127
链接:http://www.debian.org/security/2002/dsa-127

来源: BID
名称: 4534
链接:http://www.securityfocus.com/bid/4534

来源: XF
名称: xpilot-server-bo(8852)
链接:http://www.iss.net/security_center/static/8852.php