tinyproxy HTTP代理存在内存破坏漏洞

漏洞信息详情

tinyproxy HTTP代理存在内存破坏漏洞

• CNNVD编号：CNNVD-200208-119
• 危害等级： 高危
  
  
• CVE编号：
  CVE-2002-0847
  
• 漏洞类型：
  
  
  未知
  
• 发布时间：
  
  2002-05-13
  
• 威胁类型：
  
  
  远程
  
• 更新时间：
  
  2005-05-02
  
• 厂        商：
  
  tinyproxy
• 漏洞来源：

tinyproxy HTTP Proxy是一款小型HTTP代理程序，可使用在Linux和Unix操作系统下，也可使用在Microsoft Windows操作系统下。
tinyproxy HTTP Proxy在处理非法代理请求时存在漏洞，可导致远程攻击者以HTTP Proxy进程的权限在目标系统上执行任意代码。
tinyproxy HTTP Proxy在处理某些非法代理请求时会造成分配的内存被释放两次，攻击者可利用这个漏洞覆盖内存中任意地址，造成以HTTP Proxy进程的权限在目标系统上执行任意代码。
＜*链接：http：//www.debian.org/security/2002/dsa-145
*＞

临时解决方法：
如果您不能立刻安装补丁或者升级，CNNVD建议您采取以下措施以降低威胁：

* 对tinyproxy系统实行访问控制，只允许可信用户访问。
厂商补丁：
Debian
——
Debian已经为此发布了一个安全公告(DSA-145-1)以及相应补丁:
DSA-145-1：New tinyproxy packages fix security vulnerability
链接：http://www.debian.org/security/2002/dsa-145” target=”_blank”>
http://www.debian.org/security/2002/dsa-145
补丁下载：
Source archives:
http://security.debian.org/pool/updates/main/t/tinyproxy/tinyproxy_1.4.3-2woody2.dsc” target=”_blank”>
http://security.debian.org/pool/updates/main/t/tinyproxy/tinyproxy_1.4.3-2woody2.dsc
Size/MD5 checksum: 583 894dc6ee8c57988cae148ebae5e200bd
http://security.debian.org/pool/updates/main/t/tinyproxy/tinyproxy_1.4.3-2woody2.diff.gz” target=”_blank”>
http://security.debian.org/pool/updates/main/t/tinyproxy/tinyproxy_1.4.3-2woody2.diff.gz
Size/MD5 checksum: 15774 43ed91e7b2980d06aea13a9d40c93e33
http://security.debian.org/pool/updates/main/t/tinyproxy/tinyproxy_1.4.3.orig.tar.gz” target=”_blank”>
http://security.debian.org/pool/updates/main/t/tinyproxy/tinyproxy_1.4.3.orig.tar.gz
Size/MD5 checksum: 197813 609a1c7ac1928ba02303592bd83e2494
Alpha architecture:
http://security.debian.org/pool/updates/main/t/tinyproxy/tinyproxy_1.4.3-2woody2_alpha.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/t/tinyproxy/tinyproxy_1.4.3-2woody2_alpha.deb
Size/MD5 checksum: 45240 da475742787600eac462897070bb7e45
ARM architecture:
http://security.debian.org/pool/updates/main/t/tinyproxy/tinyproxy_1.4.3-2woody2_arm.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/t/tinyproxy/tinyproxy_1.4.3-2woody2_arm.deb
Size/MD5 checksum: 39548 99bc9c2736384d2f0b41a774bceb6ab3
Intel IA-32 architecture:
http://security.debian.org/pool/updates/main/t/tinyproxy/tinyproxy_1.4.3-2woody2_i386.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/t/tinyproxy/tinyproxy_1.4.3-2woody2_i386.deb
Size/MD5 checksum: 38758 591c6aa83eb191bd53f4f76caea330a4
Intel IA-64 architecture:
http://security.debian.org/pool/updates/main/t/tinyproxy/tinyproxy_1.4.3-2woody2_ia64.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/t/tinyproxy/tinyproxy_1.4.3-2woody2_ia64.deb
Size/MD5 checksum: 52294 d254853e04d3cd3da6648517b41f8988
HP Precision architecture:
http://security.debian.org/pool/updates/main/t/tinyproxy/tinyproxy_1.4.3-2woody2_hppa.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/t/tinyproxy/tinyproxy_1.4.3-2woody2_hppa.deb
Size/MD5 checksum: 41984 24b947794fe0664d32f59bf1aabdb58f
Motorola 680×0 architecture:
http://security.debian.org/pool/updates/main/t/tinyproxy/tinyproxy_1.4.3-2woody2_m68k.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/t/tinyproxy/tinyproxy_1.4.3-2woody2_m68k.deb
Size/MD5 checksum: 37600 d427a112b79aa8763c76d7a47e95d3e4
Big endian MIPS architecture:
http://security.debian.org/pool/updates/main/t/tinyproxy/tinyproxy_1.4.3-2woody2_mips.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/t/tinyproxy/tinyproxy_1.4.3-2woody2_mips.deb
Size/MD5 checksum: 41968 1e7a1ead7d24480252c6f0349283b55e
Little endian MIPS architecture:
http://security.debian.org/pool/updates/main/t/tinyproxy/tinyproxy_1.4.3-2woody2_mipsel.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/t/tinyproxy/tinyproxy_1.4.3-2woody2_mipsel.deb
Size/MD5 checksum: 41980 554b74aa879936732d14e36f6c49e4ee
PowerPC architecture:
http://security.debian.org/pool/updates/main/t/tinyproxy/tinyproxy_1.4.3-2woody2_powerpc.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/t/tinyproxy/tinyproxy_1.4.3-2woody2_powerpc.deb
Size/MD5 checksum: 40340 ec9e7db429e09493a300b9a3c090821f
IBM S/390 architecture:
http://security.debian.org/pool/updates/main/t/tinyproxy/tinyproxy_1.4.3-2woody2_s390.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/t/tinyproxy/tinyproxy_1.4.3-2woody2_s390.deb
Size/MD5 checksum: 40214 6e5aa58c775df243ebcb36672ff9a429
Sun Sparc architecture:
http://security.debian.org/pool/updates/main/t/tinyproxy/tinyproxy_1.4.3-2woody2_sparc.deb” target=”_blank”>
http://security.debian.org/pool/updates/main/t/tinyproxy/tinyproxy_1.4.3-2woody2_sparc.deb
Size/MD5 checksum: 42620 b176631600bdb9a7ea821e54d007c7ee
补丁安装方法：

1. 手工安装补丁包：

首先，使用下面的命令来下载补丁软件：

# wget url (url是补丁下载链接地址)

然后，使用下面的命令来安装补丁：

# dpkg -i file.deb (file是相应的补丁名)

2. 使用apt-get自动安装补丁包：

首先，使用下面的命令更新内部数据库：

# apt-get update

然后，使用下面的命令安装更新软件包：

# apt-get upgrade
tinyproxy
———
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

tinyproxy Upgrade tinyproxy-1.5.0.tar.gz

http://prdownloads.sourceforge.net/tinyproxy/tinyproxy-1.5.0.tar.gz” target=”_blank”>
http://prdownloads.sourceforge.net/tinyproxy/tinyproxy-1.5.0.tar.gz

来源: BID
名称: 4731
链接:http://www.securityfocus.com/bid/4731

来源: XF
名称: tinyproxy-memory-corruption(9079)
链接:http://www.iss.net/security_center/static/9079.php

来源: DEBIAN
名称: DSA-145
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=102874450402924&w=2

来源: sourceforge.net
链接:http://sourceforge.net/project/shownotes.php?release_id=88790