TNFTPD多个信号处理器远程超级用户妥协漏洞

漏洞信息详情

TNFTPD多个信号处理器远程超级用户妥协漏洞

• CNNVD编号：CNNVD-200410-061
• 危害等级： 中危
  
  
• CVE编号：
  CVE-2004-0794
  
• 漏洞类型：
  
  
  竞争条件
  
• 发布时间：
  
  2004-10-20
  
• 威胁类型：
  
  
  远程
  
• 更新时间：
  
  2005-10-20
  
• 厂        商：
  
  luke_mewburn
• 漏洞来源：
  Przemyslaw Frasune…

lukemftpd（也称为20040810之前的tnftpd）中的许多信号处理器竞争条件存在漏洞。远程已认证的攻击者可以导致服务拒绝或者执行任意代码。

The vendor has released patches resolving these issues.
NetBSD has released advisory 2004-009 addressing this issue. Please see the referenced advisory for further information. Fixes are available from CVS for the NetBSD-current and NetBSD-2.0 branches.
Apple has released an advisory (APPLE-SA-0024-09-07) along with fixes to address this, and many other issues. Please see the referenced advisory for further information.
Heimdal has released an advisory (2004-09-13) along with version 0.6.3 to address this issue. Please see the referenced advisory for further information.
Gentoo Linux has released an advisory (GLSA 200409-19) to address this issue. Please see the referenced advisory for further information. Users of affected packages are urged to execute the following with superuser privileges:
emerge sync
emerge -pv “>=app-crypt/heimdal-0.6.3”
emerge “>=app-crypt/heimdal-0.6.3”
Debian Linux has released an advisory (DSA 551-1) along with fixes dealing with this issue. Please the referenced advisory for more information.
Sun has released an advisory (Sun Alert ID: 57655) with fixes to address these issues in Sun Java Desktop System (JDS) 2003 and Release 2 for the Linux platform. Please see the advisory in Web references for more information. Users may carry out the following actions from the launch bar to download the patch:
Launch >> Applications >> System Tools >> Online Update
Luke Mewburn TNFTPD 20031217

• Luke Mewburn tnftpd-20040810.tar.gz
  ftp://ftp.netbsd.org/pub/NetBSD/misc/tnftp/tnftpd-20040810.tar.gz

Sun Java Desktop System (JDS) 2003

• Sun patch-9369
  

Heimdal Heimdal 0.3 f

• Heimdal heimdal-0.6.3.tar.gz
  ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-0.6.3.tar.gz

Heimdal Heimdal 0.4 b

• Heimdal heimdal-0.6.3.tar.gz
  ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-0.6.3.tar.gz

Heimdal Heimdal 0.4 d

• Heimdal heimdal-0.6.3.tar.gz
  ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-0.6.3.tar.gz

Heimdal Heimdal 0.4 c

• Heimdal heimdal-0.6.3.tar.gz
  ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-0.6.3.tar.gz

Heimdal Heimdal 0.4 a

• Heimdal heimdal-0.6.3.tar.gz
  ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-0.6.3.tar.gz

Heimdal Heimdal 0.4 e

• Heimdal heimdal-0.6.3.tar.gz
  ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-0.6.3.tar.gz

Heimdal Heimdal 0.5 .0

• Heimdal heimdal-0.6.3.tar.gz
  ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-0.6.3.tar.gz

Heimdal Heimdal 0.5.1

• Heimdal heimdal-0.6.3.tar.gz
  ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-0.6.3.tar.gz

Heimdal Heimdal 0.5.2

• Heimdal heimdal-0.6.3.tar.gz
  ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-0.6.3.tar.gz

Heimdal Heimdal 0.5.3

• Heimdal heimdal-0.6.3.tar.gz
  ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-0.6.3.tar.gz

Heimdal Heimdal 0.6

• Heimdal heimdal-0.6.3.tar.gz
  ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-0.6.3.tar.gz

Heimdal Heimdal 0.6.1

• Heimdal heimdal-0.6.3.tar.gz
  ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-0.6.3.tar.gz

Heimdal Heimdal 0.6.2

• Heimdal heimdal-0.6.3.tar.gz
  ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-0.6.3.tar.gz

Luke Mewburn lukemftp 1.1

• Debian lukemftpd_1.1-1woody2_alpha.debDebian GNU/Linux 3.0 alias woody
  
  http://security.debian.org/pool/updates/main/l/lukemftpd/lukemftpd_1.1
  -1woody2_alpha.deb
• Debian lukemftpd_1.1-1woody2_arm.debDebian GNU/Linux 3.0 alias woody
  
  http://security.debian.org/pool/updates/main/l/lukemftpd/lukemftpd_1.1
  -1woody2_arm.deb
• Debian lukemftpd_1.1-1woody2_hppa.debDebian GNU/Linux 3.0 alias woody
  
  http://security.debian.org/pool/updates/main/l/lukemftpd/lukemftpd_1.1
  -1woody2_hppa.deb
• Debian lukemftpd_1.1-1woody2_i386.debDebian GNU/Linux 3.0 alias woody
  
  http://security.debian.org/pool/updates/main/l/lukemftpd/lukemftpd_1.1
  -1woody2_i386.deb
• Debian lukemftpd_1.1-1woody2_ia64.debDebian GNU/Linux 3.0 alias woody
  
  http://security.debian.org/pool/updates/main/l/lukemftpd/lukemftpd_1.1
  -1woody2_ia64.deb
• Debian lukemftpd_1.1-1woody2_m68k.debDebian GNU/Linux 3.0 alias woody
  
  http://security.debian.org/pool/updates/main/l/lukemftpd/lukemftpd_1.1
  -1woody2_m68k.deb
• Debian lukemftpd_1.1-1woody2_mips.debDebian GNU/Linux 3.0 alias woody
  
  http://security.debian.org/pool/updates/main/l/lukemftpd/lukemftpd_1.1
  -1woody2_mips.deb
• Debian lukemftpd_1.1-1woody2_mipsel.debDebian GNU/Linux 3.0 alias woody
  
  http://security.debian.org/pool/updates/main/l/lukemftpd/lukemftpd_1.1
  -1woody2_mipsel.deb
• Debian lukemftpd_1.1-1woody2_powerpc.debDebian GNU/Linux 3.0 alias woody
  
  http://security.debian.org/pool/updates/main/l/lukemftpd/lukemftpd_1.1
  -1woody2_powerpc.deb
• Debian lukemftpd_1.1-1woody2_s390.debDebian GNU/Linux 3.0 alias woody
  
  http://security.debian.org/pool/updates/main/l/lukemftpd/lukemftpd_1.1
  -1woody2_s390.deb
• Debian lukemftpd_1.1-1woody2_sparc.debDebian GNU/Linux 3.0 alias woody
  

  参考网址

  来源: NETBSD
  名称: NetBSD-SA2004-009
  链接:ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-009.txt.asc

  来源: XF
  名称: tnftpd-gain-access(17020)
  链接:http://xforce.iss.net/xforce/xfdb/17020

  来源: www.vuxml.org
  链接:http://www.vuxml.org/freebsd/c4b025bb-f05d-11d8-9837-000c41e2cdad.html

  来源: DEBIAN
  名称: DSA-551
  链接:http://www.debian.org/security/2004/dsa-551

  来源: FULLDISC
  名称: 20040817 Multiple remote vulnerabilities in lukemftpd aka. tnftpd
  链接:http://lists.grok.org.uk/pipermail/full-disclosure/2004-August/025418.html