Acme Thttpd以不安全方式创建临时文件漏洞

发布日期：2005-11-07
更新日期：2005-11-08

受影响系统：

Acme thttpd 2.23b1
Acme thttpd 2.21b
Debian Linux 3.1
Debian Linux 3.0

描述：

---

BUGTRAQ ID: 15320

thttpd是小型的可移植HTTP server。

thttpd的syslogtocern脚本以不安全的方式使用临时文件，这可能允许本地攻击者创建符号链接攻击，覆盖任意文件。这种攻击最可能的后果是拒绝服务。

<*来源：Javier Fernández-Sanguino Pe&ntilde;a

链接：http://www.debian.org/security/2005/dsa-883
*>

建议：

---

厂商补丁：

Debian
------
Debian已经为此发布了一个安全公告（DSA-883-1）以及相应补丁:
DSA-883-1：New thttpd packages fix insecure temporary file
链接：http://www.debian.org/security/2005/dsa-883

补丁下载：

Source archives:

http://security.debian.org/pool/updates/main/t/thttpd/thttpd_2.21b-11.3.dsc
Size/MD5 checksum: 545 ba3c0bb15f6212db97bcf6d6524d4780
http://security.debian.org/pool/updates/main/t/thttpd/thttpd_2.21b-11.3.diff.gz
Size/MD5 checksum: 12672 47c8093a645102ea2f328455195e763c
http://security.debian.org/pool/updates/main/t/thttpd/thttpd_2.21b.orig.tar.gz
Size/MD5 checksum: 127157 9c1512664cf70c286331243ab622173e

Alpha architecture:

http://security.debian.org/pool/updates/main/t/thttpd/thttpd_2.21b-11.3_alpha.deb
Size/MD5 checksum: 67624 465efe17c6bf662b1b191b91c8cd8491
http://security.debian.org/pool/updates/main/t/thttpd/thttpd-util_2.21b-11.3_alpha.deb
Size/MD5 checksum: 27940 3830272b2dae0993fa96b4bb014feb09

ARM architecture:

http://security.debian.org/pool/updates/main/t/thttpd/thttpd_2.21b-11.3_arm.deb
Size/MD5 checksum: 54272 fd2de8fb819e11c5a0a91ad4546d3b07
http://security.debian.org/pool/updates/main/t/thttpd/thttpd-util_2.21b-11.3_arm.deb
Size/MD5 checksum: 23384 9a02e239a4d792547e088b2e7047d08a

Intel IA-32 architecture:

http://security.debian.org/pool/updates/main/t/thttpd/thttpd_2.21b-11.3_i386.deb
Size/MD5 checksum: 51996 5c6c5f4bda6ecf89c095595ae7d47e0a
http://security.debian.org/pool/updates/main/t/thttpd/thttpd-util_2.21b-11.3_i386.deb
Size/MD5 checksum: 23732 b86b4669f89ea162f965430181004097

Intel IA-64 architecture:

http://security.debian.org/pool/updates/main/t/thttpd/thttpd_2.21b-11.3_ia64.deb
Size/MD5 checksum: 78060 ae4c37cfeb4bb00aabe86fb53ac8d320
http://security.debian.org/pool/updates/main/t/thttpd/thttpd-util_2.21b-11.3_ia64.deb
Size/MD5 checksum: 29732 3f7102053a50f0c67edc8d566e3707e8

HP Precision architecture:

http://security.debian.org/pool/updates/main/t/thttpd/thttpd_2.21b-11.3_hppa.deb
Size/MD5 checksum: 59244 1b007a6734c854b6a313e3a48c59b5d3
http://security.debian.org/pool/updates/main/t/thttpd/thttpd-util_2.21b-11.3_hppa.deb
Size/MD5 checksum: 25618 1c4087f8fa972c8ec9364fb422b1f399

Motorola 680x0 architecture:

http://security.debian.org/pool/updates/main/t/thttpd/thttpd_2.21b-11.3_m68k.deb
Size/MD5 checksum: 49632 f1cc7d708bbcf9fc34fe5382b8370bd3
http://security.debian.org/pool/updates/main/t/thttpd/thttpd-util_2.21b-11.3_m68k.deb
Size/MD5 checksum: 23386 4b6af55203f640969e0ca8fadd3ebf7d

Big endian MIPS architecture:

http://security.debian.org/pool/updates/main/t/thttpd/thttpd_2.21b-11.3_mips.deb
Size/MD5 checksum: 58302 e6c7222513bd7b96a09fb53f16447552
http://security.debian.org/pool/updates/main/t/thttpd/thttpd-util_2.21b-11.3_mips.deb
Size/MD5 checksum: 24670 2f575c075a755b452ee27749cab8e72d

Little endian MIPS architecture:

http://security.debian.org/pool/updates/main/t/thttpd/thttpd_2.21b-11.3_mipsel.deb
Size/MD5 checksum: 58424 af4447af28817c182ffe85b2f1ddbaa4
http://security.debian.org/pool/updates/main/t/thttpd/thttpd-util_2.21b-11.3_mipsel.deb
Size/MD5 checksum: 24744 9b7b47b0e29e90a4805edfb960912db5

PowerPC architecture:

http://security.debian.org/pool/updates/main/t/thttpd/thttpd_2.21b-11.3_powerpc.deb
Size/MD5 checksum: 56558 cd91f39ec6a4b76377fb62f93eb31f8d
http://security.debian.org/pool/updates/main/t/thttpd/thttpd-util_2.21b-11.3_powerpc.deb
Size/MD5 checksum: 23992 7d582bab26cb31d3b9b109008cc5d493

IBM S/390 architecture:

http://security.debian.org/pool/updates/main/t/thttpd/thttpd_2.21b-11.3_s390.deb
Size/MD5 checksum: 54762 72de109e9fd79a02ea9de27619a26923
http://security.debian.org/pool/updates/main/t/thttpd/thttpd-util_2.21b-11.3_s390.deb
Size/MD5 checksum: 24536 6bd0b8d4676a15c349905b0b70bb7c65

标签：

版权申明：本站文章部分自网络，如有侵权，请联系：west999com@outlook.com
特别注意：本站所有转载文章言论不代表本站观点，本站所提供的摄影照片，插画，设计作品，如需使用，请与原作者联系，版权归原作者所有