Jed Wing CHM Lib _chm_find_in_PMGL栈溢出漏洞

发布日期：2005-10-31
更新日期：2005-11-14

受影响系统：

Jed Wing CHM lib 0.35
Jed Wing CHM lib 0.33
Jed Wing CHM lib 0.32
Jed Wing CHM lib 0.31
Jed Wing CHM lib 0.3
Jed Wing CHM lib 0.2
Jed Wing CHM lib 0.1

不受影响系统：

Jed Wing CHM lib 0.36

描述：

---

BUGTRAQ ID: 15234
CVE(CAN) ID: CVE-2005-2930

chmlib是用于处理Microsoft ITSS/CHM格式文件的函数库。

各种Linux版本捆绑的chmlib存在栈溢出漏洞，远程攻击者可能利用此漏洞在主机上执行任意指令。

在chm_lib.c的以下代码中，处理CHM文件时存在未检查的内存拷贝：

static UChar *_chm_find_in_PMGL(UChar *page_buf,
UInt32
block_len,
const
char *objPath)
{
[...]
char buffer[CHM_MAX_PATHLEN 1];
/* figure out where to start and end */
cur = page_buf;
hremain = _CHM_PMGL_LEN;
if (! _unmarshal_pmgl_header(&cur, &hremain, &header))
return NULL;
end = page_buf block_len - (header.free_space);

/* now, scan progressively */
while (cur < end)
{
/* grab the name */
temp = cur;
strLen = _chm_parse_cword(&cur);
if (! _chm_parse_UTF8(&cur, strLen, buffer))
return NULL;
[..]

可以强制_chm_parse_cword返回大于CHM_MAX_PATHLEN的值。然后可以在拷贝用户控制数据时将该值拷贝到CHM_MAX_PATHLEN大小的栈缓冲区，这可能允许攻击者通过覆盖栈中保存的返回地址控制执行流，从而执行任意代码。

<*来源：iDEFENSE

链接：http://www.idefense.com/application/poi/display?id=332&type=vulnerabilities
http://www.debian.org/security/2005/dsa-886
*>

建议：

---

临时解决方法：

* 不要打开不可信任来源的CHM文件。

厂商补丁：

Debian
------
Debian已经为此发布了一个安全公告（DSA-886-1）以及相应补丁:
DSA-886-1：New chmlib packages fix several vulnerabilities
链接：http://www.debian.org/security/2005/dsa-886

补丁下载：
Source archives:

http://security.debian.org/pool/updates/main/c/chmlib/chmlib_0.35-6sarge1.dsc
Size/MD5 checksum: 604 022d55ea43ef4a54648b0823163c4a07
http://security.debian.org/pool/updates/main/c/chmlib/chmlib_0.35-6sarge1.diff.gz
Size/MD5 checksum: 15698 55eeab9a32a66c5e123ab51f3d7427df
http://security.debian.org/pool/updates/main/c/chmlib/chmlib_0.35.orig.tar.gz
Size/MD5 checksum: 368428 8fa0e692b2606a03fb51589f66a82eec

Alpha architecture:

http://security.debian.org/pool/updates/main/c/chmlib/chmlib_0.35-6sarge1_alpha.deb
Size/MD5 checksum: 25688 2471920dc5214b95a44e50e2a8800ada
http://security.debian.org/pool/updates/main/c/chmlib/chmlib-bin_0.35-6sarge1_alpha.deb
Size/MD5 checksum: 18576 0b1d802a79cea68c00d36cd9cb7a36cd
http://security.debian.org/pool/updates/main/c/chmlib/chmlib-dev_0.35-6sarge1_alpha.deb
Size/MD5 checksum: 25544 23306cc3f7b0772f744707c86fa9258a

AMD64 architecture:

http://security.debian.org/pool/updates/main/c/chmlib/chmlib_0.35-6sarge1_amd64.deb
Size/MD5 checksum: 23748 e5a72c3311e7b00d6295a75f7bb37560
http://security.debian.org/pool/updates/main/c/chmlib/chmlib-bin_0.35-6sarge1_amd64.deb
Size/MD5 checksum: 16928 8a2d68579e364a284c03dcc4b9a01e37
http://security.debian.org/pool/updates/main/c/chmlib/chmlib-dev_0.35-6sarge1_amd64.deb
Size/MD5 checksum: 22564 50d2a8d694d1bf7251d18b4f7b02ede7

ARM architecture:

http://security.debian.org/pool/updates/main/c/chmlib/chmlib_0.35-6sarge1_arm.deb
Size/MD5 checksum: 25242 ec14b38be010c3f1fee93dd618124c5e
http://security.debian.org/pool/updates/main/c/chmlib/chmlib-bin_0.35-6sarge1_arm.deb
Size/MD5 checksum: 15962 5e1ec37635078cc29b9f2a4f91f9b20e
http://security.debian.org/pool/updates/main/c/chmlib/chmlib-dev_0.35-6sarge1_arm.deb
Size/MD5 checksum: 24000 bc84ed2d77918f6eb4378f35f43cd4e5

Intel IA-32 architecture:

http://security.debian.org/pool/updates/main/c/chmlib/chmlib_0.35-6sarge1_i386.deb
Size/MD5 checksum: 24872 fbea0ba2924295a9f553c346eeb164af
http://security.debian.org/pool/updates/main/c/chmlib/chmlib-bin_0.35-6sarge1_i386.deb
Size/MD5 checksum: 16094 de94d72e5414d1b218fd32f11cd7351b
http://security.debian.org/pool/updates/main/c/chmlib/chmlib-dev_0.35-6sarge1_i386.deb
Size/MD5 checksum: 22872 3e37bda96c284423f467aecb88e8dc98

Intel IA-64 architecture:

http://security.debian.org/pool/updates/main/c/chmlib/chmlib_0.35-6sarge1_ia64.deb

文章整理：西部数码--专业提供域名注册、虚拟主机服务
http://www.west263.com
以上信息与文章正文是不可分割的一部分,如果您要转载本文章,请保留以上信息，谢谢!