Streamripper HTTP头解析远程缓冲区溢出漏洞

https://www.securityfocus.com/bid/25278
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200708-222

StreamRipper能够将网上的MP3流媒体保存到硬盘中，特别适合录制网络MP3广播。StreamRipper中用于解析HTTP头的代码中存在多个缓冲区溢出漏洞，远程攻击者可能利用此漏洞控制用户系统。具体位于lib/http.c文件httplib_parse_sc_header()函数的324行：extract_header_value()函数是通过Location:字符串调用的。lib/http.c...extract_header_value(header,info->http_location,"Location:");...intextract_header_value(char*header,char*dest,char*match){char*start=(char*)strstr(header,match);if(start){subnstr_until(start+strlen(match),"\n",dest,MAX_ICY_STRING);return1;}else{return0;}}...lib/mchar.c...char*subnstr_until(constchar*str,char*until,char*newstr,intmaxlen){constchar*p=str;intlen=0;for(len=0;strncmp(p,until,strlen(until))!=0&&len<maxlen;p++){newstr[len]=*p;len++;}newstr[len]='\0';returnnewstr;}...extract_header_value()假设info->http_location大小为MAX_ICY_STRING(4024)字节，但实际仅为MAX_HOST_LEN(512)字节；对仅有MAX_SERVER_LEN(1024)字节的HTTP头字符串Server:也做了同样的假设。如果用户受骗连接到了恶意的服务器的话，就可能触发缓冲区溢出，导致执行任意指令。

Streamripper Streamripper 1.62.1 Streamripper Streamripper 1.62 Streamripper Streamripper 1.61.26 Streamripper Streamripper 1.61.25 Streamripper Streamripper 1.61.24 Stre

来源:sourceforge.net
链接:http://sourceforge.net/project/shownotes.php?group_id=6172&release_id=531738
来源:SECTRACK
名称:1018553
链接:http://www.securitytracker.com/id?1018553
来源:BID
名称:25278
链接:http://www.securityfocus.com/bid/25278
来源:BUGTRAQ
名称:20070812Streamripper1.62.1-BufferOverflows
链接:http://www.securityfocus.com/archive/1/archive/1/476302/100/0/threaded
来源:VUPEN
名称:ADV-2007-2858
链接:http://www.frsirt.com/english/advisories/2007/2858
来源:DEBIAN
名称:DSA-1683
链接:http://www.debian.org/security/2008/dsa-1683
来源:streamripper.cvs.sourceforge.net
链接:http://streamripper.cvs.sourceforge.net/streamripper/sripper_1x/lib/http.c?r1=1.38&r2=1.39
来源:GENTOO
名称:GLSA-200709-03
链接:http://security.gentoo.org/glsa/glsa-200709-03.xml
来源:SECUNIA
名称:33061
链接:http://secunia.com/advisories/33061
来源:SECUNIA
名称:33052
链接:http://secunia.com/advisories/33052
来源:SECUNIA
名称:26814
链接:http://secunia.com/advisories/26814
来源:SECUNIA
名称:26406
链接:http://secunia.com/advisories/26406
来源:OSVDB
名称:39533
链接:http://osvdb.org/39533