ELinks是一款开放源码的WEB浏览器。
ELinks在处理SMB相关的URL串时存在命令注入漏洞，远程攻击者可能利用此漏洞在用户机器上执行任意命令。
ELinks没有正确验证“smb://”URL串就调用smbclient命令，允许攻击者在上述URL中注入smbclient命令下载和覆盖本地文件或向SMB共享上传文件。漏洞相关代码如下：
-----------------------------------------------------------------------------
smb_func() in smb.c:
...
143 if (*share) {
144 if (!*dir || dir[strlen(dir) - 1] == '/'
|| dir[strlen(dir) - 1] == '\\') {
145 if (dir) {
146 v[n++] = "-D";
147 v[n++] = dir;
148 }
149 v[n++] = "-c";
150 v[n++] = "ls";
151 } else {
152 unsigned char *ss;
153 unsigned char *s = stracpy("get
\"");
'dir' is the directory part of the smb://.. url:
154 add_to_strn(&s, dir);
155 add_to_strn(&s, "\" -");
156 while ((ss = strchr(s, '/')))
*ss = '\\';
157 v[n++] = "-c";
158 v[n++] = s;
159 }
160 }
161 v[n++] = NULL;
smbclient is executed:
162 execvp("smbclient", (char **)v);
163 fprintf(stderr, "smbclient not found in $PATH");
164 _exit(1);
...
RedHat Enterprise Linux WS 4
RedHat Enterprise Linux ES 4
RedHat Enterprise Linux Desktop 4
RedHat Enterprise Linux AS 4
ELinks ELinks
防火墙过滤SMB通讯；
* 卸载smbclient。
厂商补丁：
RedHat
------
RedHat已经为此发布了一个安全公告（RHSA-2006:0742-01）以及相应补丁:
RHSA-2006:0742-01：Critical: elinks security update
链接：<a href="http://lwn.net/Alerts/209822/?format=printable" target="_blank">http://lwn.net/Alerts/209822/?format=printable</a>
京公网安备 11010502034610号
暂无评论