BUGTRAQ ID: 30245 CVE(CAN) ID: CVE-2008-2232 Afuse是使用FUSE在用户域实现的自动加载文件系统。 Afuse没有正确地过滤文件名便将其用在了system()调用中。如果能够读访问afuse文件系统的攻击者使用了类似于以下的路径的话： /path/";arbitrary command;" /path/`arbitrary command` 则从注册为Afuse加载的目录请求上述特制文件就会导致以提升的权限执行任意命令。 Jacob Bower Afuse 0.2 Debian ------ Debian已经为此发布了一个安全公告（DSA-1611-1）以及相应补丁: DSA-1611-1：New afuse packages fix privilege escalation 链接：<a href=http://www.debian.org/security/2008/dsa-1611 target=_blank>http://www.debian.org/security/2008/dsa-1611</a> 补丁下载： Source archives: <a href=http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1.diff.gz target=_blank>http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1.diff.gz</a> Size/MD5 checksum: 3699 645246f8f338b76b6d6785fff9997c5a <a href=http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1.dsc target=_blank>http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1.dsc</a> Size/MD5 checksum: 657...
BUGTRAQ ID: 30245 CVE(CAN) ID: CVE-2008-2232 Afuse是使用FUSE在用户域实现的自动加载文件系统。 Afuse没有正确地过滤文件名便将其用在了system()调用中。如果能够读访问afuse文件系统的攻击者使用了类似于以下的路径的话： /path/";arbitrary command;" /path/`arbitrary command` 则从注册为Afuse加载的目录请求上述特制文件就会导致以提升的权限执行任意命令。 Jacob Bower Afuse 0.2 Debian ------ Debian已经为此发布了一个安全公告（DSA-1611-1）以及相应补丁: DSA-1611-1：New afuse packages fix privilege escalation 链接：<a href=http://www.debian.org/security/2008/dsa-1611 target=_blank>http://www.debian.org/security/2008/dsa-1611</a> 补丁下载： Source archives: <a href=http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1.diff.gz target=_blank>http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1.diff.gz</a> Size/MD5 checksum: 3699 645246f8f338b76b6d6785fff9997c5a <a href=http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1.dsc target=_blank>http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1.dsc</a> Size/MD5 checksum: 657 fe408099626f3bad3bc68d2717df2a9b <a href=http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1.orig.tar.gz target=_blank>http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1.orig.tar.gz</a> Size/MD5 checksum: 98171 95cce7d6ed8e984d0ff2d650e6beb167 alpha architecture (DEC Alpha) <a href=http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_alpha.deb target=_blank>http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_alpha.deb</a> Size/MD5 checksum: 15476 465baebb172ecda5ed1e7bdd174fddac amd64 architecture (AMD x86_64 (AMD64)) <a href=http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_amd64.deb target=_blank>http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_amd64.deb</a> Size/MD5 checksum: 14224 5e5dca72cb191bf0d435f770c62e07f5 arm architecture (ARM) <a href=http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_arm.deb target=_blank>http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_arm.deb</a> Size/MD5 checksum: 12448 f39bc75bceec2e8979a514bda07164d6 hppa architecture (HP PA RISC) <a href=http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_hppa.deb target=_blank>http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_hppa.deb</a> Size/MD5 checksum: 14602 603022ee85f781d0c8c155936d432484 i386 architecture (Intel ia32) <a href=http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_i386.deb target=_blank>http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_i386.deb</a> Size/MD5 checksum: 13086 b422ac9cb737dd1fb7827eb6ea222bba ia64 architecture (Intel ia64) <a href=http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_ia64.deb target=_blank>http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_ia64.deb</a> Size/MD5 checksum: 17730 9fc41e69a8df1ddee15831b971ededb1 mips architecture (MIPS (Big Endian)) <a href=http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_mips.deb target=_blank>http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_mips.deb</a> Size/MD5 checksum: 14232 69ebaa63e04dd9a16ad8ff5a772dc576 mipsel architecture (MIPS (Little Endian)) <a href=http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_mipsel.deb target=_blank>http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_mipsel.deb</a> Size/MD5 checksum: 14282 9dabd8530851c9588c4927f53cf923d2 powerpc architecture (PowerPC) <a href=http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_powerpc.deb target=_blank>http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_powerpc.deb</a> Size/MD5 checksum: 13582 c6c86e8600353b4ff4ed66c9608fd7d0 s390 architecture (IBM S/390) <a href=http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_s390.deb target=_blank>http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_s390.deb</a> Size/MD5 checksum: 14154 b36cc8bab5a28d13430a18697bb4b85c sparc architecture (Sun SPARC/UltraSPARC) <a href=http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_sparc.deb target=_blank>http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_sparc.deb</a> Size/MD5 checksum: 12562 ff0fd7531cc011d032f74c78ae17ca0e 补丁安装方法： 1. 手工安装补丁包： 首先，使用下面的命令来下载补丁软件： # wget url (url是补丁下载链接地址) 然后，使用下面的命令来安装补丁： # dpkg -i file.deb (file是相应的补丁名) 2. 使用apt-get自动安装补丁包： 首先，使用下面的命令更新内部数据库： # apt-get update 然后，使用下面的命令安装更新软件包： # apt-get upgrade
