ELinks是一款开放源码的WEB浏览器。 ELinks在处理SMB相关的URL串时存在命令注入漏洞，远程攻击者可能利用此漏洞在用户机器上执行任意命令。 ELinks没有正确验证“smb://”URL串就调用smbclient命令，允许攻击者在上述URL中注入smbclient命令下载和覆盖本地文件或向SMB共享上传文件。漏洞相关代码如下： ----------------------------------------------------------------------------- smb_func() in smb.c: ... 143 if (*share) { 144 if (!*dir || dir[strlen(dir) - 1] == '/' || dir[strlen(dir) - 1] == '\\') { 145 if (dir) { 146 v[n++] = "-D"; 147 v[n++] = dir; 148 } 149 v[n++] = "-c"; 150 v[n++] = "ls"; 151 } else { 152 unsigned char *ss; 153 unsigned char *s = stracpy("get \""); 'dir' is the directory part of the smb://.. url: 154 add_to_strn(&s, dir); 155 add_to_strn(&s, "\" -"); 156 while ((ss = strchr(s, '/'))) *ss = '\\'; 157 v[n++] = "-c"; 158 v[n++] = s; 159 } 160 } 161 v[n++] = NULL; smbclient is executed: 162 execvp("smbclient", (char **)v); 163 fprintf(stderr, "smbclient not found in $PATH"); 164 _exit(1); ......
ELinks是一款开放源码的WEB浏览器。 ELinks在处理SMB相关的URL串时存在命令注入漏洞，远程攻击者可能利用此漏洞在用户机器上执行任意命令。 ELinks没有正确验证“smb://”URL串就调用smbclient命令，允许攻击者在上述URL中注入smbclient命令下载和覆盖本地文件或向SMB共享上传文件。漏洞相关代码如下： ----------------------------------------------------------------------------- smb_func() in smb.c: ... 143 if (*share) { 144 if (!*dir || dir[strlen(dir) - 1] == '/' || dir[strlen(dir) - 1] == '\\') { 145 if (dir) { 146 v[n++] = "-D"; 147 v[n++] = dir; 148 } 149 v[n++] = "-c"; 150 v[n++] = "ls"; 151 } else { 152 unsigned char *ss; 153 unsigned char *s = stracpy("get \""); 'dir' is the directory part of the smb://.. url: 154 add_to_strn(&s, dir); 155 add_to_strn(&s, "\" -"); 156 while ((ss = strchr(s, '/'))) *ss = '\\'; 157 v[n++] = "-c"; 158 v[n++] = s; 159 } 160 } 161 v[n++] = NULL; smbclient is executed: 162 execvp("smbclient", (char **)v); 163 fprintf(stderr, "smbclient not found in $PATH"); 164 _exit(1); ... RedHat Enterprise Linux WS 4 RedHat Enterprise Linux ES 4 RedHat Enterprise Linux Desktop 4 RedHat Enterprise Linux AS 4 ELinks ELinks 防火墙过滤SMB通讯； * 卸载smbclient。 厂商补丁： RedHat ------ RedHat已经为此发布了一个安全公告（RHSA-2006:0742-01）以及相应补丁: RHSA-2006:0742-01：Critical: elinks security update 链接：<a href="http://lwn.net/Alerts/209822/?format=printable" target="_blank">http://lwn.net/Alerts/209822/?format=printable</a>
