Lucene search

RootSSV:2824

HistoryJan 16, 2008 - 12:00 a.m.

libxml2 xmlCurrentChar()函数UTF-8解析远程拒绝服务漏洞

2008-01-1600:00:00

Root

www.seebug.org

EPSS

0.015

Percentile

87.4%

JSON

BUGTRAQ ID: 27248
CVE(CAN) ID: CVE-2007-6284

libxml2软件包提供允许用户操控XML文件的函数库，包含有读、修改和写XML和HTML文件支持。

libxml库在处理包含畸形数据的XML文件时存在漏洞，远程攻击者可能利用此漏洞导致系统不可用。

libxml库的UTF-8解码函数xmlCurrentChar()没有检查UTF-8的正确性，如果用户使用链接到该库的应用程序打开了包含有多字节组合的畸形XML内容的话，就会导致函数库陷入死循环挂起，消耗大量系统资源。

XMLSoft Libxml2 < 2.6.31
Debian

Debian已经为此发布了一个安全公告（DSA-1461-1）以及相应补丁:
DSA-1461-1：New libxml2 packages fix denial of service
链接：<a href=“http://www.debian.org/security/2008/dsa-1461” target=“_blank”>http://www.debian.org/security/2008/dsa-1461</a>

补丁下载：

Source archives:

<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.16-7sarge1.dsc” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.16-7sarge1.dsc</a>
Size/MD5 checksum: 884 991cf7cfdaf3ef05e95ec11f1b99b345
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.16-7sarge1.diff.gz” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.16-7sarge1.diff.gz</a>
Size/MD5 checksum: 127107 b142c10e523b8d72ec427382849f2d39
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.16.orig.tar.gz” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.16.orig.tar.gz</a>
Size/MD5 checksum: 4008551 7b28b412498625b51d86e58e30fbdd31

Architecture independent packages:

<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.16-7sarge1_all.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.16-7sarge1_all.deb</a>
Size/MD5 checksum: 17242 ebfb4ef8a14dec1a34ad62fe6955afef
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-python2.3_2.6.16-7sarge1_all.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-python2.3_2.6.16-7sarge1_all.deb</a>
Size/MD5 checksum: 10850 7a426e3c11a74852fc695612e2bfca25
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-doc_2.6.16-7sarge1_all.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-doc_2.6.16-7sarge1_all.deb</a>
Size/MD5 checksum: 930164 e4458eaa1f1080dfe1745a92c8f667e5

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

Debian 4.0 (stable)

Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg.orig.tar.gz” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg.orig.tar.gz</a>
Size/MD5 checksum: 3416175 5ff71b22f6253a6dd9afc1c34778dec3
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-2.diff.gz” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-2.diff.gz</a>
Size/MD5 checksum: 142579 2bfdb7f543d1bb2c113056ba7c47a8fa
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-2.dsc” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-2.dsc</a>
Size/MD5 checksum: 893 ac5bb60fd79506befb89e6d63bb81d45

Architecture independent packages:

<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-doc_2.6.27.dfsg-2_all.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-doc_2.6.27.dfsg-2_all.deb</a>
Size/MD5 checksum: 1292456 add37f996a875359e75ecae4c9bef721

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

补丁安装方法：

手工安装补丁包：

首先，使用下面的命令来下载补丁软件：

wget url (url是补丁下载链接地址)

然后，使用下面的命令来安装补丁：

dpkg -i file.deb (file是相应的补丁名)

使用apt-get自动安装补丁包：

首先，使用下面的命令更新内部数据库：

apt-get update

然后，使用下面的命令安装更新软件包：

apt-get upgrade

RedHat

RedHat已经为此发布了一个安全公告（RHSA-2008:0032-01）以及相应补丁:
RHSA-2008:0032-01：Important: libxml2 security update
链接：<a href=“https://www.redhat.com/support/errata/RHSA-2008-0032.html” target=“_blank”>https://www.redhat.com/support/errata/RHSA-2008-0032.html</a>

Sun

Sun已经为此发布了一个安全公告（Sun-Alert-103201）以及相应补丁:
Sun-Alert-103201：Security Vulnerability in the libxml2 Library may Lead to a Denial of Service (DoS)
链接：<a href=“http://sunsolve.sun.com/search/printfriendly.do?assetkey=1-26-103201-1” target=“_blank”>http://sunsolve.sun.com/search/printfriendly.do?assetkey=1-26-103201-1</a>