libxslt XSL文件处理缓冲区溢出漏洞

2008-05-2900:00:00

Root

www.seebug.org

EPSS

0.018

Percentile

88.1%

JSON

BUGTRAQ ID: 29312
CVE(CAN) ID: CVE-2008-1767

Libxslt是为GNOME项目开发的XSLT C库，XSLT本身是用于定义XML转换的XML语言。

libxslt库在转换XML文档期间使用的固定大小的数组，如果XSL样式表文件中设置了特定的template match条件的话，则使用该库的应用程序在解析文件时会触发缓冲区溢出，导致应用程序崩溃或执行任意指令。

XMLSoft libxslt < 1.1.24
Debian

Debian已经为此发布了一个安全公告（DSA-1589-1）以及相应补丁:
DSA-1589-1：New libxslt packages fix execution of arbitrary code
链接：<a href=“http://www.debian.org/security/2008/dsa-1589” target=“_blank”>http://www.debian.org/security/2008/dsa-1589</a>

补丁下载：

Source archives:

<a href=“http://security.debian.org/pool/updates/main/libx/libxslt/libxslt_1.1.19.orig.tar.gz” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxslt/libxslt_1.1.19.orig.tar.gz</a>
Size/MD5 checksum: 2799906 622e5843167593c8ea39bf86c66b8fcf
<a href=“http://security.debian.org/pool/updates/main/libx/libxslt/libxslt_1.1.19-2.dsc” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxslt/libxslt_1.1.19-2.dsc</a>
Size/MD5 checksum: 849 27df832e1c58fa0b4ee2fc08ae23eb52
<a href=“http://security.debian.org/pool/updates/main/libx/libxslt/libxslt_1.1.19-2.diff.gz” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxslt/libxslt_1.1.19-2.diff.gz</a>
Size/MD5 checksum: 149924 3135ddae6ed99518ca98cb6dd32f9cf5

alpha architecture (DEC Alpha)

<a href=“http://security.debian.org/pool/updates/main/libx/libxslt/xsltproc_1.1.19-2_alpha.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxslt/xsltproc_1.1.19-2_alpha.deb</a>
Size/MD5 checksum: 107220 cb23c0170e99f97ba4a6328b6c15d4e8
<a href=“http://security.debian.org/pool/updates/main/libx/libxslt/python-libxslt1_1.1.19-2_alpha.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxslt/python-libxslt1_1.1.19-2_alpha.deb</a>
Size/MD5 checksum: 131268 264ec9a09e6fd46eb6acb82b6e2e458f
<a href=“http://security.debian.org/pool/updates/main/libx/libxslt/libxslt1-dev_1.1.19-2_alpha.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxslt/libxslt1-dev_1.1.19-2_alpha.deb</a>
Size/MD5 checksum: 690048 6af24b16a70e3eda53cf9b01aeb72abe
<a href=“http://security.debian.org/pool/updates/main/libx/libxslt/libxslt1-dbg_1.1.19-2_alpha.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxslt/libxslt1-dbg_1.1.19-2_alpha.deb</a>
Size/MD5 checksum: 362862 b0bfc373c7b2b029bdecc32fe3c6b393
<a href=“http://security.debian.org/pool/updates/main/libx/libxslt/libxslt1.1_1.1.19-2_alpha.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxslt/libxslt1.1_1.1.19-2_alpha.deb</a>
Size/MD5 checksum: 230516 c613baf2799aca2b10f704c72d65f6dd

amd64 architecture (AMD x86_64 (AMD64))

<a href=“http://security.debian.org/pool/updates/main/libx/libxslt/python-libxslt1_1.1.19-2_amd64.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxslt/python-libxslt1_1.1.19-2_amd64.deb</a>
Size/MD5 checksum: 131736 bd359cba79ae664919f1d28bb7ee7bb9
<a href=“http://security.debian.org/pool/updates/main/libx/libxslt/libxslt1-dev_1.1.19-2_amd64.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxslt/libxslt1-dev_1.1.19-2_amd64.deb</a>
Size/MD5 checksum: 630600 9f2ce6f099ad058ddb7756c6bec0ad04
<a href=“http://security.debian.org/pool/updates/main/libx/libxslt/libxslt1.1_1.1.19-2_amd64.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxslt/libxslt1.1_1.1.19-2_amd64.deb</a>
Size/MD5 checksum: 225362 6fad243b75ab8773edac788ae83ff0b2
<a href=“http://security.debian.org/pool/updates/main/libx/libxslt/xsltproc_1.1.19-2_amd64.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxslt/xsltproc_1.1.19-2_amd64.deb</a>
Size/MD5 checksum: 106520 86122035aa23a3ac883a90f2ad206cb3
<a href=“http://security.debian.org/pool/updates/main/libx/libxslt/libxslt1-dbg_1.1.19-2_amd64.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxslt/libxslt1-dbg_1.1.19-2_amd64.deb</a>
Size/MD5 checksum: 360490 43bf746a2e2d510dc2b42bce0ebfe846

arm architecture (ARM)

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

<a href=“http://security.debian.org/pool/updates/main/libx/libxslt/libxslt1.1_1.1.19-2_i386.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxslt/libxslt1.1_1.1.19-2_i386.deb</a>
Size/MD5 checksum: 215768 065db1534d256efaa0bdbed1d5bc2efa
<a href=“http://security.debian.org/pool/updates/main/libx/libxslt/xsltproc_1.1.19-2_i386.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxslt/xsltproc_1.1.19-2_i386.deb</a>
Size/MD5 checksum: 106010 d736922f8f98e3655e0d17c47c182911
<a href=“http://security.debian.org/pool/updates/main/libx/libxslt/libxslt1-dev_1.1.19-2_i386.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxslt/libxslt1-dev_1.1.19-2_i386.deb</a>
Size/MD5 checksum: 610254 7d2f1de6b328363d404e0167b2c3d0b2
<a href=“http://security.debian.org/pool/updates/main/libx/libxslt/python-libxslt1_1.1.19-2_i386.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxslt/python-libxslt1_1.1.19-2_i386.deb</a>
Size/MD5 checksum: 127542 036211c64911322aad9f5afa3c67a8ce
<a href=“http://security.debian.org/pool/updates/main/libx/libxslt/libxslt1-dbg_1.1.19-2_i386.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxslt/libxslt1-dbg_1.1.19-2_i386.deb</a>
Size/MD5 checksum: 350172 fbd79c2f46affc6a6daea73b95c5fe4c

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

补丁安装方法：

手工安装补丁包：

首先，使用下面的命令来下载补丁软件：

wget url (url是补丁下载链接地址)

然后，使用下面的命令来安装补丁：

dpkg -i file.deb (file是相应的补丁名)

使用apt-get自动安装补丁包：

首先，使用下面的命令更新内部数据库：

apt-get update

然后，使用下面的命令安装更新软件包：

apt-get upgrade

RedHat

RedHat已经为此发布了一个安全公告（RHSA-2008:0287-01）以及相应补丁:
RHSA-2008:0287-01：Important: libxslt security update
链接：<a href=“https://www.redhat.com/support/errata/RHSA-2008-0287.html” target=“_blank”>https://www.redhat.com/support/errata/RHSA-2008-0287.html</a>

XMLSoft

目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

<a href=“http://bugzilla.gnome.org/attachment.cgi?id=109216&action=view” target=“_blank”>http://bugzilla.gnome.org/attachment.cgi?id=109216&action=view</a>
<a href=“http://svn.gnome.org/viewvc/libxslt/trunk/libxslt/pattern.c?r1=1469&r2=1468&pathrev=1469” target=“_blank”>http://svn.gnome.org/viewvc/libxslt/trunk/libxslt/pattern.c?r1=1469&r2=1468&pathrev=1469</a>


                                                &lt;xsl:stylesheet&nbsp;xmlns:xsl=&quot;http://www.w3.org/1999/XSL/Transform&quot;&nbsp;version=&quot;1.0&quot;&gt;
&lt;xsl:output&nbsp;method=&quot;xml&quot;/&gt;

&lt;xsl:template
match=&quot;html/body/table/tr/td/div/di