libxslt RC4加密/解密函数堆溢出漏洞

2008-08-0300:00:00

Root

www.seebug.org

0.226 Low

EPSS

Percentile

96.0%

JSON

BUGTRAQ ID: 30467
CVE(CAN) ID: CVE-2008-2935

Libxslt是为GNOME项目开发的XSLT C库，XSLT本身是用于定义XML转换的XML语言。

Libxslt库的crypto.c文件中crypto:rc4_encrypt函数错误的信任了密钥字符串的长度：

static void
exsltCryptoRc4EncryptFunction (xmlXPathParserContextPtr ctxt, int nargs) {
…
key = xmlXPathPopString (ctxt);
key_len = xmlUTF8Strlen (str);
…
padkey = xmlMallocAtomic (RC4_KEY_LENGTH);
key_size = xmlUTF8Strsize (key, key_len);
memcpy (padkey, key, key_size);
memset (padkey + key_size, ‘\0’, sizeof (padkey));
…

padkey堆分配是固定的128位（RC4_KEY_LENGTH），但却从XSL函数参数拷贝了任意长度的字符串，带有超长输入的XML文件就可以触发堆溢出，导致执行任意指令。

XMLSoft libxslt 1.1.24
Debian

Debian已经为此发布了一个安全公告（DSA-1624-1）以及相应补丁:
DSA-1624-1：New libxslt packages fix arbitrary code execution
链接：<a href=“http://www.debian.org/security/2008/dsa-1624” target=“_blank”>http://www.debian.org/security/2008/dsa-1624</a>

补丁下载：

Source archives:

<a href=“http://security.debian.org/pool/updates/main/libx/libxslt/libxslt_1.1.19.orig.tar.gz” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxslt/libxslt_1.1.19.orig.tar.gz</a>
Size/MD5 checksum: 2799906 622e5843167593c8ea39bf86c66b8fcf
<a href=“http://security.debian.org/pool/updates/main/libx/libxslt/libxslt_1.1.19-3.diff.gz” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxslt/libxslt_1.1.19-3.diff.gz</a>
Size/MD5 checksum: 149686 b62a7dd0aa648576a266cd20d634c216
<a href=“http://security.debian.org/pool/updates/main/libx/libxslt/libxslt_1.1.19-3.dsc” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxslt/libxslt_1.1.19-3.dsc</a>
Size/MD5 checksum: 849 7d98fdda0079574b360d4a6e2a12e2be

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

<a href=“http://security.debian.org/pool/updates/main/libx/libxslt/libxslt1-dbg_1.1.19-3_amd64.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxslt/libxslt1-dbg_1.1.19-3_amd64.deb</a>
Size/MD5 checksum: 362484 c91d2d5458f6de4002b4401f5675b742
<a href=“http://security.debian.org/pool/updates/main/libx/libxslt/libxslt1.1_1.1.19-3_amd64.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxslt/libxslt1.1_1.1.19-3_amd64.deb</a>
Size/MD5 checksum: 225658 6d4a52da7c2ca5a4280b06bdf03875e0
<a href=“http://security.debian.org/pool/updates/main/libx/libxslt/libxslt1-dev_1.1.19-3_amd64.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxslt/libxslt1-dev_1.1.19-3_amd64.deb</a>
Size/MD5 checksum: 630884 06616b7e52d2fc80530302c7d3acd540
<a href=“http://security.debian.org/pool/updates/main/libx/libxslt/xsltproc_1.1.19-3_amd64.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxslt/xsltproc_1.1.19-3_amd64.deb</a>
Size/MD5 checksum: 106562 7782d3653528b848ce1d98455f790196
<a href=“http://security.debian.org/pool/updates/main/libx/libxslt/python-libxslt1_1.1.19-3_amd64.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxslt/python-libxslt1_1.1.19-3_amd64.deb</a>
Size/MD5 checksum: 131782 8e9ed3c7418725e1853ae5ccbd082c9b

arm architecture (ARM)

hppa architecture (HP PA RISC)

<a href=“http://security.debian.org/pool/updates/main/libx/libxslt/libxslt1-dev_1.1.19-3_hppa.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxslt/libxslt1-dev_1.1.19-3_hppa.deb</a>
Size/MD5 checksum: 659318 c0f64453ca8cb8dbe9f3970cf157b3ab
<a href=“http://security.debian.org/pool/updates/main/libx/libxslt/libxslt1.1_1.1.19-3_hppa.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxslt/libxslt1.1_1.1.19-3_hppa.deb</a>
Size/MD5 checksum: 238420 a7c8f14314bdb82fc51ec1578f4efad3
<a href=“http://security.debian.org/pool/updates/main/libx/libxslt/xsltproc_1.1.19-3_hppa.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxslt/xsltproc_1.1.19-3_hppa.deb</a>
Size/MD5 checksum: 107274 3fc49ac897c34e339b3f496700bdfd5e
<a href=“http://security.debian.org/pool/updates/main/libx/libxslt/python-libxslt1_1.1.19-3_hppa.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxslt/python-libxslt1_1.1.19-3_hppa.deb</a>
Size/MD5 checksum: 132222 3f4dc4e5f1162e819bc534c610fad3dc
<a href=“http://security.debian.org/pool/updates/main/libx/libxslt/libxslt1-dbg_1.1.19-3_hppa.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxslt/libxslt1-dbg_1.1.19-3_hppa.deb</a>
Size/MD5 checksum: 360748 a8c4ae1c8f2e8c348c852a0931f762c5

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

补丁安装方法：

手工安装补丁包：

首先，使用下面的命令来下载补丁软件：

wget url (url是补丁下载链接地址)

然后，使用下面的命令来安装补丁：

dpkg -i file.deb (file是相应的补丁名)

使用apt-get自动安装补丁包：

首先，使用下面的命令更新内部数据库：

apt-get update

然后，使用下面的命令安装更新软件包：

apt-get upgrade

RedHat

RedHat已经为此发布了一个安全公告（RHSA-2008:0649-01）以及相应补丁:
RHSA-2008:0649-01：Moderate: libxslt security update
链接：<a href=“https://www.redhat.com/support/errata/RHSA-2008-0649.html” target=“_blank”>https://www.redhat.com/support/errata/RHSA-2008-0649.html</a>

XMLSoft

目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

<a href=“http://www.ocert.org/patches/exslt_crypt.patch” target=“_blank”>http://www.ocert.org/patches/exslt_crypt.patch</a>


                                                &lt;xsl:stylesheet version=&quot;1.0&quot;
xmlns:xsl=&quot;http://www.w3.org/1999/XSL/Transform&quot;
xmlns:str=&quot;http://exslt.org/strings&quot;
xmlns:crypto=&quot;http://exslt.org/crypto&quot;
xmlns:math=&quot;http://exslt.org/math&quot;
ex