CVE:CVE-2003-0028
CNNVD:CNNVD-200303-077
XDR(外部数据表示)库用来提供一种平台无关的方法来将数据从一个系统进程发送给其他系统进程。Sun Microsystems提供的XDR库中包含的xdrmem_getbytes()函数存在一个整数溢出 ，远程攻击者利用这个漏洞对使用XDR库的应用程序进行攻击，可能以应用程序进程权限在系统上执行任意指令。问题存在于'usr/src/lib/libnsl/rpc/xdr_mem.c'的168行的xdrmem_getbytes()函数：static bool_txdrmem_getbytes(XDR *xdrs， caddr_t addr， int len){        int tmp;        trace2(TR_xdrmem_getbytes， 0， len);        if ((tmp = (xdrs->x_handy - len)) < 0) { <--- VULNERABILITY                syslog(LOG_WARNING，                                .....                                .....                             return (FALSE);        }        xdrs->x_handy = tmp;        (void) memcpy(addr， xdrs->x_private， len); <--- VULNERABILITY        xdrs->x_private += len;        trace1(TR_xdrmem_getbytes， 1);        return (TRUE);}上面代码中"len"是有符号整数，因此如果"len"为负数就会导致缓冲区溢出：if ((tmp = (xdrs->x_handy - len)) < 0) {  -->这个检查会绕过但是在memcpy(addr， xdrs->x_private， len);处理时就会导致溢出。攻击者可以构造一个特殊的XDR编码来触发整数溢出，依赖于使用者如何调用xdrmem_getbytes()函数，攻击者可能覆盖一个已经分配的堆区缓冲区，造成堆缓冲区溢出。攻击者可能造成远程服务崩溃或者利用memcpy()实现的一些特点来改变内存数据并执行任意代码。
solution:Upgrade gnu glibc to a higher version than 2.1,2.1.1,2.1.2,2.1.3,2.2,2.2.1,2.2.2,2.2.3,2.2.4,2.2.5,2.3,2.3.1,2.3.2,and avoid the version 2.1,2.1.1,2.1.2,2.1.3,2.2,2.2.1,2.2.2,2.2.3,2.2.4,2.2.5,2.3,2.3.1,2.3.2; Upgrade mit kerberos_5 to a higher version than 1.2,1.2.1,1.2.2,1.2.3,1.2.4,1.2.5,1.2.6,1.2.7,and avoid the version 1.2,1.2.1,1.2.2,1.2.3,1.2.4,1.2.5,1.2.6,1.2.7; Upgrade openafs openafs to a higher version than 1.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.4a,1.1,1.1.1,1.1.1a,1.2,1.2.1,1.2.2,1.2.2a,1.2.2b,1.2.3,1.2.4,1.2.5,1.2.6,1.3,1.3.1,1.3.2,and avoid the version 1.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.4a,1.1,1.1.1,1.1.1a,1.2,1.2.1,1.2.2,1.2.2a,1.2.2b,1.2.3,1.2.4,1.2.5,1.2.6,1.3,1.3.1,1.3.2; Upgrade sgi irix to a higher version than 6.5,6.5.1,6.5.2,6.5.2f,6.5.2m,6.5.3,6.5.3f,6.5.3m,6.5.4,6.5.4f,6.5.4m,6.5.5,6.5.5f,6.5.5m,6.5.6,6.5.6f,6.5.6m,6.5.7,6.5.7f,6.5.7m,6.5.8,6.5.8f,6.5.8m,6.5.9,6.5.9f,6.5.9m,6.5.10,6.5.10f,6.5.10m,6.5.11,6.5.11f,6.5.11m,6.5.12,6.5.12f,6.5.12m,6.5.13,6.5.13f,6.5.13m,6.5.14,6.5.14f,6.5.14m,6.5.15,6.5.15f,6.5.15m,6.5.16,6.5.16f,6.5.16m,6.5.17,6.5.17f,6.5.17m,6.5.18,6.5.18f,6.5.18m,6.5.19,6.5.20,and avoid the version 6.5,6.5.1,6.5.2,6.5.2f,6.5.2m,6.5.3,6.5.3f,6.5.3m,6.5.4,6.5.4f,6.5.4m,6.5.5,6.5.5f,6.5.5m,6.5.6,6.5.6f,6.5.6m,6.5.7,6.5.7f,6.5.7m,6.5.8,6.5.8f,6.5.8m,6.5.9,6.5.9f,6.5.9m,6.5.10,6.5.10f,6.5.10m,6.5.11,6.5.11f,6.5.11m,6.5.12,6.5.12f,6.5.12m,6.5.13,6.5.13f,6.5.13m,6.5.14,6.5.14f,6.5.14m,6.5.15,6.5.15f,6.5.15m,6.5.16,6.5.16f,6.5.16m,6.5.17,6.5.17f,6.5.17m,6.5.18,6.5.18f,6.5.18m,6.5.19,6.5.20; Upgrade cray unicos to a higher version than 6.0,6.0e,6.1,7.0,8.0,8.3,9.0,9.0.2.5,9.2,9.2.4,and avoid the version 6.0,6.0e,6.1,7.0,8.0,8.3,9.0,9.0.2.5,9.2,9.2.4; Upgrade freebsd freebsd to a higher version than 4.0,4.1,4.1.1,4.1.1:release,4.1.1:stable,4.2,4.2:stable,4.3,4.3:release,4.3:stable,4.4,4.4:stable,4.5,4.5:release,4.5:stable,4.6,4.6:release,4.6:stable,4.6.2,4.7,4.7:release,4.7:stable,5.0,and avoid the version 4.0,4.1,4.1.1,4.1.1:release,4.1.1:stable,4.2,4.2:stable,4.3,4.3:release,4.3:stable,4.4,4.4:stable,4.5,4.5:release,4.5:stable,4.6,4.6:release,4.6:stable,4.6.2,4.7,4.7:release,4.7:stable,5.0; Upgrade hp hp-ux to a higher version than 10.20,10.24,11.00,11.04,11.11,11.20,11.22,and avoid the version 10.20,10.24,11.00,11.04,11.11,11.20,11.22; Upgrade hp hp-ux_series_700 to a higher version than 10.20,and avoid the version 10.20; Upgrade hp hp-ux_series_800 to a higher version than 10.20,and avoid the version 10.20; Upgrade ibm aix to a higher version than 4.3.3,5.1,5.2,and avoid the version 4.3.3,5.1,5.2; Upgrade openbsd openbsd to a higher version than 2.0,2.1,2.2,2.3,2.4,2.5,2.6,2.7,2.8,2.9,3.0,3.1,3.2,and avoid the version 2.0,2.1,2.2,2.3,2.4,2.5,2.6,2.7,2.8,2.9,3.0,3.1,3.2; Upgrade sun solaris to a higher version than 2.5.1,2.6,7.0,8.0,9.0,and avoid the version 2.5.1,2.6,7.0,8.0,9.0; Upgrade sun sunos to a higher version than -,5.5.1,5.7,5.8,and avoid the version 5.5.1,5.7,5.8