CVE:CVE-2003-0466
CNNVD:CNNVD-200308-136
realpath(3)函数用于在给出的路径名中判断规则的绝对路径名，给出的路径名可能包含``/''字符， 并涉及到如``/./'' 或``/../''、符号连接等，realpath(3)函数是FreeBSD标准C语言库文件的一部分。
realpath(3)函数在计算解析获得的路径名长度时存在单字节溢出问题，本地或者远程攻击者可以利用这个漏洞对利用此函数的服务进行缓冲区溢出攻击，可以以进程权限在系统上执行任意指令。
如果解析获得的路径名是1024字节长，并包含两个目录分割符，缓冲区传递给realpath(3)函数时就可以被单NUL字节覆盖。一般使用realpath(3)函数的应用程序可产生拒绝服务，或者执行任意代码和权限提升攻击。
在FreeBSD系统中，多个应用程序使用了realpath(3)函数，如：
lukemftpd(8)是一个变种FTP服务器，realpath(3)用于处理MLST和MLSD命令，这个漏洞可被利用以超级用户权限执行任意代码。
sftp-server(8)是OpenSSH的一部分，realpath(3)用于处理chdir命令，这个漏洞可被利用以验证用户权限执行任意代码。
在FreeBSD 4.8-RELEASE的版本中，FreeBSD的PORT集包含如下应用程序使用了realpath(3)，不过没有审核是否存在此漏洞，或者可以被利用：
BitchX-1.0c19_1
Mowitz-0.2.1_1
XFree86-clients-4.3.0_1
abcache-0.14
aim-1.5.234
analog-5.24，1
anjuta-1.0.1_1
aolserver-3.4.2
argus-2.0.5
arm-rtems-gdb-5.2_1
avr-gdb-5.2.1
ccache-2.1.1
cdparanoia-3.9.8_4
cfengine-1.6.3_4
cfengine2-2.0.3
cmake-1.4.7
comserv-1.4.3
criticalmass-0.97
dedit-0.6.2.3_1
drweb_postfix-4.29.10a
drweb-4.29.2
drweb_sendmail-4.29.10a
edonkey-gui-gtk-0.5.0
enca-0.10.7
epic4-1.0.1_2
evolution-1.2.2_1
exim-3.36_1
exim-4.12_5
exim-ldap-4.12_5
exim-ldap2-4.12_5
exim-mysql-4.12_5
exim-postgresql-4.12_5
fam-2.6.9_2
fastdep-0.15
feh-1.2.4_1
ferite-0.99.6
fileutils-4.1_1
finfo-0.1
firebird-1.0.2
firebird-1.0.r2
frontpage-5.0.2.2623_1
galeon-1.2.8
galeon2-1.3.2_1
gdb-5.3_20030311
gdb-5.2.1_1
gdm2-2.4.1.3
gecc-20021119
gentoo-0.11.34
gkrellmvolume-2.1.7
gltron-0.61
global-4.5.1
gnat-3.15p
gnomelibs-1.4.2_1
gprolog-1.2.16
gracula-3.0
gringotts-1.2.3
gtranslator-0.43_1
gvd-1.2.5
hercules-2.16.5
hte-0.7.0
hugs98-200211
i386-rtems-gdb-5.2_1
i960-rtems-gdb-5.2_1
installwatch-0.5.6
ivtools-1.0.6
ja-epic4-1.0.1_2
ja-gnomelibs-1.4.2_1
ja-msdosfs-20001027
ja-samba-2.2.7a.j1.1_1
kdebase-3.1_1
kdelibs-3.1
kermit-8.0.206
ko-BitchX-1.0c16_3
ko-msdosfs-20001027
leocad-0.73
libfpx-1.2.0.4_1
libgnomeui-2.2.0.1
libpdel-0.3.4
librep-0.16.1_1
linux-beonex-0.8.1
linux-divxplayer-0.2.0
linux-edonkey-gui-gtk-0.2.0.a.2002.02.22
linux-gnomelibs-1.2.8_2
linux-mozilla-1.2
linux-netscape-communicator-4.8
linux-netscape-navigator-4.8
linux-phoenix-0.3
linux_base-6.1_4
linux_base-7.1_2
lsh-1.5.1
lukemftpd-1.1_1
m68k-rtems-gdb-5.2_1
mips-rtems-gdb-5.2_1
mod_php4-4.3.1
moscow_ml-2.00_1
mozilla-1.0.2_1
mozilla-1.2.1_1，2
mozilla-1.2.1_2
mozilla-1.3b，1
mozilla-1.3b
mozilla-embedded-1.0.2_1
mozilla-embedded-1.2.1_1，2
mozilla-embedded-1.3b，1
msyslog-1.08f_1
netraider-0.0.2
openag-1.1.1_1
openssh-portable-3.5p1_1
openssh-3.5
p5-PPerl-0.23
paragui-1.0.2_2
powerpc-rtems-gdb-5.2_1
psim-freebsd-5.2.1
ptypes-1.7.4
pure-ftpd-1.0.14
qiv-1.8
readlink-20010616
reed-5.4
rox-1.3.6_1
rox-session-0.1.18_1
rpl-1.4.0
rpm-3.0.6_6
samba-2.2.8
samba-3.0a20
scrollkeeper-0.3.11_8，1
sh-rtems-gdb-5.2_1
sharity-light-1.2_1
siag-3.4.10
skipstone-0.8.3
sparc-rtems-gdb-5.2_1
squeak-2.7
squeak-3.2
swarm-2.1.1
tcl-8.2.3_2
tcl-8.3.5
tcl-8.4.1，1
tcl-thread-8.1.b1
teTeX-2.0.2_1
wine-2003.02.19
wml-2.0.8
worker-2.7.0
xbubble-0.2
xerces-c2-2.1.0_1
xerces_c-1.7.0
xnview-1.50
xscreensaver-gnome-4.08
xscreensaver-4.08
xworld-2.0
yencode-0.46_1
zh-cle_base-0.9p1
zh-tcl-8.3.0
zh-tw-BitchX-1.0c19_3
zh-ve-1.0
zh-xemacs-20.4_1
solution:Upgrade redhat wu_ftpd to a higher version than 2.6.1-16,2.6.1-18,2.6.2-5,2.6.2-8,and avoid the version 2.6.1-16,2.6.1-18,2.6.2-5,2.6.2-8; Upgrade washington_university wu-ftpd to a higher version than 2.5.0,2.6.0,2.6.1,2.6.2,and avoid the version 2.5.0,2.6.0,2.6.1,2.6.2; Upgrade apple mac_os_x to a higher version than 10.2.6,and avoid the version 10.2.6; Upgrade apple mac_os_x_server to a higher version than 10.2.6,and avoid the version 10.2.6; Upgrade freebsd freebsd to a higher version than 4.0,4.0:alpha,4.1,4.1.1,4.1.1:release,4.1.1:stable,4.2,4.2:stable,4.3,4.3:release,4.3:releng,4.3:stable,4.4,4.4:releng,4.4:stable,4.5,4.5:release,4.5:stable,4.6,4.6:release,4.6:stable,4.6.2,4.7,4.7:release,4.7:stable,4.8,4.8:pre-release,5.0,5.0:alpha,and avoid the version 4.0,4.0:alpha,4.1,4.1.1,4.1.1:release,4.1.1:stable,4.2,4.2:stable,4.3,4.3:release,4.3:releng,4.3:stable,4.4,4.4:releng,4.4:stable,4.5,4.5:release,4.5:stable,4.6,4.6:release,4.6:stable,4.6.2,4.7,4.7:release,4.7:stable,4.8,4.8:pre-release,5.0,5.0:alpha; Upgrade netbsd netbsd to a higher version than 1.5,1.5.1,1.5.2,1.5.3,1.6,1.6.1,and avoid the version 1.5,1.5.1,1.5.2,1.5.3,1.6,1.6.1; Upgrade openbsd openbsd to a higher version than 2.0,2.1,2.2,2.3,2.4,2.5,2.6,2.7,2.8,2.9,3.0,3.1,3.2,3.3,and avoid the version 2.0,2.1,2.2,2.3,2.4,2.5,2.6,2.7,2.8,2.9,3.0,3.1,3.2,3.3; Upgrade sun solaris to a higher version than 9.0,and avoid the version 9.0