Login
Login-Name Passwort


 
Newsletter
Werbung

Sicherheit: Ausführen beliebiger Kommandos in curl
Aktuelle Meldungen Distributionen
Name: Ausführen beliebiger Kommandos in curl
ID: MDVSA-2015:021
Distribution: Mandriva
Plattformen: Mandriva Business Server 1.0
Datum: Mo, 12. Januar 2015, 17:17
Referenzen: http://advisories.mageia.org/MGASA-2015-0020.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8150

Originalnachricht

This is a multi-part message in MIME format...

------------=_1421065991-19931-1

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2015:021
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : curl
Date : January 12, 2015
Affected: Business Server 1.0
_______________________________________________________________________

Problem Description:

Updated curl packages fix security vulnerability:

When libcurl sends a request to a server via a HTTP proxy, it copies
the entire URL into the request and sends if off. If the given URL
contains line feeds and carriage returns those will be sent along to
the proxy too, which allows the program to for example send a separate
HTTP request injected embedded in the URL (CVE-2014-8150).
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8150
http://advisories.mageia.org/MGASA-2015-0020.html
_______________________________________________________________________

Updated Packages:

Mandriva Business Server 1/X86_64:
cbf237775c5e1ca9bb4682d51bd28556 mbs1/x86_64/curl-7.24.0-3.8.mbs1.x86_64.rpm
45f01de00df39d1b46f9e35172c38dbb
mbs1/x86_64/curl-examples-7.24.0-3.8.mbs1.x86_64.rpm
574c629f73b354a3be90064f312b6c84
mbs1/x86_64/lib64curl4-7.24.0-3.8.mbs1.x86_64.rpm
46c44721804a2f0b9fa3734656505bc0
mbs1/x86_64/lib64curl-devel-7.24.0-3.8.mbs1.x86_64.rpm
b54588388c5e4a620672c871489e620a mbs1/SRPMS/curl-7.24.0-3.8.mbs1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFUs7CzmqjQ0CJFipgRAtoPAJ0dGoTpMEEe8qVIF6NHXa5zzmj4GQCgxxqM
IStoYE0u+k6e8Wj/8q4lxo0=
=bhc7
-----END PGP SIGNATURE-----


------------=_1421065991-19931-1
Content-Type: text/plain; charset="UTF-8";
name="message-footer.txt"
Content-Disposition: inline; filename="message-footer.txt"
Content-Transfer-Encoding: 8bit

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
_______________________________________________________


------------=_1421065991-19931-1--
Pro-Linux
Traut euch!
Neue Nachrichten
Werbung