drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Ausführen von Code mit höheren Privilegien in thermostat
Name: |
Ausführen von Code mit höheren Privilegien in thermostat |
|
ID: |
FEDORA-2014-17415 |
|
Distribution: |
Fedora |
|
Plattformen: |
Fedora 20 |
|
Datum: |
Do, 8. Januar 2015, 08:32 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8120 |
|
Applikationen: |
Thermostat |
|
Originalnachricht |
Name : thermostat Product : Fedora 20 Version : 1.0.6 Release : 1.fc20 URL : http://icedtea.classpath.org/thermostat/ Summary : A monitoring and serviceability tool for OpenJDK Description : Thermostat is a monitoring and instrumentation tool for the Hotspot JVM, with support for monitoring multiple JVM instances. The system is made up of two processes: an Agent, which collects data, and a Client which allows users to visualize this data. These components communicate via a MongoDB-based storage layer. A pluggable agent and gui framework allows for collection and visualization of performance data beyond that which is included out of the box.
------------------------------------------------------------------------------- - Update Information:
Update to latest maintenance release. It was discovered that, in certain configurations, the Thermostat agent disclosed JMX management URLs of all local Java virtual machines to any local user. A local, unprivileged user could use this flaw to escalate their privileges on the system. (CVE-2014-8120) ------------------------------------------------------------------------------- - ChangeLog:
* Thu Dec 18 2014 Elliott Baron <ebaron@redhat.com> - 1.0.6-1 - Update to latest maintenance release. - Resolves: CVE-2014-8120 * Mon Oct 13 2014 Severin Gehwolf <sgehwolf@redhat.com> - 1.0.4-4.5 - Use /etc/alternatives/java_sdk_openjdk as jdk_base. * Mon Oct 13 2014 Severin Gehwolf <sgehwolf@redhat.com> - 1.0.4-4.4 - Remove obsolete requires on gnome-icon-theme. * Thu Sep 4 2014 Severin Gehwolf <sgehwolf@redhat.com> - 1.0.4-4.3 - Fix hawtjni-runtime symlink and use OpenJDK 8 in scripts, R/BRs. * Tue Sep 2 2014 Severin Gehwolf <sgehwolf@redhat.com> - 1.0.4-4.2 - Rebuild for updated jcommon/jfreechart versions. * Tue Aug 19 2014 Severin Gehwolf <sgehwolf@redhat.com> - 1.0.4-4.1 - Rebuild for updated httpcomponents-client version (v4.3.5). * Mon Aug 18 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.0.4-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild * Tue Jun 10 2014 Severin Gehwolf <sgehwolf@redhat.com> - 1.0.4-3 - Drop manual requires in favour of mvn()-style auto-requires. - Switch to mvn()-style BRs. - Use io.netty:netty over org.jboss.netty:netty in order to keep thermostat installable. * Fri Jun 6 2014 Severin Gehwolf <sgehwolf@redhat.com> - 1.0.4-2 - Rebuild for updated httpcomonents-client (v4.3.4) and apache-commons-beanutils (v1.9.2) builds. * Wed Jun 4 2014 Severin Gehwolf <sgehwolf@redhat.com> - 1.0.4-1 - Update to latest upstream release. * Fri Feb 14 2014 Severin Gehwolf <sgehwolf@redhat.com> - 1.0.2-1 - Update to latest upstream release. * Tue Feb 11 2014 Omair Majid <omajid@redhat.com> - 1.0.0-3 - Update license field to match the tarball license * Fri Jan 17 2014 Severin Gehwolf <sgehwolf@redhat.com> - 1.0.0-2 - Fix path to jdk/tools.jar in boot scripts. * Thu Nov 28 2013 Severin Gehwolf <sgehwolf@redhat.com> - 1.0.0-1 - Update to upstream 1.0.0 release. - Add support for building release branch snapshots. * Tue Nov 5 2013 Severin Gehwolf <sgehwolf@redhat.com> - 0.15.0-1 - Update to latest upstream release. - Use osgi-style R/BR in order to ensure that things work during runtime. - Use custom CATALINA_BASE for thermostat-webapp deployment. - Reduce symlinked jars in thermostat-webapp classpath. - Thermostat tomcat is started via: $ systemctl start tomcat@thermostat * Wed Oct 23 2013 Severin Gehwolf <sgehwolf@redhat.com> - 0.9.2-7 - SCL-ize thermostat. ------------------------------------------------------------------------------- - References:
[ 1 ] Bug #1168977 - CVE-2014-8120 thermostat: local JMX URL disclosure https://bugzilla.redhat.com/show_bug.cgi?id=1168977 ------------------------------------------------------------------------------- -
This update can be installed with the "yum" update program. Use su -c 'yum update thermostat' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys ------------------------------------------------------------------------------- - _______________________________________________ package-announce mailing list package-announce@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/package-announce
|
|
|
|