drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Ausführen beliebiger Kommandos in PlRPC
Name: |
Ausführen beliebiger Kommandos in PlRPC |
|
ID: |
201403-08 |
|
Distribution: |
Gentoo |
|
Plattformen: |
Keine Angabe |
|
Datum: |
Do, 27. März 2014, 12:28 |
|
Referenzen: |
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-7284 |
|
Applikationen: |
PlRPC |
|
Originalnachricht |
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --AtEDaJCjRDJqciUixXixcr8FxS5f995jq Content-Type: text/plain; charset=UTF- Content-Transfer-Encoding: quoted-printable
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201403-08 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal Title: PlRPC: Arbitrary code execution Date: March 27, 2014 Bugs: #497692 ID: 201403-08
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis ========
PlRPC uses Storable which allows for code execution prior to Authentication
Background ==========
The Perl RPC Module is a Perl module that implements IDL-free RPCs.
Affected packages =================
------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-perl/PlRPC < 0.202.0-r2 >= 0.202.0-r2
Description ===========
PlRPC uses Storable module for serialization and deserialization of untrusted data. Deserialized data can contain objects which can lead to loading of foreign modules, and possible execution of arbitrary code.
Impact ======
A remote attacker could possibly execute arbitrary code with the privileges of the process, or cause a Denial of Service condition.
Workaround ==========
External authentication mechanism can be used with PlRPC such as TLS or IPSEC.
Resolution ==========
All PlRPC users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-perl/PlRPC-0.202.0-r2"
References ==========
[ 1 ] CVE-2013-7284 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-7284
Availability ============
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201403-08.xml
Concerns? =========
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License =======
Copyright 2014 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
-- Mikle Kolyada Gentoo Linux Developer
--AtEDaJCjRDJqciUixXixcr8FxS5f995jq Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iJwEAQECAAYFAlM0BwgACgkQG9wOWsQutdY7TQQAjAHgeG6fwYvyj+yyLL6H3Dzo cz1l7aYuv7O2nw6zY4/1Mbl7tjnRvmM6+WsrPFpfnXrYEonN8rR1Aze/v9qj9Ai2 WZnWfW04fPxDx3eTOcHC5d3SAwqo8gwlaMdJdwn9NxcrTTT4hGaU4yeUg5pIqYeo zm7gRUPc0zIZjouxScE= =7eDg -----END PGP SIGNATURE-----
--AtEDaJCjRDJqciUixXixcr8FxS5f995jq--
|
|
|
|