drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Ausführen beliebiger Kommandos in autofs
Name: |
Ausführen beliebiger Kommandos in autofs |
|
ID: |
USN-2579-1 |
|
Distribution: |
Ubuntu |
|
Plattformen: |
Ubuntu 14.10 |
|
Datum: |
Mo, 27. April 2015, 16:33 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8169 |
|
Applikationen: |
autofs |
|
Originalnachricht |
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --===============7863076161074986054== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="Pc1e7di0iAnlFCgQgbctaN2HTQO9G26xk"
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --Pc1e7di0iAnlFCgQgbctaN2HTQO9G26xk Content-Type: text/plain; charset=utf- Content-Transfer-Encoding: quoted-printable
========================================================================== Ubuntu Security Notice USN-2579-1 April 27, 2015
autofs vulnerability ==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.10
Summary:
autofs could be made to run programs as an administrator if program maps were configured.
Software Description: - autofs: kernel-based automounter for Linux
Details:
It was discovered that autofs incorrectly filtered environment variables when using program maps. When program maps were configured, a local user could use this issue to escalate privileges.
This update changes the default behaviour by adding a prefix to environment variables. Sites using program maps will need to adapt to the new variable names, or revert to the previous names by using a new configuration option called FORCE_STANDARD_PROGRAM_MAP_ENV.
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 14.10: autofs 5.0.8-1ubuntu1.1
After a standard system update you need to reboot your computer to make all the necessary changes.
References: http://www.ubuntu.com/usn/usn-2579-1 CVE-2014-8169
Package Information: https://launchpad.net/ubuntu/+source/autofs/5.0.8-1ubuntu1.1
--Pc1e7di0iAnlFCgQgbctaN2HTQO9G26xk Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIcBAEBCgAGBQJVPjLFAAoJEGVp2FWnRL6TTkoQAIjsgovAMUojREIiCA2amH7n +YlCAcyGp4L1607Re3hbQoxJbE2jhqYPPGOK5IgGWQ/qHGKYlP5TUq84Qpkmj78t iwW1/Kw2Tkg0NTMOzpMOuyk+WKK6u6a7QopZZV8MrM1F+RMO2qil2KMD+oRLocj2 mdatQn2vWQqbf73GWy1OOHYDPZV+0pwywGNW79zJRNMlHpzbPBXoebmZ17juyRZD sCgcgHKoAJx95SBUdVppQ0rpoAWNlOJwyYE9YvG+EUVxL2Vql9ryojq7fMzbR+BX H0JkmU8zFhlC+AoMMw3sGsvCsmZn1cfIsYFWEaJoTGnrTIqaTZ3GCs0lfrMR7YxZ ARYKg1FmfEJW/IL1ht3je3usbBuC78s8QpgF83dDnNrnpJvElm2h9NYvWluCatpG Him3GvpEr5zFk5GQWPDLYBeOFm908+EWINIpa2UcTxnYhALl5Fc+pJnbg7J6fwBn qRV8iz/rRhdQN5oGAw4Imkrb97Fv4C0ZQhgEI9jjGyvnv2OcnQE/myEsRx/Y7JWk kFaQHmOugG6bYq2PFlrUrvve1l4PF9rRSIaPwOJdA1Hu8w0wSjYHlujIR6tdddWy S9IFoR60lubU+EuPIsT6tYTX9VlvcFqH5XfOtKD4ON5MKRjt+FEKdL3IZzWqBUox f7awvmM3nsiwYJ5dSF2R =t6nz -----END PGP SIGNATURE-----
--Pc1e7di0iAnlFCgQgbctaN2HTQO9G26xk--
--===============7863076161074986054== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline
-- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
--===============7863076161074986054==--
|
|
|
|