Ausführen beliebiger Kommandos in dstat
ID: | 200911-04 |
Distribution: | Gentoo |
Plattformen: | Keine Angabe |
Datum: | Mi, 25. November 2009, 17:21 |
Referenzen: | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3894 |
Applikationen: | dstat |
Originalnachricht |
|
--nextPart1335703.qfVLBlZNEH Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Content-Disposition: inline - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200911-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: dstat: Untrusted search path Date: November 25, 2009 Bugs: #293497 ID: 200911-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== An untrusted search path vulnerability in the dstat might result in the execution of arbitrary code. Background ========== dstat is a versatile system resource monitor written in Python. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 sys-apps/dstat < 0.6.9-r1 >= 0.6.9-r1 Description =========== Robert Buchholz of the Gentoo Security Team reported that dstat includes the current working directory and subdirectories in the Python module search path (sys.path) before calling "import". Impact ====== A local attacker could entice a user to run "dstat" from a directory containing a specially crafted Python module, resulting in the execution of arbitrary code with the privileges of the user running the application. Workaround ========== Do not run "dstat" from untrusted working directories. Resolution ========== All dstat users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/dstat-0.6.9-r1" References ========== [ 1 ] CVE-2009-3894 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3894 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200911-04.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2009 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 --nextPart1335703.qfVLBlZNEH Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.11 (GNU/Linux) iQIcBAABCgAGBQJLDUlVAAoJECaaHo/OfoM5Sf0QALzCwWJ5uebgFWJCQTjWQgwW IJgC8o+9iZ6jdReOAuIpFx/mwZIOGruKoSl7CYp+Xjbxmv9PcnnrPmDqGg4JEc5U oyQrFH9w9gvh+mj/O0n3RKenbzocheeGLnPPsiH7ZPoThFo00FL2nHwEMiveEXbb EUy8xsz6a12RkfvpHmKEr1Y5E7LhRz8m4LrS2NkgdoSV7HKC1YNZg320MZaGma+9 gbJDmBZLw074A2tJ7VleqxsZpT0WyROY58EyQWpMA74pRXxvsHpYvaEaFBxIY6Bb z7Uv7612DcTcnc7aMV+LPFD90HCHodv6Ocy21sHHJFtu/SZAHcX7sQHH4l1iwWpv Ywv0bXWLVxo4aMdrfrRNNaAJdhNXrkVF/SSnJ2kW5MXyAwxslAdzZwyurPDOZi7n eK+sV5oHjGFOIjN8V4cFLDkqbQ6eYa9nUjgCuZoDMDQ6qY8qhor9x8NedIOM1Nh7 ZorCZOq2GJwr86bNr6OUp5ZanJOeFoVm21vnGbLZpCPCjPzkoOksTRz9xmbHdLzF XYZNL72LDwC9y7QsTo+dvvvHjBRizhbhoA5wk+Licg76OUwW1UugVpN8hLuG9fuC zqCFv9GwAJswUCJUaTieLb8i91QHUoRWleHdd+zlfMIfsMA5LUtNnhbIHYgazc3z 27v7x/1jzJ0j+kfGGREz =zxm3 -----END PGP SIGNATURE----- --nextPart1335703.qfVLBlZNEH-- |