drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Ausführen beliebiger Kommandos in dstat
Name: |
Ausführen beliebiger Kommandos in dstat |
|
ID: |
200911-04 |
|
Distribution: |
Gentoo |
|
Plattformen: |
Keine Angabe |
|
Datum: |
Mi, 25. November 2009, 17:21 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3894 |
|
Applikationen: |
dstat |
|
Originalnachricht |
--nextPart1335703.qfVLBlZNEH Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Content-Disposition: inline
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200911-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal Title: dstat: Untrusted search path Date: November 25, 2009 Bugs: #293497 ID: 200911-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis ========
An untrusted search path vulnerability in the dstat might result in the execution of arbitrary code.
Background ==========
dstat is a versatile system resource monitor written in Python.
Affected packages =================
------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 sys-apps/dstat < 0.6.9-r1 >= 0.6.9-r1
Description ===========
Robert Buchholz of the Gentoo Security Team reported that dstat includes the current working directory and subdirectories in the Python module search path (sys.path) before calling "import".
Impact ======
A local attacker could entice a user to run "dstat" from a directory containing a specially crafted Python module, resulting in the execution of arbitrary code with the privileges of the user running the application.
Workaround ==========
Do not run "dstat" from untrusted working directories.
Resolution ==========
All dstat users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/dstat-0.6.9-r1"
References ==========
[ 1 ] CVE-2009-3894 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3894
Availability ============
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200911-04.xml
Concerns? =========
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License =======
Copyright 2009 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
--nextPart1335703.qfVLBlZNEH Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part.
-----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.11 (GNU/Linux)
iQIcBAABCgAGBQJLDUlVAAoJECaaHo/OfoM5Sf0QALzCwWJ5uebgFWJCQTjWQgwW IJgC8o+9iZ6jdReOAuIpFx/mwZIOGruKoSl7CYp+Xjbxmv9PcnnrPmDqGg4JEc5U oyQrFH9w9gvh+mj/O0n3RKenbzocheeGLnPPsiH7ZPoThFo00FL2nHwEMiveEXbb EUy8xsz6a12RkfvpHmKEr1Y5E7LhRz8m4LrS2NkgdoSV7HKC1YNZg320MZaGma+9 gbJDmBZLw074A2tJ7VleqxsZpT0WyROY58EyQWpMA74pRXxvsHpYvaEaFBxIY6Bb z7Uv7612DcTcnc7aMV+LPFD90HCHodv6Ocy21sHHJFtu/SZAHcX7sQHH4l1iwWpv Ywv0bXWLVxo4aMdrfrRNNaAJdhNXrkVF/SSnJ2kW5MXyAwxslAdzZwyurPDOZi7n eK+sV5oHjGFOIjN8V4cFLDkqbQ6eYa9nUjgCuZoDMDQ6qY8qhor9x8NedIOM1Nh7 ZorCZOq2GJwr86bNr6OUp5ZanJOeFoVm21vnGbLZpCPCjPzkoOksTRz9xmbHdLzF XYZNL72LDwC9y7QsTo+dvvvHjBRizhbhoA5wk+Licg76OUwW1UugVpN8hLuG9fuC zqCFv9GwAJswUCJUaTieLb8i91QHUoRWleHdd+zlfMIfsMA5LUtNnhbIHYgazc3z 27v7x/1jzJ0j+kfGGREz =zxm3 -----END PGP SIGNATURE-----
--nextPart1335703.qfVLBlZNEH--
|
|
|
|