drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Unsichere Verwendung von /tmp in webmin
Name: |
Unsichere Verwendung von /tmp in webmin
|
|
ID: |
CSSA-2001-004.0 |
|
Distribution: |
Caldera |
|
Plattformen: |
Caldera eDesktop 2.4, Caldera Desktop 2.3, Caldera eBuilder, Caldera eServer 2.3.1 |
|
Datum: |
Di, 30. Januar 2001, 12:00 |
|
Referenzen: |
Keine Angabe |
|
Applikationen: |
Webmin |
|
Originalnachricht |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
______________________________________________________________________________ Caldera Systems, Inc. Security Advisory
Subject: security problems in webmin Advisory number: CSSA-2001-004.0 Issue date: 2001 January, 17 Cross reference: ______________________________________________________________________________
1. Problem Description
On several occasions, webmin creates temporary files insecurely. This can be exploited by a local attacker to overwrite or create arbitrary files and possibly gain root privilege. There are no known exploits for this problem.
2. Vulnerable Versions
System Package ----------------------------------------------------------- OpenLinux Desktop 2.3 not shipping with webmin
OpenLinux eServer 2.3.1 All packages previous to and OpenLinux eBuilder webmin-0.749-5
OpenLinux eDesktop 2.4 All packages previous to wemin-0.78-8
3. Solution
Workaround:
none
The proper solution is to upgrade to the fixed packages.
4. OpenLinux eServer 2.3.1 and OpenLinux eBuilder for ECential 3.0
4.1 Location of Fixed Packages
The upgrade packages can be found on Caldera's FTP site at:
ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/RPMS/
The corresponding source code package can be found at:
ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/SRPMS
4.2 Verification 9cf4e2041e6c6122f402199d09fcbffc RPMS/webmin-0.749-5.i386.rpm 4a1eaff7a80609ec19198aa815081f4b SRPMS/webmin-0.749-5.src.rpm 4.3 Installing Fixed Packages
Upgrade the affected packages with the following commands:
rpm -Fhv webmin-0.749-5.i386.rpm
5. OpenLinux eDesktop 2.4
5.1 Location of Fixed Packages
The upgrade packages can be found on Caldera's FTP site at:
ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/RPMS/
The corresponding source code package can be found at:
ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/SRPMS
5.2 Verification
b6c8209aac511616367e8a6278e49c6d RPMS/webmin-0.78-8.i386.rpm fb9ddf3279b007fa99f49e7aaf486f5b SRPMS/webmin-0.78-8.src.rpm
5.3 Installing Fixed Packages
Upgrade the affected packages with the following commands:
rpm -Fhv webmin-0.78-8.i386.rpm
6. References
This and other Caldera security resources are located at:
http://www.calderasystems.com/support/security/index.html
This security fix closes Caldera's internal Problem Report 8732.
7. Disclaimer
Caldera Systems, Inc. is not responsible for the misuse of any of the information we provide on this website and/or through our security advisories. Our advisories are a service to our customers intended to promote secure installation and use of Caldera OpenLinux.
______________________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.1 (GNU/Linux) Comment: For info see http://www.gnupg.org
iD8DBQE6ZarL18sy83A/qfwRApCGAJ9v/FkWzGVtASyI5Ldopk7ZCau4twCeLOxS eUIie7kKyFMgJqLROaJflWE= =rAVp -----END PGP SIGNATURE-----
|
|
|
|