drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Ausführen beliebiger Kommandos in Fail2ban
Name: |
Ausführen beliebiger Kommandos in Fail2ban |
|
ID: |
MDVSA-2013:078 |
|
Distribution: |
Mandriva |
|
Plattformen: |
Mandriva Business Server 1.0 |
|
Datum: |
Di, 9. April 2013, 12:38 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5642
https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0372 |
|
Applikationen: |
Fail2ban |
|
Originalnachricht |
This is a multi-part message in MIME format...
------------=_1365497646-2161-321
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2013:078 http://www.mandriva.com/en/support/security/ _______________________________________________________________________
Package : fail2ban Date : April 9, 2013 Affected: Business Server 1.0 _______________________________________________________________________
Problem Description:
Updated fail2ban package fixes security vulnerability: fail2ban before 0.8.8 didn't escape the content of \<matches\> (if used in custom action files), which could cause issues on the system running fail2ban as it scans log files, depending on what content is matched, since that content could contain arbitrary symbols (CVE-2012-5642). _______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5642 https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0372 _______________________________________________________________________
Updated Packages:
Mandriva Business Server 1/X86_64: 02b6ad856438586b58cb6226d210cedd mbs1/x86_64/fail2ban-0.8.6-3.1.mbs1.noarch.rpm 1f6f5e01367b978b7f1643eb754a5f28 mbs1/SRPMS/fail2ban-0.8.6-3.1.mbs1.src.rpm _______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/en/support/security/advisories/
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com _______________________________________________________________________
Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux)
iD8DBQFRY6y/mqjQ0CJFipgRAqA9AKDGO1NeYqqGLG5kdV0D6cDk55dyoACeNCFW kDZv6FNjedQlHHm/5USMrdU= =InV4 -----END PGP SIGNATURE-----
------------=_1365497646-2161-321 Content-Type: text/plain; charset="UTF-8"; name="message-footer.txt" Content-Disposition: inline; filename="message-footer.txt" Content-Transfer-Encoding: 8bit
To unsubscribe, send a email to sympa@mandrivalinux.org with this subject : unsubscribe security-announce _______________________________________________________ Want to buy your Pack or Services from Mandriva? Go to http://store.mandriva.com _______________________________________________________
------------=_1365497646-2161-321--
|
|
|
|