drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Zwei Probleme in Munin
Name: |
Zwei Probleme in Munin |
|
ID: |
DSA-2815-1 |
|
Distribution: |
Debian |
|
Plattformen: |
Debian sid, Debian wheezy, Debian jessie |
|
Datum: |
Di, 10. Dezember 2013, 07:33 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6048
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6359 |
|
Applikationen: |
Munin |
|
Originalnachricht |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
- ------------------------------------------------------------------------- Debian Security Advisory DSA-2815-1 security@debian.org http://www.debian.org/security/ Salvatore Bonaccorso December 09, 2013 http://www.debian.org/security/faq - -------------------------------------------------------------------------
Package : munin Vulnerability : denial of service Problem type : remote Debian-specific: no CVE ID : CVE-2013-6048 CVE-2013-6359
Christoph Biedl discovered two denial of service vulnerabilities in munin, a network-wide graphing framework. The Common Vulnerabilities and Exposures project identifies the following problems:
CVE-2013-6048
The Munin::Master::Node module of munin does not properly validate certain data a node sends. A malicious node might exploit this to drive the munin-html process into an infinite loop with memory exhaustion on the munin master.
CVE-2013-6359
A malicious node, with a plugin enabled using "multigraph" as a multigraph service name, can abort data collection for the entire node the plugin runs on.
For the stable distribution (wheezy), these problems have been fixed in version 2.0.6-4+deb7u2.
For the testing distribution (jessie), these problems have been fixed in version 2.0.18-1.
For the unstable distribution (sid), these problems have been fixed in version 2.0.18-1.
We recommend that you upgrade your munin packages.
Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.15 (GNU/Linux)
iQIcBAEBCgAGBQJSpkCOAAoJEAVMuPMTQ89EMV8P/R+S4LjASU572SZQuYgYbz/I xEV4VD96c7rP3wbHQLdPLYhq3gbm6RbluH3nIwV5h4txplkaPEiL1YsQ/1QO3n89 hcpwBS9uOPijofDVVe0+CwfkESZF2sn4nOeWwnb7ZBqyALjMxyedMZTP7PVx3NQb VEV4k9LSkCmUfPTaaJJVv7xlKoX4kYm3zKfykyYiWEsotXqyloMpc8jluld+qULl MpTbwyhZLxF4Iw49mzwHdItQjXxfy0W76YwydCziXFjeotNvn+GoXG2mRzNhBGl4 Hlvu/9vfJZ37EI/pDV59KiqPBAexEO4rp/aHMJUOT9gMRnZ2MKCluGviquDHH1z6 8tkM0t5NmaT8JWzGsPF4H/TcJRmCP+KXDpU/T+lH2NI2F1i9qFei1b3rBGXuhVyy gZTtd/r9LYeBDWIUALWfpAIQrXnjEKlLWak8Z/7BtkrZlNV3I1KEaWgm6i16DlJw x+QavEPYErolOtQZNAfPVItXBDwYswC4Y4fcA2vQR0aR8ftvPqGqVRmE3b5kUops iIsdLSh+T2Ha5+0a95mWTefRRqME5cxbFbQyKdG/ZSHxJIICJD+ye/MS1p25awxE alpS4Mqp+yHfOfpyrA1hpPRtSCAAIZByoh8Gb5lMGb9TVMq7Ufy24HwTki1/fYI9 TcOtwDcyQn6CZL9x7nva =dUQV -----END PGP SIGNATURE-----
-- To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org Archive: http://lists.debian.org/E1Vq95m-0008G6-3w@master.debian.org
|
|
|
|