drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Ausführen beliebiger Kommandos in Apache
Name: |
Ausführen beliebiger Kommandos in Apache |
|
ID: |
USN-2551-1 |
|
Distribution: |
Ubuntu |
|
Plattformen: |
Ubuntu 14.04 LTS, Ubuntu 14.10 |
|
Datum: |
Mo, 30. März 2015, 21:51 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0254
https://launchpad.net/ubuntu/+source/jakarta-taglibs-standard/1.1.2-2ubuntu1.14.04.1
https://launchpad.net/ubuntu/+source/jakarta-taglibs-standard/1.1.2-2ubuntu1.14.10.1 |
|
Applikationen: |
Apache |
|
Originalnachricht |
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --===============1902128739760122641== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="dtsFnCrC7ulTBexK9Ga1nTtj9of42LmcD"
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --dtsFnCrC7ulTBexK9Ga1nTtj9of42LmcD Content-Type: text/plain; charset=utf- Content-Transfer-Encoding: quoted-printable
========================================================================== Ubuntu Security Notice USN-2551-1 March 30, 2015
jakarta-taglibs-standard vulnerability ==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.10 - Ubuntu 14.04 LTS
Summary:
Apache Standard Taglibs loaded external XML entities.
Software Description: - jakarta-taglibs-standard: Implementation of JSP Standard Tag Library (JSTL)
Details:
David Jorm discovered that the Apache Standard Taglibs incorrectly handled external XML entities. A remote attacker could possibly use this issue to execute arbitrary code or perform other external XML entity attacks.
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 14.10: libjakarta-taglibs-standard-java 1.1.2-2ubuntu1.14.10.1 libjstl1.1-java 1.1.2-2ubuntu1.14.10.1
Ubuntu 14.04 LTS: libjakarta-taglibs-standard-java 1.1.2-2ubuntu1.14.04.1 libjstl1.1-java 1.1.2-2ubuntu1.14.04.1
In general, a standard system update will make all the necessary changes.
References: http://www.ubuntu.com/usn/usn-2551-1 CVE-2015-0254
Package Information:
https://launchpad.net/ubuntu/+source/jakarta-taglibs-standard/1.1.2-2ubuntu1.14.10.1
https://launchpad.net/ubuntu/+source/jakarta-taglibs-standard/1.1.2-2ubuntu1.14.04.1
--dtsFnCrC7ulTBexK9Ga1nTtj9of42LmcD Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIcBAEBCgAGBQJVGY/tAAoJEGVp2FWnRL6TglcP/3n/77LSZ5lP4W61/U6qh53B jmBT24uAPo3UFn1pI9G/Aa0X6+R6wdE+3Ho5vO0v9wL5zgkxx5IjusbaNGUuW2Rf CTcUmXzAsbhJG3BeT+W61XlVEnCEEjMuLdehHzAF4N4fkN1eGCUIgd1oS8Bl/cPZ dL+li7gjgwqi++VkETnfY2Mvqt3rCRlsb16yrdpOvD4kT6pO+E8bH6IRqB5FWEbF 42KT8JsbvgHaHjBsfSb8Px6RyEx9E/vGRJ+hD2p9Sqp/T/pRwiOJWuWoqKlerB51 /t5gs1aGXwHNVu+i91r3KnSV4KEuc5aGM1MvGokO17gwv+ukVyWby9IB6dks01m6 jLwH01RGbXTc0/EYmceA/fNyYlHsUSjyc+FRWRMKMlS54R2Wlrmk6zsdW/5y4+NM vnYlUFIo2a2osuM9UUf/oht3BJcyjG8+ADoKH4sIOLF2cHoCqu4doc9ZG9I6MAU+ qpqsy90iSwsvF2cx6EJM4ZPY7l5rGi4YXWcgfoRvakfPx4aGtVJr2RyUISYq6AWv xb6OeWqfVr383e9RP5AC6U2PyCaAlHc0Fxn5yHlxZt7cGx3sSyGzvclc+3D9nLHS mE4TQLIcH7OgTfOm9LIci2w/odTa8ZqaCqCR/Op/CekLauD37MEHLAzn1yJ3BQBL EJpYHG8aT3MlL7GIKwW3 =Ti8R -----END PGP SIGNATURE-----
--dtsFnCrC7ulTBexK9Ga1nTtj9of42LmcD--
--===============1902128739760122641== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline
-- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
--===============1902128739760122641==--
|
|
|
|