Uočen je sigurnosni nedostatak u programskom paketu Apache Commons Daemon koji udaljenom napadaču omogućuje zaobilaženje postavljenih ograničenja i otkrivanje osjetljivih informacija.
Nedostatak je otkriven u datoteci "native/unix/native/jsvc-unix.c", a očituje se kao nepravilno postavljanje korisničkih mogućnosti pri pokretanju programa.
Posljedica:
Udaljeni napadač može iskoristiti nedostatak za zaobilaženje postavljenih ograničenja i pristup osjetljivim podacima u inače nedostupnim datotekama.
Rješenje:
Svim korisnicima se savjetuje korištenje odgovarajuće nadogradnje.
==========================================================================
Ubuntu Security Notice USN-1298-1
December 12, 2011
commons-daemon vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 11.10
- Ubuntu 11.04
Summary:
Apache Commons Daemon would allow unintended access to files over the
network.
Software Description:
- commons-daemon: wrapper to launch Java applications as daemons
Details:
Wilfried Weissmann discovered that Apache Commons Daemon incorrectly
dropped capabilities after starting. A remote attacker could possibly use
this flaw to read certain files, bypassing the intended permissions.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 11.10:
libcommons-daemon-java 1.0.6-1ubuntu0.1
Ubuntu 11.04:
libcommons-daemon-java 1.0.4-1ubuntu0.1
After a standard system update you need to restart applications which use
Apache Commons Daemon, such as the Jetty web server, to make all the
necessary changes.
References:
http://www.ubuntu.com/usn/usn-1298-1
CVE-2011-2729
Package Information:
https://launchpad.net/ubuntu/+source/commons-daemon/1.0.6-1ubuntu0.1
https://launchpad.net/ubuntu/+source/commons-daemon/1.0.4-1ubuntu0.1
Posljednje sigurnosne preporuke