U radu programskog paketa wicd uočena je nova sigurnosna ranjivost. Lokalni zloćudni korisnik navedenu ranjivost može iskoristiti za proizvoljno pokretanje programskog koda.
Paket:
wicd 1.x
Operacijski sustavi:
Fedora 17
Kritičnost:
4.6
Problem:
neodgovarajuća provjera ulaznih podataka
Iskorištavanje:
lokalno
Posljedica:
proizvoljno izvršavanje programskog koda
Rješenje:
programska zakrpa proizvođača
CVE:
CVE-2012-2095
Izvorni ID preporuke:
FEDORA-2012-5858
Izvor:
Fedora
Problem:
Sigurnosni propust je posljedica pogrešnog filtriranja ulaznih podataka putem "DBus" sučelja.
Posljedica:
Lokalni napadač spomenutu ranjivost može iskoristiti za proizvoljno izvršavanje programskog koda.
Rješenje:
Svim se korisnicima navedenog programskog paketa, u svrhu zaštite sigurnosti, savjetuje njegova nadogradnja na novije inačice.
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2012-5858
2012-04-14 01:39:02
--------------------------------------------------------------------------------
Name : wicd
Product : Fedora 17
Version : 1.7.2.1
Release : 1.fc17
URL : http://wicd.sourceforge.net/
Summary : Wireless and wired network connection manager
Description :
Wicd is designed to give the user as much control over behavior of network
connections as possible. Every network, both wired and wireless, has its
own profile with its own configuration options and connection behavior.
Wicd will try to automatically connect only to networks the user specifies
it should try, with a preference first to a wired network, then to wireless.
This package provides the architecture-dependent components of wicd.
--------------------------------------------------------------------------------
Update Information:
This update fixes CVE-2012-2095. The wicd daemon suffered from a local
privilege escalation flaw due to incomplete input sanitization. A local
attacker sould use this to inject arbitrary code through the D-Bus interface.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #811762 - CVE-2012-2095 wicd: broken filtering leads to arbitrary
code execution
https://bugzilla.redhat.com/show_bug.cgi?id=811762
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update wicd' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list
Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
https://admin.fedoraproject.org/mailman/listinfo/package-announce
Posljednje sigurnosne preporuke