Uočena su i ispravljena dva sigurnosna nedostatka programskog paketa maniadrive. Zlonamjerni napadači su ih mogli iskoristiti za zaobilaženje postavljenih ograničenja, proizvoljno izvršavanje programskog koda s povećanim privilegijama te DoS napad.
Paket:
maniadrive 1.x
Operacijski sustavi:
Fedora 17
Kritičnost:
5.9
Problem:
cjelobrojno prepisivanje, pogreška u programskoj funkciji, pogreška u programskoj komponenti
Uočena je greška u funkciji "crypt()" te cjelobrojno prepisivanje koje je posljedica neodgovarajućeg načina obrade TAR datoteka koju obavlja ekstenzija PHAR.
Posljedica:
Udaljeni napadači propuste mogu iskoristiti za zaobilaženje postavljenih ograničenja, pokretanje proizvoljnog programskog koda s privilegijama korisnika koji je pokrenuo program te napad uskraćivanjem usluga (DoS).
Rješenje:
Preporuča se nadogradnja ranjivog programskog paketa.
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2012-9490
2012-06-15 11:59:43
--------------------------------------------------------------------------------
Name : maniadrive
Product : Fedora 17
Version : 1.2
Release : 41.fc17
URL : http://maniadrive.raydium.org/
Summary : 3D stunt driving game
Description :
ManiaDrive is an arcade car game on acrobatic tracks, with a quick and nervous
gameplay (tracks almost never exceed one minute). Features: Complex car
physics, Challenging "story mode", LAN and Internet mode, Live scores,
Track editor, Dedicated server with HTTP interface and More than 30 blocks.
--------------------------------------------------------------------------------
Update Information:
The PHP development team would like to announce the immediate availability of
PHP 5.4.4. All users of PHP are encouraged to upgrade to PHP 5.4.4.
The release fixes multiple security issues: A weakness in the DES implementation
of crypt and a heap overflow issue in the phar extension.
PHP 5.4.4 fixes over 30 bugs. Please note that the use of php://fd streams is
now restricted to the CLI SAPI
Changelog: http://www.php.net/ChangeLog-5.php#5.4.4
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jun 14 2012 Remi Collet <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 1.2-41
- rebuild against PHP 5.4.4
* Wed May 9 2012 Remi Collet <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 1.2-40
- rebuild against PHP 5.4.3
* Thu May 3 2012 Remi Collet <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 1.2-39
- rebuild against PHP 5.4.2
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #816956 - CVE-2012-2143 BSD crypt(): DES encrypted password weakness
https://bugzilla.redhat.com/show_bug.cgi?id=816956
[ 2 ] Bug #823594 - CVE-2012-2386 php: Integer overflow leading to heap-buffer
overflow in the Phar extension
https://bugzilla.redhat.com/show_bug.cgi?id=823594
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update maniadrive' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list
Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
https://admin.fedoraproject.org/mailman/listinfo/package-announce
Posljednje sigurnosne preporuke