Miembros de
Boletines de Vulnerabilidades |
Múltiples vulnerabilidades en Perl-Compatible Regular Expression |
|
Clasificación de la vulnerabilidad |
|
| Propiedad | Valor |
| Nivel de Confianza | Oficial |
| Impacto | Obtener acceso |
| Dificultad | Experto |
| Requerimientos del atacante | Acceso remoto sin cuenta a un servicio estandar |
Información sobre el sistema |
|
| Propiedad | Valor |
| Fabricante afectado | GNU/Linux |
| Software afectado |
Perl-Compatible Regular Expression < 7.0 Kazehakase |
Descripción |
|
|
Se han encontrado múltiples vulnerabilidades en Perl-Compatible Regular Expression. Las vulnerabilidades son descritas a continuación. - CVE-2006-7228: Se ha encontrado una vulnerabilidad del tipo desbordamiento de entero en la librería Perl-Compatible Regular Expression en las versiones anteriores a la 6.7. La vulnerabilidad reside en un cálculo incorrecto del tamaño. Un atacante remoto podría ejecutar código arbitrario mediante una expresión regular relacionada con valores grandes en min, max o duplength. - CVE-2006-7230: Se ha encontrado una vulnerabilidad en la librería Perl-Compatible Regular Expression en las versiones anteriores a la 7.0. La vulnerabilidad reside al no calcular de forma correcta la cantidad de memoria necesaria para el patrón de una expresión regular compilada cuando las opciones UTF-8 -x o -i son cambiadas junto el patrón. |
|
Solución |
|
|
Actualización de software Suse Linux Las actualizaciones pueden descargarse mediante YAST o del servidor FTP oficial de Suse Linux. Red Hat (RHSA-2007:1059-9) RHEL Desktop Workstation (v. 5 cliente) Red Hat Enterprise Linux (v. 5 servidor) Red Hat Enterprise Linux Desktop (v. 5 cliente) https://rhn.redhat.com/ Red Hat (RHSA-2007:1068-3) Red Hat Desktop (v. 4) Red Hat Enterprise Linux AS (v. 4) Red Hat Enterprise Linux ES (v. 4) Red Hat Enterprise Linux WS (v. 4) https://rhn.redhat.com/ Red Hat (RHSA-2007:1063-4) Red Hat Desktop (v. 3) Red Hat Enterprise Linux AS (v. 3) Red Hat Enterprise Linux ES (v. 3) Red Hat Enterprise Linux WS (v. 3) https://rhn.redhat.com/ Red Hat (RHSA-2007:1065-3) Red Hat Enterprise Linux AS (v. 2.1) Red Hat Enterprise Linux ES (v. 2.1) Red Hat Enterprise Linux WS (v. 2.1) Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor https://rhn.redhat.com/ Red Hat (RHSA-2007:1076-6) Red Hat Desktop (v. 3) Red Hat Desktop (v. 4) Red Hat Enterprise Linux AS (v. 3) Red Hat Enterprise Linux AS (v. 4) Red Hat Enterprise Linux ES (v. 3) Red Hat Enterprise Linux ES (v. 4) Red Hat Enterprise Linux WS (v. 3) Red Hat Enterprise Linux WS (v. 4) https://rhn.redhat.com/ Red Hat (RHSA-2007:1077-5) Red Hat Enterprise Linux AS (v. 2.1) Red Hat Enterprise Linux ES (v. 2.1) Red Hat Enterprise Linux WS (v. 2.1) Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor https://rhn.redhat.com/ Mandriva (MDVSA-2008:012) Corporate Server 3.0 corporate/3.0/i586/libpython2.3-2.3.3-2.5.C30mdk.i586.rpm corporate/3.0/i586/libpython2.3-devel-2.3.3-2.5.C30mdk.i586.rpm corporate/3.0/i586/python-2.3.3-2.5.C30mdk.i586.rpm corporate/3.0/i586/python-base-2.3.3-2.5.C30mdk.i586.rpm corporate/3.0/i586/python-docs-2.3.3-2.5.C30mdk.i586.rpm corporate/3.0/i586/tkinter-2.3.3-2.5.C30mdk.i586.rpm corporate/3.0/SRPMS/python-2.3.3-2.5.C30mdk.src.rpm X86_64 corporate/3.0/x86_64/lib64python2.3-2.3.3-2.5.C30mdk.x86_64.rpm corporate/3.0/x86_64/lib64python2.3-devel-2.3.3-2.5.C30mdk.x86_64.rpm corporate/3.0/x86_64/python-2.3.3-2.5.C30mdk.x86_64.rpm corporate/3.0/x86_64/python-base-2.3.3-2.5.C30mdk.x86_64.rpm corporate/3.0/x86_64/python-docs-2.3.3-2.5.C30mdk.x86_64.rpm corporate/3.0/x86_64/tkinter-2.3.3-2.5.C30mdk.x86_64.rpm corporate/3.0/SRPMS/python-2.3.3-2.5.C30mdk.src.rpm Multi Network Firewall 2.0 mnf/2.0/i586/libpython2.3-2.3.3-2.5.M20mdk.i586.rpm mnf/2.0/i586/libpython2.3-devel-2.3.3-2.5.M20mdk.i586.rpm mnf/2.0/i586/python-2.3.3-2.5.M20mdk.i586.rpm mnf/2.0/i586/python-base-2.3.3-2.5.M20mdk.i586.rpm mnf/2.0/i586/python-docs-2.3.3-2.5.M20mdk.i586.rpm mnf/2.0/i586/tkinter-2.3.3-2.5.M20mdk.i586.rpm mnf/2.0/SRPMS/python-2.3.3-2.5.M20mdk.src.rpm Mandriva (MDVSA-2008:030) Corporate Server 3.0 corporate/3.0/i586/libpcre0-4.5-3.4.C30mdk.i586.rpm corporate/3.0/i586/libpcre0-devel-4.5-3.4.C30mdk.i586.rpm corporate/3.0/i586/pcre-4.5-3.4.C30mdk.i586.rpm corporate/3.0/SRPMS/pcre-4.5-3.4.C30mdk.src.rpm X86_64 corporate/3.0/x86_64/lib64pcre0-4.5-3.4.C30mdk.x86_64.rpm corporate/3.0/x86_64/lib64pcre0-devel-4.5-3.4.C30mdk.x86_64.rpm corporate/3.0/x86_64/pcre-4.5-3.4.C30mdk.x86_64.rpm corporate/3.0/SRPMS/pcre-4.5-3.4.C30mdk.src.rpm Multi Network Firewall 2.0 mnf/2.0/i586/libpcre0-4.5-3.4.M20mdk.i586.rpm mnf/2.0/i586/libpcre0-devel-4.5-3.4.M20mdk.i586.rpm mnf/2.0/i586/pcre-4.5-3.4.M20mdk.i586.rpm mnf/2.0/SRPMS/pcre-4.5-3.4.M20mdk.src.rpm Debian (DSA-1570-1) Debian Linux 4.0 Source http://security.debian.org/pool/updates/main/k/kazehakase/kazehakase_0.4.2-1etch1.diff.gz http://security.debian.org/pool/updates/main/k/kazehakase/kazehakase_0.4.2.orig.tar.gz http://security.debian.org/pool/updates/main/k/kazehakase/kazehakase_0.4.2-1etch1.dsc alpha (DEC Alpha) http://security.debian.org/pool/updates/main/k/kazehakase/kazehakase_0.4.2-1etch1_alpha.deb amd64 (AMD x86_64 (AMD64)) http://security.debian.org/pool/updates/main/k/kazehakase/kazehakase_0.4.2-1etch1_amd64.deb arm (ARM) http://security.debian.org/pool/updates/main/k/kazehakase/kazehakase_0.4.2-1etch1_arm.deb hppa (HP PA RISC) http://security.debian.org/pool/updates/main/k/kazehakase/kazehakase_0.4.2-1etch1_hppa.deb i386 (Intel ia32) http://security.debian.org/pool/updates/main/k/kazehakase/kazehakase_0.4.2-1etch1_i386.deb mips (MIPS (Big Endian)) http://security.debian.org/pool/updates/main/k/kazehakase/kazehakase_0.4.2-1etch1_mips.deb mipsel (MIPS (Little Endian)) http://security.debian.org/pool/updates/main/k/kazehakase/kazehakase_0.4.2-1etch1_mipsel.deb powerpc (PowerPC) http://security.debian.org/pool/updates/main/k/kazehakase/kazehakase_0.4.2-1etch1_powerpc.deb s390 (IBM S/390) http://security.debian.org/pool/updates/main/k/kazehakase/kazehakase_0.4.2-1etch1_s390.deb sparc (Sun SPARC/UltraSPARC) http://security.debian.org/pool/updates/main/k/kazehakase/kazehakase_0.4.2-1etch1_sparc.deb Red Hat (RHSA-2008:0546-3) Red Hat Enterprise Linux AS (v. 2.1) Red Hat Enterprise Linux ES (v. 2.1) Red Hat Enterprise Linux WS (v. 2.1) Red Hat Linux Advanced Workstation 2.1 para Itanium Processor https://rhn.redhat.com/ |
|
Identificadores estándar |
|
| Propiedad | Valor |
| CVE |
CVE-2006-7228 CVE-2006-7230 |
| BID | 26462 |
Recursos adicionales |
|
|
SUSE Security Advisory (SUSE-SA:2007:062) http://www.novell.com/linux/security/advisories/2007_62_pcre.html SUSE Security Advisory (SUSE-SA:2008:004) http://www.novell.com/linux/security/advisories/2008_04_php.html Red Hat Security Advisory (RHSA-2007:1059-9) https://rhn.redhat.com/errata/RHSA-2007-1059.html Red Hat Security Advisory (RHSA-2007:1068-3) https://rhn.redhat.com/errata/RHSA-2007-1068.html Red Hat Security Advisory (RHSA-2007:1063-4) https://rhn.redhat.com/errata/RHSA-2007-1063.html Red Hat Security Advisory (RHSA-2007:1065-3) https://rhn.redhat.com/errata/RHSA-2007-1065.html Red Hat Security Advisory (RHSA-2007:1076-6) https://rhn.redhat.com/errata/RHSA-2007-1076.html Red Hat Security Advisory (RHSA-2007:1077-5) https://rhn.redhat.com/errata/RHSA-2007-1077.html Mandriva Security Advisory (MDVSA-2008:012) http://www.mandriva.com/en/security/advisories?name=MDVSA-2008:012 Mandriva Security Advisory (MDVSA-2008:030) http://www.mandriva.com/en/security/advisories?name=MDVSA-2008:030 Debian Security Advisory (DSA-1570-1) http://lists.debian.org/debian-security-announce/2008/msg00146.html Red Hat Security Advisory (RHSA-2008:0546-3) https://rhn.redhat.com/errata/RHSA-2008-0546.html |
|
Histórico de versiones |
||
| Versión | Comentario | Fecha |
| 1.0 | Aviso emitido | 2007-11-28 |
| 1.1 | Aviso emitido por Red Hat (RHSA-2007:1059-9), aviso emitido por Red Hat (RHSA-2007:1068-3), aviso emitido por Red Hat (RHSA-2007:1063-4), aviso emitido por Red Hat (RHSA-2007:1065-3) | 2007-11-30 |
| 1.2 | Aviso emitido por Red Hat (RHSA-2007:1076-6), aviso emitido por Red Hat (RHSA-2007:1077-5) | 2007-12-12 |
| 1.3 | Aviso emitido por Mandriva (MDVSA-2008:012) | 2008-01-22 |
| 1.4 | Aviso emitido por Suse (SUSE-SA:2008:004) | 2008-01-31 |
| 1.5 | Aviso emitido por Mandriva (MDVSA-2008:030) | 2008-02-01 |
| 1.6 | Aviso emitido por Debian (DSA-1570-1) | 2008-05-13 |
| 1.7 | Aviso emitido por Red Hat (RHSA-2008:0546-3) | 2008-07-17 |
