int(1802)

Vulnerability Bulletins


Ejecución arbitraria de código en affix

Vulnerability classification

Property Value
Confidence level Oficial
Impact Obtener acceso
Dificulty Experto
Required attacker level Acceso remoto sin cuenta a un servicio exotico

System information

Property Value
Affected manufacturer GNU/Linux
Affected software affix 2.1.2
affix 3.2.0

Description

Se ha descubierto una vulnerabilidad en affix. La vulnerabilidad se debe a un uso incorrecto de la llamada popen.

Esta vulnerabilidad puede ser explotada por un atacante remoto para ejecutar comandos arbitrarios en un sistema vulnerable.

Solution



Actualización de software

Debian Linux 3.1
Source
http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3.diff.gz
http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3.dsc
DEC Alpha
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-3_alpha.deb
http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3_alpha.deb
http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_alpha.deb
AMD64
http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_amd64.deb
http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3_amd64.deb
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-3_amd64.deb
ARM
http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_arm.deb
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-3_arm.deb
http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3_arm.deb
HP PA RISC
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-3_hppa.deb
http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_hppa.deb
http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3_hppa.deb
Intel ia32
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-3_i386.deb
http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3_i386.deb
http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_i386.deb
Intel ia64
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-3_ia64.deb
http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3_ia64.deb
http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_ia64.deb
Motorola Mc680x0
http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_m68k.deb
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-3_m68k.deb
http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3_m68k.deb
MIPS (Big Endian)
http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_mips.deb
http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3_mips.deb
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-3_mips.deb
MIPS (Little Endian)
http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_mipsel.deb
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-3_mipsel.deb
http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3_mipsel.deb
PowerPC
http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3_powerpc.deb
http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_powerpc.deb
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-3_powerpc.deb
IBM S/390
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-3_s390.deb
http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3_s390.deb
http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_s390.deb
Sun SPARC/UltraSPARC
http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_sparc.deb
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-3_sparc.deb
http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3_sparc.deb

Standar resources

Property Value
CVE CAN-2005-2716
BID

Other resources

Debian Security Advisory DSA 796-1
http://lists.debian.org/debian-security-announce/debian-security-announce-2005/msg00185.html

Version history

Version Comments Date
1.0 Aviso emitido 2005-09-06
Ministerio de Defensa
CNI
CCN
CCN-CERT