Test Kennung:	1.3.6.1.4.1.25623.1.0.71113
Kategorie:	Red Hat Local Security Checks
Titel:	RedHat Security Advisory RHSA-2012:0308
Zusammenfassung:	NOSUMMARY
Beschreibung:	Description: The remote host is missing updates announced in advisory RHSA-2012:0308. BusyBox provides a single binary that includes versions of a large number of system commands, including a shell. This can be very useful for recovering from certain types of system failures, particularly those involving broken shared libraries. A buffer underflow flaw was found in the way the uncompress utility of BusyBox expanded certain archive files compressed using Lempel-Ziv compression. If a user were tricked into expanding a specially-crafted archive file with uncompress, it could cause BusyBox to crash or, potentially, execute arbitrary code with the privileges of the user running BusyBox. (CVE-2006-1168) The BusyBox DHCP client, udhcpc, did not sufficiently sanitize certain options provided in DHCP server replies, such as the client hostname. A malicious DHCP server could send such an option with a specially-crafted value to a DHCP client. If this option's value was saved on the client system, and then later insecurely evaluated by a process that assumes the option is trusted, it could lead to arbitrary code execution with the privileges of that process. Note: udhcpc is not used on Red Hat Enterprise Linux by default, and no DHCP client script is provided with the busybox packages. (CVE-2011-2716) This update also fixes the following bugs: * Prior to this update, the cp command wrongly returned the exit code 0 to indicate success if a device ran out of space while attempting to copy files of more than 4 gigabytes. This update modifies BusyBox, so that in such situations, the exit code 1 is returned. Now, the cp command shows correctly whether a process failed. (BZ#689659) * Prior to this update, the findfs command failed to check all existing block devices on a system with thousands of block device nodes in /dev/. This update modifies BusyBox so that findfs checks all block devices even in this case. (BZ#756723) All users of busybox are advised to upgrade to these updated packages, which correct these issues. Solution: Please note that this update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date http://rhn.redhat.com/errata/RHSA-2012-0308.html Risk factor : Low
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2006-1168 BugTraq ID: 19455 http://www.securityfocus.com/bid/19455 Debian Security Information: DSA-1149 (Google Search) http://www.debian.org/security/2006/dsa-1149 http://security.gentoo.org/glsa/glsa-200610-03.xml http://www.mandriva.com/security/advisories?name=MDKSA-2006:140 http://www.mandriva.com/security/advisories?name=MDVSA-2012:129 http://bugs.gentoo.org/show_bug.cgi?id=141728 https://bugzilla.redhat.com/show_bug.cgi?id=728536 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9373 http://www.redhat.com/support/errata/RHSA-2006-0663.html RedHat Security Advisories: RHSA-2012:0810 http://rhn.redhat.com/errata/RHSA-2012-0810.html http://securitytracker.com/id?1016836 http://secunia.com/advisories/21427 http://secunia.com/advisories/21434 http://secunia.com/advisories/21437 http://secunia.com/advisories/21467 http://secunia.com/advisories/21880 http://secunia.com/advisories/22036 http://secunia.com/advisories/22296 http://secunia.com/advisories/22377 SGI Security Advisory: 20060901-01-P ftp://patches.sgi.com/support/free/security/advisories/20060901-01-P.asc SuSE Security Announcement: SUSE-SR:2006:020 (Google Search) http://www.novell.com/linux/security/advisories/2006_20_sr.html http://www.vupen.com/english/advisories/2006/3234 XForce ISS Database: ncompress-decompress-underflow(28315) https://exchange.xforce.ibmcloud.com/vulnerabilities/28315 Common Vulnerability Exposure (CVE) ID: CVE-2011-2716 BugTraq ID: 48879 http://www.securityfocus.com/bid/48879 Bugtraq: 20190613 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series (Google Search) https://seclists.org/bugtraq/2019/Jun/14 http://seclists.org/fulldisclosure/2019/Jun/18 http://seclists.org/fulldisclosure/2020/Aug/20 http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html http://secunia.com/advisories/45363
Copyright	Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com

Dies ist nur einer von 99761 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.