ID de Prueba:	1.3.6.1.4.1.25623.1.0.50719
Categoría:	Mandrake Local Security Checks
Título:	Mandrake Security Advisory MDKSA-2003:058-1 (cdrecord)
Resumen:	NOSUMMARY
Descripción:	Description: The remote host is missing an update to cdrecord announced via advisory MDKSA-2003:058-1. A vulnerability in cdrecord was discovered that can be used to obtain root access because Mandrake Linux ships with the cdrecord binary suid root and sgid cdwriter. Updated packages are provided that fix this vulnerability. You may also elect to remove the suid and sgid bits from cdrecord manually, which can be done by executing, as root: chmod ug-s /usr/bin/cdrecord This is not required to protect yourself from this particular vulnerability, however. Update: Two additional format string problems were discovered by Olaf Kirch and an updated patch has been applied to fix those problems as well. Affected versions: 8.2, 9.0, 9.1, Corporate Server 2.1 Solution: To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. http://www.securityspace.com/smysecure/catid.html?in=MDKSA-2003:058-1 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0289 http://marc.theaimsgroup.com/?l=bugtraq&m=105285564307225&w=2 Risk factor : High CVSS Score: 7.2
Referencia Cruzada:	BugTraq ID: 7565 Common Vulnerability Exposure (CVE) ID: CVE-2003-0289 http://www.securityfocus.com/bid/7565 Bugtraq: 20030513 Cdrecord_local_root_exploit. (Google Search) http://marc.info/?l=bugtraq&m=105286031812533&w=2 Bugtraq: 20030513 cdrtools2.0 Format String Vulnerability (Google Search) http://marc.info/?l=bugtraq&m=105285564307225&w=2 http://forums.gentoo.org/viewtopic.php?t=54904 http://www.mandriva.com/security/advisories?name=MDKSA-2003:058 http://www.securiteam.com/exploits/5ZP0C2AAAC.html XForce ISS Database: cdrtools-scsiopen-format-string(12007) https://exchange.xforce.ibmcloud.com/vulnerabilities/12007
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.