ID de Prueba:	1.3.6.1.4.1.25623.1.0.51219
Categoría:	Red Hat Local Security Checks
Título:	RedHat Security Advisory RHSA-2002:256
Resumen:	NOSUMMARY
Descripción:	Description: The remote host is missing updates announced in advisory RHSA-2002:256. The wget packages shipped with Red Hat Linux Advanced Server 2.1 contain a security bug which, under certain circumstances, can cause local files to be written outside the download directory. [Updated 09 Jan 2003] Added fixed packages for the Itanium (IA64) architecture. [Updated 06 Feb 2003] Added fixed packages for Advanced Workstation 2.1 Versions of wget prior to 1.8.2-4 contain a bug that permits a malicious FTP server to create or overwrite files anywhere on the local file system. FTP clients must check to see if an FTP server's response to the NLST command includes any directory information along with the list of filenames required by the FTP protocol (RFC 959, section 4.1.3). If the FTP client fails to do so, a malicious FTP server can send filenames beginning with '/' or containing '/../' which can be used to direct a vulnerable FTP client to write files (such as .forward, .rhosts, .shost, etc.) that can then be used for later attacks against the client machine. All users of wget should upgrade to the errata packages which are not vulnerable to this issue. Thanks to Steven M. Christey for his work in discovering this issue in current FTP clients and for providing a patched FTP server to verify the new packages. Solution: Please note that this update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date http://rhn.redhat.com/errata/RHSA-2002-256.html http://marc.theaimsgroup.com/?l=bugtraq&m=87602746719482 Risk factor : Medium CVSS Score: 5.0
Referencia Cruzada:	BugTraq ID: 6352 Common Vulnerability Exposure (CVE) ID: CVE-2002-1344 http://www.securityfocus.com/bid/6352 BugTraq ID: 6360 http://www.securityfocus.com/bid/6360 Bugtraq: 20021211 Directory Traversal Vulnerabilities in FTP Clients (Google Search) http://marc.info/?l=bugtraq&m=103962838628940&w=2 Bugtraq: 20021219 TSLSA-2002-0089 - wget (Google Search) http://marc.info/?l=bugtraq&m=104033016703851&w=2 Caldera Security Advisory: CSSA-2003.003.0 http://www.securityfocus.com/archive/1/307045/30/26300/threaded CERT/CC vulnerability note: VU#210148 http://www.kb.cert.org/vuls/id/210148 Computer Incident Advisory Center Bulletin: N-022 http://www.ciac.org/ciac/bulletins/n-022.shtml Conectiva Linux advisory: CLA-2002:552 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000552 Conectiva Linux advisory: CLSA-2002:552 http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000552 Debian Security Information: DSA-209 (Google Search) https://www.debian.org/security/2002/dsa-209 http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-086.php http://www.openpkg.com/security/advisories/OpenPKG-SA-2003.007.html http://www.redhat.com/support/errata/RHSA-2002-229.html http://www.redhat.com/support/errata/RHSA-2002-256.html SCO Security Bulletin: CSSA-2003-003.0 ftp://ftp.sco.com/pub/security/OpenLinux/CSSA-2003-003.0.txt http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0102.html http://www.iss.net/security_center/static/10820.php
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.