ID de Prueba:	1.3.6.1.4.1.25623.1.0.51586
Categoría:	Conectiva Local Security Checks
Título:	Conectiva Security Advisory CLA-2001:429
Resumen:	NOSUMMARY
Descripción:	Description: The remote host is missing updates announced in advisory CLA-2001:429. The ht://Dig system is a complete world wide web indexing and searching system for a small domain or intranet. The htsearch program is the component used for queries and can be used with a web server using a cgi interface. Nergal reported[1] a vulnerability in htsearch wich allows a remote user to pass the -c parameter (use specific config file) to the program even when it's running as a cgi. A malicious user could point to a file like /dev/zero and let the server run in an endless loop, trying to read config parameters from there. Also, if the user has write permission on the server and can create a file with specific entries, he/she can point the server to it and retrive any file readable by the webserver UID. Solution: The apt tool can be used to perform RPM package upgrades by running 'apt-get update' followed by 'apt-get upgrade' http://sourceforge.net/tracker/index.php?func=detail&aid=458013&group_id=4593& http://www.securityspace.com/smysecure/catid.html?in=CLA-2001:429 http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=002001 Risk factor : High
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.