ID de Prueba:	1.3.6.1.4.1.25623.1.0.60637
Categoría:	Mandrake Local Security Checks
Título:	Mandrake Security Advisory MDVSA-2008:079 (sarg)
Resumen:	NOSUMMARY
Descripción:	Description: The remote host is missing an update to sarg announced via advisory MDVSA-2008:079. A stack-based buffer overflow in sarg (Squid Analysis Report Generator) allowed remote attackers to execute arbitrary code via a long Squid proxy server User-Agent header (CVE-2008-1167). A cross-site scripting vulnerability in sarg version 2.x prior to 2.2.5 allowed remote attackers to inject arbitrary web script or HTML via the User-Agent heder, which is not properly handled when displaying the Squid proxy log (CVE-2008-1168). In addition, a number of other fixes have been made such as making the getword() function more robust which should prevent any overflows, other segfaults have been fixed, and the useragent report is now more consistent with the other reports. The updated packages have been patched to correct these issues. Affected: 2007.0, 2007.1, 2008.0, Multi Network Firewall 2.0 Solution: To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. http://www.securityspace.com/smysecure/catid.html?in=MDVSA-2008:079 Risk factor : Critical CVSS Score: 10.0
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2008-1167 BugTraq ID: 28077 http://www.securityfocus.com/bid/28077 Bugtraq: 20080302 Squid Analysis Report Generator <= 2.2.3.1 buffer overflow (Google Search) http://www.securityfocus.com/archive/1/489018/100/0/threaded http://www.gentoo.org/security/en/glsa/glsa-200803-21.xml http://www.mandriva.com/security/advisories?name=MDVSA-2008:079 http://www.securitytracker.com/id?1019536 http://secunia.com/advisories/28668 http://secunia.com/advisories/29309 http://secunia.com/advisories/29323 http://secunia.com/advisories/29500 SuSE Security Announcement: SUSE-SR:2008:006 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.html http://www.vupen.com/english/advisories/2008/0749 XForce ISS Database: sarg-useragent-bo(40970) https://exchange.xforce.ibmcloud.com/vulnerabilities/40970 Common Vulnerability Exposure (CVE) ID: CVE-2008-1168 http://sourceforge.net/project/shownotes.php?release_id=581509 http://www.vupen.com/english/advisories/2008/0750/references XForce ISS Database: sarg-useragent-xss(40972) https://exchange.xforce.ibmcloud.com/vulnerabilities/40972
Copyright	Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.