ID de Prueba:	1.3.6.1.4.1.25623.1.0.63337
Categoría:	Slackware Local Security Checks
Título:	Slackware: Security Advisory (SSA:2009-033-01)
Resumen:	The remote host is missing an update for the 'xdg-utils' package(s) announced via the SSA:2009-033-01 advisory.
Descripción:	Summary: The remote host is missing an update for the 'xdg-utils' package(s) announced via the SSA:2009-033-01 advisory. Vulnerability Insight: New xdg-utils packages are available for Slackware 12.2 and -current to fix security issues. Applications that use /etc/mailcap could be tricked into running an arbitrary script through xdg-open, and a separate flaw in xdg-open could allow the execution of arbitrary commands embedded in untrusted input provided to xdg-open. More details about the issues may be found in the Common Vulnerabilities and Exposures (CVE) database: [links moved to references] Here are the details from the Slackware 12.2 ChangeLog: +--------------------------+ patches/packages/xdg-utils-1.0.2-noarch-3_slack12.2.tgz: This update fixes two security issues. First, use of xdg-open in /etc/mailcap was found to be unsafe -- xdg-open passes along downloaded files without indicating what mime type they initially presented themselves as, leaving programs further down the processing chain to discover the file type again. This makes it rather trivial to present a script (such as a .desktop file) as a document type (like a PDF) so that it looks safe to click on in a browser, but will result in the execution of an arbitrary script. It might be safe to send files to trusted applications in /etc/mailcap, but it does not seem to be safe to send files to xdg-open in /etc/mailcap. This package will comment out calls to xdg-open in /etc/mailcap if they are determined to have been added by a previous version of this package. If you've made any local customizations to /etc/mailcap, be sure to check that there are no uncommented calls to xdg-open after installing this update. Thanks to Manuel Reimer for discovering this issue. For more information, see: [link moved to references] Another bug in xdg-open fails to sanitize input properly allowing the execution of arbitrary commands. This was fixed in the xdg-utils repository quite some time ago (prior to the inclusion of xdg-utils in Slackware), but was never fixed in the official release of xdg-utils. The sources for xdg-utils in Slackware have now been updated from the repo to fix the problem. For more information, see: [link moved to references] (* Security fix *) +--------------------------+ Affected Software/OS: 'xdg-utils' package(s) on Slackware 12.2, Slackware current. Solution: Please install the updated package(s). CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2008-0386 BugTraq ID: 27528 http://www.securityfocus.com/bid/27528 http://security.gentoo.org/glsa/glsa-200801-21.xml http://www.mandriva.com/security/advisories?name=MDVSA-2008:031 http://www.securitytracker.com/id?1019284 http://secunia.com/advisories/28638 http://secunia.com/advisories/28728 http://secunia.com/advisories/29048 SuSE Security Announcement: SUSE-SR:2008:004 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00008.html http://www.vupen.com/english/advisories/2008/0342 Common Vulnerability Exposure (CVE) ID: CVE-2009-0068 BugTraq ID: 33137 http://www.securityfocus.com/bid/33137 https://bugs.freedesktop.org/show_bug.cgi?id=19377 http://www.openwall.com/lists/oss-security/2009/01/06/1
Copyright	Copyright (C) 2012 Greenbone AG

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.