ID de Prueba:	1.3.6.1.4.1.25623.1.0.69671
Categoría:	Mandrake Local Security Checks
Título:	Mandriva Security Advisory MDVSA-2011:096 (python)
Resumen:	NOSUMMARY
Descripción:	Description: The remote host is missing an update to python announced via advisory MDVSA-2011:096. Multiple vulnerabilities have been identified and fixed in python: The is_cgi method in CGIHTTPServer.py in the CGIHTTPServer module in Python 2.5, 2.6, and 3.0 allows remote attackers to read script source code via an HTTP GET request that lacks a / (slash) character at the beginning of the URI (CVE-2011-1015). A flaw was found in the Python urllib and urllib2 libraries where they would not differentiate between different target URLs when handling automatic redirects. This caused Python applications using these modules to follow any new URL that they understood, including the file:// URL type. This could allow a remote server to force a local Python application to read a local file instead of the remote one, possibly exposing local files that were not meant to be exposed (CVE-2011-1521). Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more: http://store.mandriva.com/product_info.php?cPath=149&products_id=490 The updated packages have been patched to correct this issue. Affected: 2009.0, 2010.1, Corporate 4.0, Enterprise Server 5.0 Solution: To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. http://www.securityspace.com/smysecure/catid.html?in=MDVSA-2011:096 Risk factor : High CVSS Score: 6.4
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2011-1015 1025489 http://securitytracker.com/id?1025489 46541 http://www.securityfocus.com/bid/46541 50858 http://secunia.com/advisories/50858 51024 http://secunia.com/advisories/51024 51040 http://secunia.com/advisories/51040 MDVSA-2011:096 http://www.mandriva.com/security/advisories?name=MDVSA-2011:096 USN-1596-1 http://www.ubuntu.com/usn/USN-1596-1 USN-1613-1 http://www.ubuntu.com/usn/USN-1613-1 USN-1613-2 http://www.ubuntu.com/usn/USN-1613-2 [oss-security] 20110223 CVE request: Information disclosure in CGIHTTPServer from Python http://openwall.com/lists/oss-security/2011/02/23/27 [oss-security] 20110224 Re: CVE request: Information disclosure in CGIHTTPServer from Python http://openwall.com/lists/oss-security/2011/02/24/10 http://bugs.python.org/issue2254 http://hg.python.org/cpython/rev/c6c4398293bd/ http://svn.python.org/view?view=revision&revision=71303 https://bugzilla.redhat.com/show_bug.cgi?id=680094 Common Vulnerability Exposure (CVE) ID: CVE-2011-1521 http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html http://openwall.com/lists/oss-security/2011/03/24/5 http://openwall.com/lists/oss-security/2011/03/28/2 http://openwall.com/lists/oss-security/2011/09/11/1 http://openwall.com/lists/oss-security/2011/09/13/2 http://openwall.com/lists/oss-security/2011/09/15/5 http://securitytracker.com/id?1025488 SuSE Security Announcement: SUSE-SR:2011:009 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html http://www.ubuntu.com/usn/USN-1592-1
Copyright	Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.