ID de Prueba:	1.3.6.1.4.1.25623.1.0.69809
Categoría:	Red Hat Local Security Checks
Título:	RedHat Security Advisory RHSA-2011:0953
Resumen:	NOSUMMARY
Descripción:	Description: The remote host is missing updates announced in advisory RHSA-2011:0953. system-config-firewall is a graphical user interface for basic firewall setup. It was found that system-config-firewall used the Python pickle module in an insecure way when sending data (via D-Bus) to the privileged back-end mechanism. A local user authorized to configure firewall rules using system-config-firewall could use this flaw to execute arbitrary code with root privileges, by sending a specially-crafted serialized object. (CVE-2011-2520) Red Hat would like to thank Marco Slaviero of SensePost for reporting this issue. This erratum updates system-config-firewall to use JSON (JavaScript Object Notation) for data exchange, instead of pickle. Therefore, an updated version of system-config-printer that uses this new communication data format is also provided in this erratum. Users of system-config-firewall are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. Running instances of system-config-firewall must be restarted before the utility will be able to communicate with its updated back-end. Solution: Please note that this update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date http://rhn.redhat.com/errata/RHSA-2011-0953.html Risk factor : High CVSS Score: 6.0
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2011-2520 1025793 http://securitytracker.com/id?1025793 45294 http://secunia.com/advisories/45294 48715 http://www.securityfocus.com/bid/48715 FEDORA-2011-9652 http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063314.html RHSA-2011:0953 http://www.redhat.com/support/errata/RHSA-2011-0953.html [oss-security] 20110718 CVE-2011-2520: flaw in system-config-firewall's usage of pickle allows privilege escalation http://www.openwall.com/lists/oss-security/2011/07/18/6 https://bugzilla.redhat.com/show_bug.cgi?id=717985 systemconfigfirewall-priv-escalation(68734) https://exchange.xforce.ibmcloud.com/vulnerabilities/68734
Copyright	Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.