English | Deutsch | Español | Português
 ID de Usuario:
 Contraseña:
Nuevo usuario
 Acerca de:   Dedicada | Avanzada | Estándar | Periódica | Sin Riesgo | Escritorio | Básica | Individual | Sello | FAQ
  Resumen de Precio/Funciones | Ordenar  | Nuevas Vulnerabilidades | Confidencialidad | Búsqueda de Vulnerabilidad
 Búsqueda de    
Vulnerabilidad   
    Buscar 75803 Descripciones CVE y
40037 Descripciones de Pruebas,
accesos 10,000+ referencias cruzadas.
Pruebas   CVE   Todos  

ID de Prueba:1.3.6.1.4.1.25623.1.0.71113
Categoría:Red Hat Local Security Checks
Título:RedHat Security Advisory RHSA-2012:0308
Resumen:Redhat Security Advisory RHSA-2012:0308
Descripción:The remote host is missing updates announced in
advisory RHSA-2012:0308.

BusyBox provides a single binary that includes versions of a large number
of system commands, including a shell. This can be very useful for
recovering from certain types of system failures, particularly those
involving broken shared libraries.

A buffer underflow flaw was found in the way the uncompress utility of
BusyBox expanded certain archive files compressed using Lempel-Ziv
compression. If a user were tricked into expanding a specially-crafted
archive file with uncompress, it could cause BusyBox to crash or,
potentially, execute arbitrary code with the privileges of the user running
BusyBox. (CVE-2006-1168)

The BusyBox DHCP client, udhcpc, did not sufficiently sanitize certain
options provided in DHCP server replies, such as the client hostname. A
malicious DHCP server could send such an option with a specially-crafted
value to a DHCP client. If this option's value was saved on the client
system, and then later insecurely evaluated by a process that assumes the
option is trusted, it could lead to arbitrary code execution with the
privileges of that process. Note: udhcpc is not used on Red Hat Enterprise
Linux by default, and no DHCP client script is provided with the busybox
packages. (CVE-2011-2716)

This update also fixes the following bugs:

* Prior to this update, the cp command wrongly returned the exit code 0 to
indicate success if a device ran out of space while attempting to copy
files of more than 4 gigabytes. This update modifies BusyBox, so that in
such situations, the exit code 1 is returned. Now, the cp command shows
correctly whether a process failed. (BZ#689659)

* Prior to this update, the findfs command failed to check all existing
block devices on a system with thousands of block device nodes in /dev/.
This update modifies BusyBox so that findfs checks all block devices even
in this case. (BZ#756723)

All users of busybox are advised to upgrade to these updated packages,
which correct these issues.

Solution:
Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date

http://rhn.redhat.com/errata/RHSA-2012-0308.html

Risk factor : Low
Referencia Cruzada: Common Vulnerability Exposure (CVE) ID: CVE-2006-1168
http://bugs.gentoo.org/show_bug.cgi?id=141728
https://bugzilla.redhat.com/show_bug.cgi?id=728536
Debian Security Information: DSA-1149 (Google Search)
http://www.debian.org/security/2006/dsa-1149
http://security.gentoo.org/glsa/glsa-200610-03.xml
http://www.mandriva.com/security/advisories?name=MDKSA-2006:140
http://www.mandriva.com/security/advisories?name=MDVSA-2012:129
http://www.redhat.com/support/errata/RHSA-2006-0663.html
RedHat Security Advisories: RHSA-2012:0810
http://rhn.redhat.com/errata/RHSA-2012-0810.html
SGI Security Advisory: 20060901-01-P
ftp://patches.sgi.com/support/free/security/advisories/20060901-01-P.asc
SuSE Security Announcement: SUSE-SR:2006:020 (Google Search)
http://www.novell.com/linux/security/advisories/2006_20_sr.html
BugTraq ID: 19455
http://www.securityfocus.com/bid/19455
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9373
http://www.vupen.com/english/advisories/2006/3234
http://securitytracker.com/id?1016836
http://secunia.com/advisories/21427
http://secunia.com/advisories/21434
http://secunia.com/advisories/21437
http://secunia.com/advisories/21880
http://secunia.com/advisories/22036
http://secunia.com/advisories/22296
http://secunia.com/advisories/22377
http://secunia.com/advisories/21467
XForce ISS Database: ncompress-decompress-underflow(28315)
http://xforce.iss.net/xforce/xfdb/28315
Common Vulnerability Exposure (CVE) ID: CVE-2011-2716
BugTraq ID: 48879
http://www.securityfocus.com/bid/48879
http://secunia.com/advisories/45363
CopyrightCopyright (c) 2012 E-Soft Inc. http://www.securityspace.com

Esta es sólo una de 40037 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa.

Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.

Registro de Nuevo Usuario
Email:
Usuario:
Contraseña:
Envíeme por email sus boletines mensuales, informándome los últimos servicios, mejoras y encuestas.
Por favor envíeme por email un anuncio de prueba de vulnerabilidades siempre que se agregue una nueva prueba.
   Privacidad
Ingreso de Usuario Registrado
 
Usuario:   
Contraseña:  

 ¿Olvidó su usuario o contraseña??
Email/ID de Usario:




Principal | Acerca de Nosotros | Contáctenos | Programas de Asociado | Developer APIs | Privacidad | Listas de Correo | Abuso
Auditorías de Seguridad | DNS Administrado | Monitoreo de Red | Analizador de Sitio | Informes de Investigación de Internet
Prueba de Web | Whois

© 1998-2014 E-Soft Inc. Todos los derechos reservados.