Test ID:	1.3.6.1.4.1.25623.1.0.52036
Category:	Mandrake Local Security Checks
Title:	Mandrake Security Advisory MDKSA-2005:067 (sharutils)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to sharutils announced via advisory MDKSA-2005:067. Shaun Colley discovered a buffer overflow in shar that was triggered by output files (using -o) with names longer than 49 characters which could be exploited to run arbitrary attacker-specified code. Ulf Harnhammar discovered that shar does not check the data length returned by the wc command. Joey Hess discovered that unshar would create temporary files in an insecure manner which could allow a symbolic link attack to create or overwrite arbitrary files with the privileges of the user using unshar. The updated packages have been patched to correct these issues. Affected versions: 10.0, 10.1, Corporate 3.0, Corporate Server 2.1 Solution: To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. http://www.securityspace.com/smysecure/catid.html?in=MDKSA-2005:067 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=302412 Risk factor : High CVSS Score: 7.5
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2004-1772 BugTraq ID: 10066 http://www.securityfocus.com/bid/10066 Bugtraq: 20040406 GNU Sharutils buffer overflow vulnerability. (Google Search) http://www.securityfocus.com/archive/1/359639 https://bugzilla.fedora.us/show_bug.cgi?id=2155 http://marc.info/?l=bugtraq&m=108137386310299&w=2 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11722 http://www.redhat.com/support/errata/RHSA-2005-377.html XForce ISS Database: sharutils-shar-bo(15759) https://exchange.xforce.ibmcloud.com/vulnerabilities/15759 Common Vulnerability Exposure (CVE) ID: CVE-2004-1773 BugTraq ID: 11298 http://www.securityfocus.com/bid/11298 http://security.gentoo.org/glsa/glsa-200410-01.xml https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11093
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.