|Category:||Ubuntu Local Security Checks|
|Title:||Ubuntu USN-198-1 (cfengine)|
|Summary:||Ubuntu USN-198-1 (cfengine)|
The remote host is missing an update to cfengine
announced via advisory USN-198-1.
A security issue affects the following Ubuntu releases:
Ubuntu 4.10 (Warty Warthog)
Ubuntu 5.04 (Hoary Hedgehog)
The following packages are affected: cfengine
Javier Fernandez-Sanguino Pena discovered that several tools in the
cfengine package (vicf, cfmailfilter, and cfcron) create and use
temporary files in an insecure way. A local attacker could exploit
this with a symlink attack to create or overwrite arbitrary files with
the privileges of the user running the cfengine program.
The problem can be corrected by upgrading the affected package to
version 1.6.5-1ubuntu0.4.10.1 (for Ubuntu 4.10), or
1.6.5-1ubuntu0.5.04.1 (for Ubuntu 5.04). In general, a standard
system upgrade is sufficient to effect the necessary changes.
Risk factor : Medium
Common Vulnerability Exposure (CVE) ID: CVE-2005-2960|
Debian Security Information: DSA-835 (Google Search)
Debian Security Information: DSA-836 (Google Search)
SuSE Security Announcement: SUSE-SR:2005:023 (Google Search)
BugTraq ID: 14994
XForce ISS Database: cfengine-mulitple-file-symlink(22489)
Common Vulnerability Exposure (CVE) ID: CVE-2005-3137
|Copyright||Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com|
|This is only one of 58880 vulnerability tests in our test suite. Find out more about running a complete security audit.|
To run a free test of this vulnerability against your system, register below.