Test ID:	1.3.6.1.4.1.25623.1.0.702827
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-2827-1)
Summary:	The remote host is missing an update for the Debian 'libcommons-fileupload-java' package(s) announced via the DSA-2827-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'libcommons-fileupload-java' package(s) announced via the DSA-2827-1 advisory. Vulnerability Insight: It was discovered that Apache Commons FileUpload, a package to make it easy to add robust, high-performance, file upload capability to servlets and web applications, incorrectly handled file names with NULL bytes in serialized instances. A remote attacker able to supply a serialized instance of the DiskFileItem class, which will be deserialized on a server, could use this flaw to write arbitrary content to any location on the server that is accessible to the user running the application server process. For the oldstable distribution (squeeze), this problem has been fixed in version 1.2.2-1+deb6u1. For the stable distribution (wheezy), this problem has been fixed in version 1.2.2-1+deb7u1. For the testing distribution (jessie), this problem has been fixed in version 1.3-2.1. For the unstable distribution (sid), this problem has been fixed in version 1.3-2.1. We recommend that you upgrade your libcommons-fileupload-java packages. Affected Software/OS: 'libcommons-fileupload-java' package(s) on Debian 6, Debian 7. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2013-2186 55716 http://secunia.com/advisories/55716 63174 http://www.securityfocus.com/bid/63174 DSA-2827 http://www.debian.org/security/2013/dsa-2827 RHSA-2013:1428 http://rhn.redhat.com/errata/RHSA-2013-1428.html RHSA-2013:1429 http://rhn.redhat.com/errata/RHSA-2013-1429.html RHSA-2013:1430 http://rhn.redhat.com/errata/RHSA-2013-1430.html RHSA-2013:1442 http://rhn.redhat.com/errata/RHSA-2013-1442.html RHSA-2013:1448 http://rhn.redhat.com/errata/RHSA-2013-1448.html RHSA-2016:0070 https://access.redhat.com/errata/RHSA-2016:0070 SUSE-SU-2013:1660 http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00008.html USN-2029-1 http://ubuntu.com/usn/usn-2029-1 apache-commons-cve20132186-file-overrwite(88133) https://exchange.xforce.ibmcloud.com/vulnerabilities/88133 http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01 https://www.tenable.com/security/research/tra-2016-23 openSUSE-SU-2013:1571 http://lists.opensuse.org/opensuse-updates/2013-10/msg00033.html openSUSE-SU-2013:1596 http://lists.opensuse.org/opensuse-updates/2013-10/msg00050.html
Copyright	Copyright (C) 2013 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.