Test ID:	1.3.6.1.4.1.25623.1.0.703010
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-3010-1)
Summary:	The remote host is missing an update for the Debian 'python-django' package(s) announced via the DSA-3010-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'python-django' package(s) announced via the DSA-3010-1 advisory. Vulnerability Insight: Several vulnerabilities were discovered in Django, a high-level Python web development framework. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2014-0480 Florian Apolloner discovered that in certain situations, URL reversing could generate scheme-relative URLs which could unexpectedly redirect a user to a different host, leading to phishing attacks. CVE-2014-0481 David Wilson reported a file upload denial of service vulnerability. Django's file upload handling in its default configuration may degrade to producing a huge number of `os.stat()` system calls when a duplicate filename is uploaded. A remote attacker with the ability to upload files can cause poor performance in the upload handler, eventually causing it to become very slow. CVE-2014-0482 David Greisen discovered that under some circumstances, the use of the RemoteUserMiddleware middleware and the RemoteUserBackend authentication backend could result in one user receiving another user's session, if a change to the REMOTE_USER header occurred without corresponding logout/login actions. CVE-2014-0483 Collin Anderson discovered that it is possible to reveal any field's data by modifying the popup and to_field parameters of the query string on an admin change form page. A user with access to the admin interface, and with sufficient knowledge of model structure and the appropriate URLs, could construct popup views which would display the values of non-relationship fields, including fields the application developer had not intended to expose in such a fashion. For the stable distribution (wheezy), these problems have been fixed in version 1.4.5-1+deb7u8. For the unstable distribution (sid), these problems have been fixed in version 1.6.6-1. We recommend that you upgrade your python-django packages. Affected Software/OS: 'python-django' package(s) on Debian 7. Solution: Please install the updated package(s). CVSS Score: 6.0 CVSS Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2014-0480 BugTraq ID: 69425 http://www.securityfocus.com/bid/69425 Debian Security Information: DSA-3010 (Google Search) http://www.debian.org/security/2014/dsa-3010 http://secunia.com/advisories/59782 http://secunia.com/advisories/61276 http://secunia.com/advisories/61281 SuSE Security Announcement: openSUSE-SU-2014:1132 (Google Search) http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html Common Vulnerability Exposure (CVE) ID: CVE-2014-0481 Common Vulnerability Exposure (CVE) ID: CVE-2014-0482 Common Vulnerability Exposure (CVE) ID: CVE-2014-0483
Copyright	Copyright (C) 2014 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.