[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Mandriva] Schwachstelle in Elinks - MDKSA-2006:216
-----BEGIN PGP SIGNED MESSAGE-----
Liebe Kolleginnen und Kollegen,
soeben erreichte uns nachfolgendes Advisory von Mandriva Security. Wir
geben diese Informationen unveraendert an Sie weiter.
CVE-2006-5925 - Schwachstelle in elinks
Das im Webbrowser elinks enthaltene Modul fuer den Zugriff auf SMB
Server ist fehlerhaft. Sind in einer smb:// Url smbclient Kommandos
enthalten, werden diese ohne Warnung ausgefuehrt. Dies erlaubt einem
entfernten Angreifer mittels eines HTML Dokuments Steuerbefehle an den
SMB-Client zu schicken. Der Angreifer kann auf diese Weise mit
Benutzerrechten auf beliebige Dateien des lokalen Systems sowie SMB
Server zugreifen oder diese ueberschreiben.
Betroffen sind die folgenden Software Pakete und Plattformen:
Paket links
Mandriva 2006.0
Mandriva 2007.0
Vom Hersteller werden ueberarbeitete Pakete zur Verfuegung gestellt.
Hersteller Advisory:
http://www.mandriva.com/security/advisories?name=MDKSA-2006:216
(c) der deutschen Zusammenfassung bei DFN-CERT Services GmbH; die
Verbreitung, auch auszugsweise, ist nur unter Hinweis auf den Urheber,
DFN-CERT Services GmbH, und nur zu nicht kommerziellen Zwecken
gestattet.
Mit freundlichen Gruessen,
Klaus Moeller, DFN-CERT
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2006:216
http://www.mandriva.com/security/
_______________________________________________________________________
Package : links
Date : November 20, 2006
Affected: 2006.0, 2007.0
_______________________________________________________________________
Problem Description:
The links web browser with smbclient installed allows remote attackers
to execute arbitrary code via shell metacharacters in an smb:// URI, as
demonstrated by using PUT and GET statements.
Corporate 3.0 is not affected by this issue, as that version of links
does not have smb:// URI support.
Updated packages have disabled access to smb:// URIs.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5925
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2006.0:
ea08f62d39a09dea86b7d1a5cb51e327 2006.0/i586/links-2.1-0.pre18.5.1.20060mdk.i586.rpm
adbcd46c1caf25846b7ff382ac6eee7d 2006.0/i586/links-common-2.1-0.pre18.5.1.20060mdk.i586.rpm
e87b887c09df5e888c097766e7ec619c 2006.0/i586/links-graphic-2.1-0.pre18.5.1.20060mdk.i586.rpm
ee822254533bf4719ee94223161b7de0 2006.0/SRPMS/links-2.1-0.pre18.5.1.20060mdk.src.rpm
Mandriva Linux 2006.0/X86_64:
796b482155ea5ab249bbe1baabcdd419 2006.0/x86_64/links-2.1-0.pre18.5.1.20060mdk.x86_64.rpm
5f897e5f5d1c712b547bce7fdb7b61d4 2006.0/x86_64/links-common-2.1-0.pre18.5.1.20060mdk.x86_64.rpm
93e5c42924fcafb2fc121c0d69b7f398 2006.0/x86_64/links-graphic-2.1-0.pre18.5.1.20060mdk.x86_64.rpm
ee822254533bf4719ee94223161b7de0 2006.0/SRPMS/links-2.1-0.pre18.5.1.20060mdk.src.rpm
Mandriva Linux 2007.0:
27f5da60ae0072b509e17326146922c1 2007.0/i586/links-2.1-0.pre18.13.1mdv2007.0.i586.rpm
b4dac2435e4622cabf537c4df1749d83 2007.0/i586/links-common-2.1-0.pre18.13.1mdv2007.0.i586.rpm
d33ab06111f877fbccb8f85ceb4044af 2007.0/i586/links-graphic-2.1-0.pre18.13.1mdv2007.0.i586.rpm
04961b71a4a04032a6e335dcaf91aa9d 2007.0/SRPMS/links-2.1-0.pre18.13.1mdv2007.0.src.rpm
Mandriva Linux 2007.0/X86_64:
fe702c658fd4b931c8c79efd9c77010b 2007.0/x86_64/links-2.1-0.pre18.13.1mdv2007.0.x86_64.rpm
5d8d03edf4217e9d3a6ab7f006c5613a 2007.0/x86_64/links-common-2.1-0.pre18.13.1mdv2007.0.x86_64.rpm
e1c5effc08dfbc2e2c8b1bc351f4ea50 2007.0/x86_64/links-debug-2.1-0.pre18.13.1mdv2007.0.x86_64.rpm
8fd02e550d5310ae74e48f002d7da45b 2007.0/x86_64/links-graphic-2.1-0.pre18.13.1mdv2007.0.x86_64.rpm
04961b71a4a04032a6e335dcaf91aa9d 2007.0/SRPMS/links-2.1-0.pre18.13.1mdv2007.0.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
iD8DBQFFYfQXmqjQ0CJFipgRApBLAKDIO3FYiF5JM4CRiigwGYFc/0fjAgCgrJRq
gvRXQIbTpwd2RXYsDXrHt8I=
=ROqA
- -----END PGP SIGNATURE-----
- --
Dipl. Inform. Klaus Moeller (CSIRT), DFN-CERT Services GmbH
https://www.dfn-cert.de/, +49-40-808077-555
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)
iQEVAwUBRWLXvPBT2+ukQ5RFAQEohAf9HMJJPqR0Yao3saS4HDRqhcgB4pYYzpVa
7fEjT5kr7iFQ0hqnh4Ct1uL1ogz9T7vEG2pMaMczGt87ijPLpyQcXvs3HvxU9zdn
6hamRcPHW7qSTnOACWlj6E6BHOD9qg9Su/yypPOLgj+ZNbOulhL+tHJzGQpLjqiX
8ifLxVwMBbiL6zuvMzaDgs8u8LKhIim56RKjuhuEj5WSmq0MKxxdEVw22WFRUVMD
5SaQAlTWG3fSJJv2pwH88kChbGjGIrO9nUtgPCV7N6eEttF8d4BF9L3x37nQcBYl
tP6NKKHPJjGW4/0V9CVQj2Y3Dlq4QlNY8OTr85a3w/Od8Y4fhsDR7w==
=MvjS
-----END PGP SIGNATURE-----