| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <E1W6m0v-000474-73@titan.mandriva.com> Date: Fri, 24 Jan 2014 20:02:00 +0100 From: security@...driva.com To: full-disclosure@...ts.grok.org.uk Subject: [ MDVSA-2014:022 ] augeas -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2014:022 http://www.mandriva.com/en/support/security/ _______________________________________________________________________ Package : augeas Date : January 24, 2014 Affected: Business Server 1.0 _______________________________________________________________________ Problem Description: Updated augeas packages fix security vulnerabilities: Multiple flaws were found in the way Augeas handled configuration files when updating them. An application using Augeas to update configuration files in a directory that is writable to by a different user (for example, an application running as root that is updating files in a directory owned by a non-root service user) could have been tricked into overwriting arbitrary files or leaking information via a symbolic link or mount point attack (CVE-2012-0786, CVE-2012-0787). A flaw was found in the way Augeas handled certain umask settings when creating new configuration files. This flaw could result in configuration files being created as world writable, allowing unprivileged local users to modify their content (CVE-2013-6412). _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0786 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0787 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6412 https://rhn.redhat.com/errata/RHSA-2013-1537.html https://rhn.redhat.com/errata/RHSA-2014-0044.html _______________________________________________________________________ Updated Packages: Mandriva Business Server 1/X86_64: 799a59ca268bf8f01dcdf8bfdb5e038f mbs1/x86_64/augeas-1.1.0-1.1.mbs1.x86_64.rpm 83a4643fa57cdab5a5191999bc687925 mbs1/x86_64/augeas-lenses-1.1.0-1.1.mbs1.x86_64.rpm 19623ba70567eed99d718bcad1ce9a35 mbs1/x86_64/lib64augeas0-1.1.0-1.1.mbs1.x86_64.rpm 7f039c5e0a965cfa21fda1dceba9e22f mbs1/x86_64/lib64augeas-devel-1.1.0-1.1.mbs1.x86_64.rpm 123fda0cfde74d4b5f19a0d3ecffe323 mbs1/x86_64/lib64fa1-1.1.0-1.1.mbs1.x86_64.rpm 9bc8bccb4b3d3a7901b018a604e5f5fb mbs1/SRPMS/augeas-1.1.0-1.1.mbs1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFS4o6FmqjQ0CJFipgRAqzXAJ9mMIeUMIprErjkvjDP1wMn+C5tSQCgsZKu k5Ku18i2UyRIA0FjIE89kQ8= =F2IH -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists