"Gentoo Linux Security Advisory GLSA 200911-06
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: High
Title: PEAR Net_Traceroute: Command injection
Date: November 26, 2009
Bugs: #294264
ID: 200911-06
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
An input sanitation error in PEAR Net_Traceroute might allow remote
attackers to execute arbitrary commands.
Background
==========
PEAR Net_Traceroute is an OS independent wrapper class for executing
traceroute calls from PHP.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 dev-php/PEAR-Net_Traceroute = 0.21.2
Description
===========
Pasquale Imperato reported that the $host parameter to the traceroute()
function in Traceroute.php is not properly sanitized before being
passed to exec().
Impact
======
A remote attacker could exploit this vulnerability when user input is
passed directly to PEAR Net_Traceroute in a PHP script, possibly
resulting in the remote execution of arbitrary shell commands with the
privileges of the user running the affected PHP script.
Workaround
==========
Ensure that all data that is passed to the traceroute() function is
properly shell escaped (for instance using the escapeshellcmd()
function).
Resolution
==========
All PEAR Net_Traceroute users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose
">=dev-php/PEAR-Net_Traceroute-0.21.2"
References
==========
[ 1 ] CVE-2009-4025
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4025
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200911-06.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2009 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
"
Ronan Keating suffering anxiety attacks since Stephen Gatelys deathGLSA 200910-02 Pidgin: Multiple vulnerabilities
This entry was posted
on 5:20 PM
.
Archives
-
▼
2009
(488)
-
▼
November
(49)
- RHSA-2009:1620-01 Moderate: bind security update
- RHSA-2009:1615-01 Moderate: xerces-j2 security update
- DSA 1942-1: New wireshark packages fix several vul...
- GLSA 200911-04 dstat: Untrusted search path
- GLSA 200911-06 PEAR Net_Traceroute: Command injec...
- DSA 1939-1: New libvorbis packages fix several vul...
- DSA 1941-1: New poppler packages fix several vulne...
- RHSA-2009:1601-01 Critical: kdelibs security update
- GLSA 200911-05 Wireshark: Multiple vulnerabilities
- USN-861-1: libvorbis vulnerabilities
- DSA 1938-1: New php-mail packages fix insufficient...
- DSA 1937-1: New gforge packages fix cross-site scr...
- DSA-1934-1: New apache2 packages fix several issues
- USN-859-1: OpenJDK vulnerabilities
- USN-860-1: Apache vulnerabilities
- RHSA-2009:1595-01 Moderate: cups security update
- RHSA-2009:1587-01 Important: kernel security and b...
- GLSA 200911-02 Sun JDK/JRE: Multiple vulnerabilites
- DSA 1936-1: New libgd2 packages fix several vulner...
- RHSA-2009:1588-02 Important: kernel security update
- DSA 1935-1: New gnutls23/gnutls26 packages fix SSL...
- RHSA-2009:1585-01 Moderate: samba3x security and b...
- RHSA-2009:1584-01 Important: java-1.6.0-openjdk se...
- RHSA-2009:1580-02 Moderate: httpd security update
- DSA 1933-1: New cups packages fix cross-site scrip...
- USN-858-1: OpenLDAP vulnerability
- DSA 1932-1: New pidgin packages fix arbitrary code...
- RHSA-2009:1582-01 Critical: java-1.6.0-ibm securit...
- RHSA-2009:1561-01 Important: libvorbis security up...
- RHSA-2009:1562-01 Important: tomcat security update
- USN-853-2: Firefox and Xulrunner regression
- USN-854-1: GD library vulnerabilities
- DSA 1928-1: New Linux 2.6.24 packages fix several ...
- RHSA-2009:1540-01 Important: kernel-rt security, b...
- RHSA-2009:1550-01 Important: kernel security and b...
- RHSA-2009:1541-01 Important: kernel security update
- USN-850-3: poppler vulnerabilities
- DSA 1927-1: New Linux 2.6.26 packages fix several ...
- USN-855-1: libhtml-parser-perl vulnerability
- RHSA-2009:1548-01 Important: kernel security and b...
- RHSA-2009:1530-01 Critical: firefox security update
- DSA 1924-1: New mahara packages fix several vulner...
- USN-853-1: Firefox and Xulrunner vulnerabilities
- RHSA-2009:1528-01 Moderate: samba security and bug...
- RHSA-2009:1531-01 Critical: seamonkey security update
- DSA 1922-1: New xulrunner packages fix several vul...
- DSA 1923-1: New libhtml-parser-perl packages fix d...
- RHSA-2009:1535-01 Moderate: pidgin security update
- DSA 1921-1: New expat packages fix denial of service
-
▼
November
(49)