PT-2014-2138 · Suse · Suse Studio Extension For System Z+2

Thomas Biege · Publicado 2014-04-16 · Atualizado 2014-04-17 · CVE-2011-3180

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions kiwi versions prior to 4.98.08 SUSE Studio Onsite versions prior to 1.2.1 SUSE Studio Extension for System z versions prior to 1.2.1

Description The issue allows attackers to execute arbitrary commands via shell metacharacters in the path of an overlay file, related to chown.

Recommendations For kiwi versions prior to 4.98.08, update to version 4.98.08 or later to resolve the issue. For SUSE Studio Onsite versions prior to 1.2.1, update to version 1.2.1 or later. For SUSE Studio Extension for System z versions prior to 1.2.1, update to version 1.2.1 or later.

Exploit

Correção

Identificadores relacionados

CVE-2011-3180

Produtos afetados

Suse Studio Extension For System Z

Suse Studio Onsite

Kiwi

Referências · 4

• 🔥 https://github.com/openSUSE/kiwi/commit/f0f74b3f6ac6d47f7919aa9db380c0ad41ffe55f# · Exploit
• http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00015.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-3180 · Nota de Segurança
• http://openwall.com/lists/oss-security/2011/11/02/4 · Nota