PT-2014-2165 · Suse · Suse Studio Extension For System Z+2

Publicado 2014-04-16 · Atualizado 2014-04-17 · CVE-2011-4192

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions kiwi versions prior to 4.85.1 SUSE Studio Onsite versions prior to 1.2.1 SUSE Studio Extension for System z versions prior to 1.2.1

Description The issue allows attackers to execute arbitrary commands. This can be demonstrated by using double quotes in kiwi oemtitle of .profile.

Recommendations For kiwi versions prior to 4.85.1, update to version 4.85.1 or later. For SUSE Studio Onsite versions prior to 1.2.1, update to version 1.2.1 or later. For SUSE Studio Extension for System z versions prior to 1.2.1, update to version 1.2.1 or later.

Correção

Identificadores relacionados

CVE-2011-4192

Produtos afetados

Suse Studio Extension For System Z

Suse Studio Onsite

Kiwi

Referências · 2

• http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00015.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-4192 · Nota de Segurança