PT-2014-2167 · Suse · Suse Studio Extension For System Z+2

Thomas Biege · Publicado 2014-04-16 · Atualizado 2014-04-17 · CVE-2011-4195

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SUSE Studio Onsite versions 1.2 through 1.2 before 1.2.1 SUSE Studio Extension for System z versions 1.2 through 1.2 before 1.2.1 kiwi versions prior to 4.98.05

Description The issue allows attackers to execute arbitrary commands via shell metacharacters in an image name.

Recommendations For SUSE Studio Onsite version 1.2, update to version 1.2.1. For SUSE Studio Extension for System z version 1.2, update to version 1.2.1. For kiwi versions prior to 4.98.05, update to version 4.98.05 or later.

Exploit

Correção

Identificadores relacionados

CVE-2011-4195

Produtos afetados

Suse Studio Extension For System Z

Suse Studio Onsite

Kiwi

Referências · 4

• 🔥 https://github.com/openSUSE/kiwi/commit/88bf491d16942766016c606e4210b4e072c1019f · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-4195 · Nota de Segurança
• http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00015.html · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2011/11/02/4 · Nota