Weex: Format string vulnerability
漏洞ID | 1053308 | 漏洞类型 | |
发布时间 | 2005-10-09 | 更新时间 | 2005-10-09 |
CVE编号 | N/A | CNNVD-ID | N/A |
漏洞平台 | N/A | CVSS评分 | N/A |
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200510-09
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: Weex: Format string vulnerability
Date: October 08, 2005
Bugs: #107849
ID: 200510-09
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Weex contains a format string error that may be exploited by malicious
servers to execute arbitrary code.
Background
==========
Weex is a non-interactive FTP client typically used to update web
pages.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-ftp/weex < 2.6.1.5-r1 >= 2.6.1.5-r1
Description
===========
Ulf Harnhammar discovered a format string bug in Weex that can be
triggered when it is first run (or when its cache files are rebuilt,
using the -r option).
Impact
======
An attacker could setup a malicious FTP server which, when accessed
using Weex, could trigger the format string bug and end up executing
arbitrary code with the rights of the user running Weex.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Weex users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-ftp/weex-2.6.1.5-r1"
References
==========
[ 1 ] CAN-2005-3150
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-3150
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200510-09.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security (at) gentoo (dot) org [email concealed] or alternatively, you may file a bug at
http://bugs.gentoo.org.
License
=======
Copyright 2005 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.0
相关推荐: Mozilla FTP View跨站脚本攻击漏洞
Mozilla FTP View跨站脚本攻击漏洞 漏洞ID 1106904 漏洞类型 跨站脚本 发布时间 2002-08-06 更新时间 2002-12-31 CVE编号 CVE-2002-2359 CNNVD-ID CNNVD-200212-275 漏洞平台…
© 版权声明
文章版权归作者所有,未经允许请勿转载。
THE END
喜欢就支持一下吧
恐龙抗狼扛1年前0
kankan啊啊啊啊3年前0
66666666666666