[SECURITY] [DSA 3794-1] munin security update

2017-02-2520:37:50

lists.debian.org

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

1.9 Low

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:M/Au:N/C:N/I:P/A:N

JSON

Debian Security Advisory DSA-3794-1 [email protected]
https://www.debian.org/security/ Salvatore Bonaccorso
February 25, 2017 https://www.debian.org/security/faq

Package : munin
CVE ID : CVE-2017-6188
Debian Bug : 855705

Stevie Trujillo discovered a local file write vulnerability in munin, a
network-wide graphing framework, when CGI graphs are enabled. GET
parameters are not properly handled, allowing to inject options into
munin-cgi-graph and overwriting any file accessible accessible by the
user running the cgi-process.

For the stable distribution (jessie), this problem has been fixed in
version 2.0.25-1+deb8u1.

We recommend that you upgrade your munin packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian7allmunin-async< 2.0.6-4+deb7u3munin-async_2.0.6-4+deb7u3_all.deb
Debian8allmunin-doc< 2.0.25-1+deb8u1munin-doc_2.0.25-1+deb8u1_all.deb
Debian8allmunin-plugins-core< 2.0.25-1+deb8u1munin-plugins-core_2.0.25-1+deb8u1_all.deb
Debian7allmunin-plugins-java< 2.0.6-4+deb7u3munin-plugins-java_2.0.6-4+deb7u3_all.deb
Debian7allmunin-plugins-core< 2.0.6-4+deb7u3munin-plugins-core_2.0.6-4+deb7u3_all.deb
Debian7allmunin-node< 2.0.6-4+deb7u3munin-node_2.0.6-4+deb7u3_all.deb
Debian8allmunin-node< 2.0.25-1+deb8u1munin-node_2.0.25-1+deb8u1_all.deb
Debian8allmunin-common< 2.0.25-1+deb8u1munin-common_2.0.25-1+deb8u1_all.deb
Debian8allmunin-plugins-extra< 2.0.25-1+deb8u1munin-plugins-extra_2.0.25-1+deb8u1_all.deb
Debian7allmunin< 2.0.6-4+deb7u3munin_2.0.6-4+deb7u3_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	7	all	munin-async	< 2.0.6-4+deb7u3	munin-async_2.0.6-4+deb7u3_all.deb
Debian	8	all	munin-doc	< 2.0.25-1+deb8u1	munin-doc_2.0.25-1+deb8u1_all.deb
Debian	8	all	munin-plugins-core	< 2.0.25-1+deb8u1	munin-plugins-core_2.0.25-1+deb8u1_all.deb
Debian	7	all	munin-plugins-java	< 2.0.6-4+deb7u3	munin-plugins-java_2.0.6-4+deb7u3_all.deb
Debian	7	all	munin-plugins-core	< 2.0.6-4+deb7u3	munin-plugins-core_2.0.6-4+deb7u3_all.deb
Debian	7	all	munin-node	< 2.0.6-4+deb7u3	munin-node_2.0.6-4+deb7u3_all.deb
Debian	8	all	munin-node	< 2.0.25-1+deb8u1	munin-node_2.0.25-1+deb8u1_all.deb
Debian	8	all	munin-common	< 2.0.25-1+deb8u1	munin-common_2.0.25-1+deb8u1_all.deb
Debian	8	all	munin-plugins-extra	< 2.0.25-1+deb8u1	munin-plugins-extra_2.0.25-1+deb8u1_all.deb
Debian	7	all	munin	< 2.0.6-4+deb7u3	munin_2.0.6-4+deb7u3_all.deb