ID UBUNTU_USN-994-1.NASL Type nessus Reporter Ubuntu Security Notice (C) 2010-2019 Canonical, Inc. / NASL script (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. Modified 2019-09-19T00:00:00
Description
It was discovered that libHX incorrectly handled certain parameters to the HX_split function. An attacker could use this flaw to cause a denial of service or possibly execute arbitrary code with the privileges of the user.
The default compiler options for affected releases should reduce the vulnerability to a denial of service.
Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Ubuntu Security Notice USN-994-1. The text
# itself is copyright (C) Canonical, Inc. See
# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered
# trademark of Canonical, Inc.
#
include("compat.inc");
if (description)
{
script_id(49763);
script_version("1.12");
script_cvs_date("Date: 2019/09/19 12:54:26");
script_cve_id("CVE-2010-2947");
script_bugtraq_id(42592);
script_xref(name:"USN", value:"994-1");
script_name(english:"Ubuntu 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : libhx vulnerability (USN-994-1)");
script_summary(english:"Checks dpkg output for updated packages.");
script_set_attribute(
attribute:"synopsis",
value:
"The remote Ubuntu host is missing one or more security-related
patches."
);
script_set_attribute(
attribute:"description",
value:
"It was discovered that libHX incorrectly handled certain parameters to
the HX_split function. An attacker could use this flaw to cause a
denial of service or possibly execute arbitrary code with the
privileges of the user.
The default compiler options for affected releases should reduce the
vulnerability to a denial of service.
Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
);
script_set_attribute(
attribute:"see_also",
value:"https://usn.ubuntu.com/994-1/"
);
script_set_attribute(attribute:"solution", value:"Update the affected packages.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libhx");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libhx-dev");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libhx-doc");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libhx10");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libhx14");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libhx18");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libhx22");
script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:10.04:-:lts");
script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:8.04:-:lts");
script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:9.04");
script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:9.10");
script_set_attribute(attribute:"vuln_publication_date", value:"2010/08/24");
script_set_attribute(attribute:"patch_publication_date", value:"2010/09/29");
script_set_attribute(attribute:"plugin_publication_date", value:"2010/10/06");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_copyright(english:"Ubuntu Security Notice (C) 2010-2019 Canonical, Inc. / NASL script (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_family(english:"Ubuntu Local Security Checks");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");
exit(0);
}
include("audit.inc");
include("ubuntu.inc");
include("misc_func.inc");
if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/Ubuntu/release");
if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
release = chomp(release);
if (! preg(pattern:"^(8\.04|9\.04|9\.10|10\.04)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 8.04 / 9.04 / 9.10 / 10.04", "Ubuntu " + release);
if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);
cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);
flag = 0;
if (ubuntu_check(osver:"8.04", pkgname:"libhx-dev", pkgver:"1.10.2-2ubuntu0.1")) flag++;
if (ubuntu_check(osver:"8.04", pkgname:"libhx10", pkgver:"1.10.2-2ubuntu0.1")) flag++;
if (ubuntu_check(osver:"9.04", pkgname:"libhx-dev", pkgver:"1.28-1ubuntu0.1")) flag++;
if (ubuntu_check(osver:"9.04", pkgname:"libhx14", pkgver:"1.28-1ubuntu0.1")) flag++;
if (ubuntu_check(osver:"9.10", pkgname:"libhx-dev", pkgver:"2.9-3ubuntu0.1")) flag++;
if (ubuntu_check(osver:"9.10", pkgname:"libhx-doc", pkgver:"2.9-3ubuntu0.1")) flag++;
if (ubuntu_check(osver:"9.10", pkgname:"libhx18", pkgver:"2.9-3ubuntu0.1")) flag++;
if (ubuntu_check(osver:"10.04", pkgname:"libhx", pkgver:"3.2-1ubuntu0.1")) flag++;
if (ubuntu_check(osver:"10.04", pkgname:"libhx-dev", pkgver:"3.2-1ubuntu0.1")) flag++;
if (ubuntu_check(osver:"10.04", pkgname:"libhx-doc", pkgver:"3.2-1ubuntu0.1")) flag++;
if (ubuntu_check(osver:"10.04", pkgname:"libhx22", pkgver:"3.2-1ubuntu0.1")) flag++;
if (flag)
{
security_report_v4(
port : 0,
severity : SECURITY_HOLE,
extra : ubuntu_report_get()
);
exit(0);
}
else
{
tested = ubuntu_pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libhx / libhx-dev / libhx-doc / libhx10 / libhx14 / libhx18 / etc");
}
{"id": "UBUNTU_USN-994-1.NASL", "type": "nessus", "bulletinFamily": "scanner", "title": "Ubuntu 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : libhx vulnerability (USN-994-1)", "description": "It was discovered that libHX incorrectly handled certain parameters to the HX_split function. An attacker could use this flaw to cause a denial of service or possibly execute arbitrary code with the privileges of the user.\n\nThe default compiler options for affected releases should reduce the vulnerability to a denial of service.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2010-10-06T00:00:00", "modified": "2019-09-19T00:00:00", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {}, "cvss3": {"score": null, "vector": null}, "href": "https://www.tenable.com/plugins/nessus/49763", "reporter": "Ubuntu Security Notice (C) 2010-2019 Canonical, Inc. / NASL script (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2947", "https://usn.ubuntu.com/994-1/"], "cvelist": ["CVE-2010-2947"], "immutableFields": [], "lastseen": "2021-08-19T13:02:59", "viewCount": 0, "enchantments": {"dependencies": {}, "score": {"value": 6.6, "vector": "NONE"}, "backreferences": {"references": [{"type": "cve", "idList": ["CVE-2010-2947"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2010-2947"]}, {"type": "fedora", "idList": ["FEDORA:115FE110AF7"]}, {"type": "nessus", "idList": ["FEDORA_2010-13155.NASL", "MANDRIVA_MDVSA-2010-165.NASL", "SUSE_11_1_LIBHX13-100823.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310862375"]}, {"type": "ubuntu", "idList": ["USN-994-1"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2010-2947"]}]}, "exploitation": null, "vulnersScore": 6.6}, "pluginID": "49763", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-994-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(49763);\n script_version(\"1.12\");\n script_cvs_date(\"Date: 2019/09/19 12:54:26\");\n\n script_cve_id(\"CVE-2010-2947\");\n script_bugtraq_id(42592);\n script_xref(name:\"USN\", value:\"994-1\");\n\n script_name(english:\"Ubuntu 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : libhx vulnerability (USN-994-1)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"It was discovered that libHX incorrectly handled certain parameters to\nthe HX_split function. An attacker could use this flaw to cause a\ndenial of service or possibly execute arbitrary code with the\nprivileges of the user.\n\nThe default compiler options for affected releases should reduce the\nvulnerability to a denial of service.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/994-1/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libhx\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libhx-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libhx-doc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libhx10\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libhx14\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libhx18\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libhx22\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:10.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:8.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:9.04\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:9.10\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2010/08/24\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2010/09/29\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/10/06\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2010-2019 Canonical, Inc. / NASL script (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"misc_func.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! preg(pattern:\"^(8\\.04|9\\.04|9\\.10|10\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 8.04 / 9.04 / 9.10 / 10.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nflag = 0;\n\nif (ubuntu_check(osver:\"8.04\", pkgname:\"libhx-dev\", pkgver:\"1.10.2-2ubuntu0.1\")) flag++;\nif (ubuntu_check(osver:\"8.04\", pkgname:\"libhx10\", pkgver:\"1.10.2-2ubuntu0.1\")) flag++;\nif (ubuntu_check(osver:\"9.04\", pkgname:\"libhx-dev\", pkgver:\"1.28-1ubuntu0.1\")) flag++;\nif (ubuntu_check(osver:\"9.04\", pkgname:\"libhx14\", pkgver:\"1.28-1ubuntu0.1\")) flag++;\nif (ubuntu_check(osver:\"9.10\", pkgname:\"libhx-dev\", pkgver:\"2.9-3ubuntu0.1\")) flag++;\nif (ubuntu_check(osver:\"9.10\", pkgname:\"libhx-doc\", pkgver:\"2.9-3ubuntu0.1\")) flag++;\nif (ubuntu_check(osver:\"9.10\", pkgname:\"libhx18\", pkgver:\"2.9-3ubuntu0.1\")) flag++;\nif (ubuntu_check(osver:\"10.04\", pkgname:\"libhx\", pkgver:\"3.2-1ubuntu0.1\")) flag++;\nif (ubuntu_check(osver:\"10.04\", pkgname:\"libhx-dev\", pkgver:\"3.2-1ubuntu0.1\")) flag++;\nif (ubuntu_check(osver:\"10.04\", pkgname:\"libhx-doc\", pkgver:\"3.2-1ubuntu0.1\")) flag++;\nif (ubuntu_check(osver:\"10.04\", pkgname:\"libhx22\", pkgver:\"3.2-1ubuntu0.1\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libhx / libhx-dev / libhx-doc / libhx10 / libhx14 / libhx18 / etc\");\n}\n", "naslFamily": "Ubuntu Local Security Checks", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:libhx", "p-cpe:/a:canonical:ubuntu_linux:libhx-dev", "p-cpe:/a:canonical:ubuntu_linux:libhx-doc", "p-cpe:/a:canonical:ubuntu_linux:libhx10", "p-cpe:/a:canonical:ubuntu_linux:libhx14", "p-cpe:/a:canonical:ubuntu_linux:libhx18", "p-cpe:/a:canonical:ubuntu_linux:libhx22", "cpe:/o:canonical:ubuntu_linux:10.04:-:lts", "cpe:/o:canonical:ubuntu_linux:8.04:-:lts", "cpe:/o:canonical:ubuntu_linux:9.04", "cpe:/o:canonical:ubuntu_linux:9.10"], "solution": "Update the affected packages.", "nessusSeverity": "Critical", "cvssScoreSource": "", "vpr": {"risk factor": "Medium", "score": "5.9"}, "exploitAvailable": false, "exploitEase": "No known exploits are available", "patchPublicationDate": "2010-09-29T00:00:00", "vulnerabilityPublicationDate": "2010-08-24T00:00:00", "exploitableWith": [], "_state": {"dependencies": 1645261340}}
{"fedora": [{"lastseen": "2021-06-08T18:43:08", "description": "A library for: - rbtree with key-value pair extension - deques (double-ended queues) (Stacks (LIFO) / Queues (FIFOs)) - platform independent opendir-style directory access - platform independent dlopen-style shared library access - auto-storage strings with direct access - command line option (argv) parser - shconfig-style config file parser - platform independent random number generator with transparent /dev/urandom support - various string, memory and zvec ops ", "edition": 3, "cvss3": {}, "published": "2010-10-28T22:20:52", "type": "fedora", "title": "[SECURITY] Fedora 14 Update: libHX-3.6-1.fc14", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-2947"], "modified": "2010-10-28T22:20:52", "id": "FEDORA:115FE110AF7", "href": "", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-06-08T18:43:08", "description": "A library for: - rbtree with key-value pair extension - deques (double-ended queues) (Stacks (LIFO) / Queues (FIFOs)) - platform independent opendir-style directory access - platform independent dlopen-style shared library access - auto-storage strings with direct access - command line option (argv) parser - shconfig-style config file parser - platform independent random number generator with transparent /dev/urandom support - various string, memory and zvec ops ", "edition": 3, "cvss3": {}, "published": "2010-09-04T04:53:11", "type": "fedora", "title": "[SECURITY] Fedora 12 Update: libHX-3.6-1.fc12", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-2947"], "modified": "2010-09-04T04:53:11", "id": "FEDORA:4F65C10FA4F", "href": "", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:50", "description": "This module is aimed at environments with central file servers that a user wishes to mount on login and unmount on logout, such as (semi-)diskless stations where many users can logon. The module also supports mounting local filesystems of any kind the normal mount utility supports, with extra code to make sure certain volumes are set up properly because often they need more than just a mount call, such as encrypted volumes. This includes SMB/CIFS, NCP, davfs2, FUSE, losetup crypto, dm-crypt/cryptsetup and truecrypt. If you intend to use pam_mount to protect volumes on your computer using an encrypted filesystem system, please know that there are many other issues you need to consider in order to protect your data. For example, you probably want to disable or encrypt your swap partition. Don't assume a system is secure without carefully considering potential threats. ", "edition": 2, "cvss3": {}, "published": "2010-09-04T04:53:11", "type": "fedora", "title": "[SECURITY] Fedora 12 Update: pam_mount-2.5-1.fc12", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-2947"], "modified": "2010-09-04T04:53:11", "id": "FEDORA:4349510F865", "href": "", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-06-08T18:43:08", "description": "A library for: - rbtree with key-value pair extension - deques (double-ended queues) (Stacks (LIFO) / Queues (FIFOs)) - platform independent opendir-style directory access - platform independent dlopen-style shared library access - auto-storage strings with direct access - command line option (argv) parser - shconfig-style config file parser - platform independent random number generator with transparent /dev/urandom support - various string, memory and zvec ops ", "edition": 3, "cvss3": {}, "published": "2010-09-04T04:57:09", "type": "fedora", "title": "[SECURITY] Fedora 13 Update: libHX-3.6-1.fc13", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-2947"], "modified": "2010-09-04T04:57:09", "id": "FEDORA:3786D110B24", "href": "", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:50", "description": "This module is aimed at environments with central file servers that a user wishes to mount on login and unmount on logout, such as (semi-)diskless stations where many users can logon. The module also supports mounting local filesystems of any kind the normal mount utility supports, with extra code to make sure certain volumes are set up properly because often they need more than just a mount call, such as encrypted volumes. This includes SMB/CIFS, NCP, davfs2, FUSE, losetup crypto, dm-crypt/cryptsetup and truecrypt. If you intend to use pam_mount to protect volumes on your computer using an encrypted filesystem system, please know that there are many other issues you need to consider in order to protect your data. For example, you probably want to disable or encrypt your swap partition. Don't assume a system is secure without carefully considering potential threats. ", "edition": 2, "cvss3": {}, "published": "2010-09-04T04:57:09", "type": "fedora", "title": "[SECURITY] Fedora 13 Update: pam_mount-2.5-1.fc13", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-2947"], "modified": "2010-09-04T04:57:09", "id": "FEDORA:3485410FA4F", "href": "", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:50", "description": "This module is aimed at environments with central file servers that a user wishes to mount on login and unmount on logout, such as (semi-)diskless stations where many users can logon. The module also supports mounting local filesystems of any kind the normal mount utility supports, with extra code to make sure certain volumes are set up properly because often they need more than just a mount call, such as encrypted volumes. This includes SMB/CIFS, NCP, davfs2, FUSE, losetup crypto, dm-crypt/cryptsetup and truecrypt. If you intend to use pam_mount to protect volumes on your computer using an encrypted filesystem system, please know that there are many other issues you need to consider in order to protect your data. For example, you probably want to disable or encrypt your swap partition. Don't assume a system is secure without carefully considering potential threats. ", "edition": 2, "cvss3": {}, "published": "2010-10-28T22:20:52", "type": "fedora", "title": "[SECURITY] Fedora 14 Update: pam_mount-2.5-1.fc14", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-2947"], "modified": "2010-10-28T22:20:52", "id": "FEDORA:CCF96110934", "href": "", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "openvas": [{"lastseen": "2017-12-21T11:33:27", "description": "Check for the Version of pam_mount", "cvss3": {}, "published": "2010-12-02T00:00:00", "type": "openvas", "title": "Fedora Update for pam_mount FEDORA-2010-12950", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2947"], "modified": "2017-12-20T00:00:00", "id": "OPENVAS:862608", "href": "http://plugins.openvas.org/nasl.php?oid=862608", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for pam_mount FEDORA-2010-12950\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"This module is aimed at environments with central file servers that a\n user wishes to mount on login and unmount on logout, such as\n (semi-)diskless stations where many users can logon.\n\n The module also supports mounting local filesystems of any kind the\n normal mount utility supports, with extra code to make sure certain\n volumes are set up properly because often they need more than just a\n mount call, such as encrypted volumes. This includes SMB/CIFS, NCP,\n davfs2, FUSE, losetup crypto, dm-crypt/cryptsetup and truecrypt.\n \n If you intend to use pam_mount to protect volumes on your computer\n using an encrypted filesystem system, please know that there are many\n other issues you need to consider in order to protect your data. For\n example, you probably want to disable or encrypt your swap partition.\n Don't assume a system is secure without carefully considering\n potential threats.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\ntag_affected = \"pam_mount on Fedora 14\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050088.html\");\n script_id(862608);\n script_version(\"$Revision: 8186 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-20 07:30:34 +0100 (Wed, 20 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2010-12-02 08:39:14 +0100 (Thu, 02 Dec 2010)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_xref(name: \"FEDORA\", value: \"2010-12950\");\n script_cve_id(\"CVE-2010-2947\");\n script_name(\"Fedora Update for pam_mount FEDORA-2010-12950\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of pam_mount\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC14\")\n{\n\n if ((res = isrpmvuln(pkg:\"pam_mount\", rpm:\"pam_mount~2.5~1.fc14\", rls:\"FC14\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-12-04T11:17:53", "description": "Ubuntu Update for Linux kernel vulnerabilities USN-994-1", "cvss3": {}, "published": "2010-10-01T00:00:00", "type": "openvas", "title": "Ubuntu Update for libhx vulnerability USN-994-1", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2947"], "modified": "2017-12-01T00:00:00", "id": "OPENVAS:840508", "href": "http://plugins.openvas.org/nasl.php?oid=840508", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_ubuntu_USN_994_1.nasl 7965 2017-12-01 07:38:25Z santu $\n#\n# Ubuntu Update for libhx vulnerability USN-994-1\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"It was discovered that libHX incorrectly handled certain parameters to the\n HX_split function. An attacker could use this flaw to cause a denial of\n service or possibly execute arbitrary code with the privileges of the user.\n\n The default compiler options for affected releases should reduce the\n vulnerability to a denial of service.\";\n\ntag_summary = \"Ubuntu Update for Linux kernel vulnerabilities USN-994-1\";\ntag_affected = \"libhx vulnerability on Ubuntu 8.04 LTS ,\n Ubuntu 9.04 ,\n Ubuntu 9.10 ,\n Ubuntu 10.04 LTS\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\nif(description)\n{\n script_xref(name: \"URL\" , value: \"http://www.ubuntu.com/usn/usn-994-1/\");\n script_id(840508);\n script_version(\"$Revision: 7965 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-01 08:38:25 +0100 (Fri, 01 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2010-10-01 16:10:21 +0200 (Fri, 01 Oct 2010)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_xref(name: \"USN\", value: \"994-1\");\n script_cve_id(\"CVE-2010-2947\");\n script_name(\"Ubuntu Update for libhx vulnerability USN-994-1\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\");\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"UBUNTU9.10\")\n{\n\n if ((res = isdpkgvuln(pkg:\"libhx-dev\", ver:\"2.9-3ubuntu0.1\", rls:\"UBUNTU9.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libhx-doc\", ver:\"2.9-3ubuntu0.1\", rls:\"UBUNTU9.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libhx18\", ver:\"2.9-3ubuntu0.1\", rls:\"UBUNTU9.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"UBUNTU10.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"libhx-dev\", ver:\"3.2-1ubuntu0.1\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libhx-doc\", ver:\"3.2-1ubuntu0.1\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libhx22\", ver:\"3.2-1ubuntu0.1\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"UBUNTU9.04\")\n{\n\n if ((res = isdpkgvuln(pkg:\"libhx-dev\", ver:\"1.28-1ubuntu0.1\", rls:\"UBUNTU9.04\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libhx14\", ver:\"1.28-1ubuntu0.1\", rls:\"UBUNTU9.04\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"UBUNTU8.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"libhx-dev\", ver:\"1.10.2-2ubuntu0.1\", rls:\"UBUNTU8.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libhx10\", ver:\"1.10.2-2ubuntu0.1\", rls:\"UBUNTU8.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-12-14T11:48:26", "description": "Check for the Version of libHX", "cvss3": {}, "published": "2010-09-07T00:00:00", "type": "openvas", "title": "Mandriva Update for libHX MDVSA-2010:165 (libHX)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2947"], "modified": "2017-12-14T00:00:00", "id": "OPENVAS:831144", "href": "http://plugins.openvas.org/nasl.php?oid=831144", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mandriva Update for libHX MDVSA-2010:165 (libHX)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"A vulnerability has been found and corrected in libHX:\n\n Heap-based buffer overflow in the HX_split function in string.c in\n libHX before 3.6 allows remote attackers to execute arbitrary code\n or cause a denial of service (application crash) via a string that\n is inconsistent with the expected number of fields (CVE-2010-2947).\n\n The updated packages have been patched to correct this issue.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\ntag_affected = \"libHX on Mandriva Linux 2009.0,\n Mandriva Linux 2009.0/X86_64,\n Mandriva Linux 2009.1,\n Mandriva Linux 2009.1/X86_64,\n Mandriva Linux 2010.0,\n Mandriva Linux 2010.0/X86_64\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.mandriva.com/security-announce/2010-08/msg00026.php\");\n script_id(831144);\n script_version(\"$Revision: 8109 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-14 07:31:15 +0100 (Thu, 14 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2010-09-07 07:38:40 +0200 (Tue, 07 Sep 2010)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_xref(name: \"MDVSA\", value: \"2010:165\");\n script_cve_id(\"CVE-2010-2947\");\n script_name(\"Mandriva Update for libHX MDVSA-2010:165 (libHX)\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of libHX\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/release\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"MNDK_2010.0\")\n{\n\n if ((res = isrpmvuln(pkg:\"libHX22\", rpm:\"libHX22~3.1~1.1mdv2010.0\", rls:\"MNDK_2010.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libHX-devel\", rpm:\"libHX-devel~3.1~1.1mdv2010.0\", rls:\"MNDK_2010.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libHX\", rpm:\"libHX~3.1~1.1mdv2010.0\", rls:\"MNDK_2010.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64HX22\", rpm:\"lib64HX22~3.1~1.1mdv2010.0\", rls:\"MNDK_2010.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64HX-devel\", rpm:\"lib64HX-devel~3.1~1.1mdv2010.0\", rls:\"MNDK_2010.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"MNDK_2009.1\")\n{\n\n if ((res = isrpmvuln(pkg:\"libHX18\", rpm:\"libHX18~2.5~1.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libHX-devel\", rpm:\"libHX-devel~2.5~1.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libHX\", rpm:\"libHX~2.5~1.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64HX18\", rpm:\"lib64HX18~2.5~1.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64HX-devel\", rpm:\"lib64HX-devel~2.5~1.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"MNDK_2009.0\")\n{\n\n if ((res = isrpmvuln(pkg:\"libHX14\", rpm:\"libHX14~1.25~1.1mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libHX-devel\", rpm:\"libHX-devel~1.25~1.1mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libHX\", rpm:\"libHX~1.25~1.1mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64HX14\", rpm:\"lib64HX14~1.25~1.1mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64HX-devel\", rpm:\"lib64HX-devel~1.25~1.1mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-01-19T15:04:43", "description": "Check for the Version of pam_mount", "cvss3": {}, "published": "2010-09-07T00:00:00", "type": "openvas", "title": "Fedora Update for pam_mount FEDORA-2010-13127", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2947"], "modified": "2018-01-19T00:00:00", "id": "OPENVAS:1361412562310862377", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310862377", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for pam_mount FEDORA-2010-13127\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"This module is aimed at environments with central file servers that a\n user wishes to mount on login and unmount on logout, such as\n (semi-)diskless stations where many users can logon.\n\n The module also supports mounting local filesystems of any kind the\n normal mount utility supports, with extra code to make sure certain\n volumes are set up properly because often they need more than just a\n mount call, such as encrypted volumes. This includes SMB/CIFS, NCP,\n davfs2, FUSE, losetup crypto, dm-crypt/cryptsetup and truecrypt.\n\n If you intend to use pam_mount to protect volumes on your computer\n using an encrypted filesystem system, please know that there are many\n other issues you need to consider in order to protect your data. For\n example, you probably want to disable or encrypt your swap partition.\n Don't assume a system is secure without carefully considering\n potential threats.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\ntag_affected = \"pam_mount on Fedora 13\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.fedoraproject.org/pipermail/package-announce/2010-September/046999.html\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.862377\");\n script_version(\"$Revision: 8469 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-01-19 08:58:21 +0100 (Fri, 19 Jan 2018) $\");\n script_tag(name:\"creation_date\", value:\"2010-09-07 15:09:12 +0200 (Tue, 07 Sep 2010)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_xref(name: \"FEDORA\", value: \"2010-13127\");\n script_cve_id(\"CVE-2010-2947\");\n script_name(\"Fedora Update for pam_mount FEDORA-2010-13127\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of pam_mount\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC13\")\n{\n\n if ((res = isrpmvuln(pkg:\"pam_mount\", rpm:\"pam_mount~2.5~1.fc13\", rls:\"FC13\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-12-14T11:48:50", "description": "Check for the Version of libHX", "cvss3": {}, "published": "2010-09-07T00:00:00", "type": "openvas", "title": "Fedora Update for libHX FEDORA-2010-13155", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2947"], "modified": "2017-12-14T00:00:00", "id": "OPENVAS:862378", "href": "http://plugins.openvas.org/nasl.php?oid=862378", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for libHX FEDORA-2010-13155\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_affected = \"libHX on Fedora 12\";\ntag_insight = \"A library for:\n - rbtree with key-value pair extension\n - deques (double-ended queues) (Stacks (LIFO) / Queues (FIFOs))\n - platform independent opendir-style directory access\n - platform independent dlopen-style shared library access\n - auto-storage strings with direct access\n - command line option (argv) parser\n - shconfig-style config file parser\n - platform independent random number generator with transparent\n /dev/urandom support\n - various string, memory and zvec ops\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.fedoraproject.org/pipermail/package-announce/2010-September/046980.html\");\n script_id(862378);\n script_version(\"$Revision: 8109 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-14 07:31:15 +0100 (Thu, 14 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2010-09-07 15:09:12 +0200 (Tue, 07 Sep 2010)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_xref(name: \"FEDORA\", value: \"2010-13155\");\n script_cve_id(\"CVE-2010-2947\");\n script_name(\"Fedora Update for libHX FEDORA-2010-13155\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of libHX\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC12\")\n{\n\n if ((res = isrpmvuln(pkg:\"libHX\", rpm:\"libHX~3.6~1.fc12\", rls:\"FC12\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-12-21T11:32:38", "description": "Check for the Version of pam_mount", "cvss3": {}, "published": "2010-09-07T00:00:00", "type": "openvas", "title": "Fedora Update for pam_mount FEDORA-2010-13127", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2947"], "modified": "2017-12-21T00:00:00", "id": "OPENVAS:862377", "href": "http://plugins.openvas.org/nasl.php?oid=862377", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for pam_mount FEDORA-2010-13127\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"This module is aimed at environments with central file servers that a\n user wishes to mount on login and unmount on logout, such as\n (semi-)diskless stations where many users can logon.\n\n The module also supports mounting local filesystems of any kind the\n normal mount utility supports, with extra code to make sure certain\n volumes are set up properly because often they need more than just a\n mount call, such as encrypted volumes. This includes SMB/CIFS, NCP,\n davfs2, FUSE, losetup crypto, dm-crypt/cryptsetup and truecrypt.\n\n If you intend to use pam_mount to protect volumes on your computer\n using an encrypted filesystem system, please know that there are many\n other issues you need to consider in order to protect your data. For\n example, you probably want to disable or encrypt your swap partition.\n Don't assume a system is secure without carefully considering\n potential threats.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\ntag_affected = \"pam_mount on Fedora 13\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.fedoraproject.org/pipermail/package-announce/2010-September/046999.html\");\n script_id(862377);\n script_version(\"$Revision: 8205 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-21 07:30:37 +0100 (Thu, 21 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2010-09-07 15:09:12 +0200 (Tue, 07 Sep 2010)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_xref(name: \"FEDORA\", value: \"2010-13127\");\n script_cve_id(\"CVE-2010-2947\");\n script_name(\"Fedora Update for pam_mount FEDORA-2010-13127\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of pam_mount\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC13\")\n{\n\n if ((res = isrpmvuln(pkg:\"pam_mount\", rpm:\"pam_mount~2.5~1.fc13\", rls:\"FC13\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-01-18T11:05:24", "description": "Check for the Version of pam_mount", "cvss3": {}, "published": "2010-12-02T00:00:00", "type": "openvas", "title": "Fedora Update for pam_mount FEDORA-2010-12950", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2947"], "modified": "2018-01-17T00:00:00", "id": "OPENVAS:1361412562310862608", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310862608", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for pam_mount FEDORA-2010-12950\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"This module is aimed at environments with central file servers that a\n user wishes to mount on login and unmount on logout, such as\n (semi-)diskless stations where many users can logon.\n\n The module also supports mounting local filesystems of any kind the\n normal mount utility supports, with extra code to make sure certain\n volumes are set up properly because often they need more than just a\n mount call, such as encrypted volumes. This includes SMB/CIFS, NCP,\n davfs2, FUSE, losetup crypto, dm-crypt/cryptsetup and truecrypt.\n \n If you intend to use pam_mount to protect volumes on your computer\n using an encrypted filesystem system, please know that there are many\n other issues you need to consider in order to protect your data. For\n example, you probably want to disable or encrypt your swap partition.\n Don't assume a system is secure without carefully considering\n potential threats.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\ntag_affected = \"pam_mount on Fedora 14\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050088.html\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.862608\");\n script_version(\"$Revision: 8440 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-01-17 08:58:46 +0100 (Wed, 17 Jan 2018) $\");\n script_tag(name:\"creation_date\", value:\"2010-12-02 08:39:14 +0100 (Thu, 02 Dec 2010)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_xref(name: \"FEDORA\", value: \"2010-12950\");\n script_cve_id(\"CVE-2010-2947\");\n script_name(\"Fedora Update for pam_mount FEDORA-2010-12950\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of pam_mount\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC14\")\n{\n\n if ((res = isrpmvuln(pkg:\"pam_mount\", rpm:\"pam_mount~2.5~1.fc14\", rls:\"FC14\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-01-02T10:54:39", "description": "Check for the Version of libHX", "cvss3": {}, "published": "2010-09-07T00:00:00", "type": "openvas", "title": "Fedora Update for libHX FEDORA-2010-13155", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2947"], "modified": "2017-12-28T00:00:00", "id": "OPENVAS:1361412562310862378", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310862378", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for libHX FEDORA-2010-13155\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_affected = \"libHX on Fedora 12\";\ntag_insight = \"A library for:\n - rbtree with key-value pair extension\n - deques (double-ended queues) (Stacks (LIFO) / Queues (FIFOs))\n - platform independent opendir-style directory access\n - platform independent dlopen-style shared library access\n - auto-storage strings with direct access\n - command line option (argv) parser\n - shconfig-style config file parser\n - platform independent random number generator with transparent\n /dev/urandom support\n - various string, memory and zvec ops\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.fedoraproject.org/pipermail/package-announce/2010-September/046980.html\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.862378\");\n script_version(\"$Revision: 8254 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-28 08:29:05 +0100 (Thu, 28 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2010-09-07 15:09:12 +0200 (Tue, 07 Sep 2010)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_xref(name: \"FEDORA\", value: \"2010-13155\");\n script_cve_id(\"CVE-2010-2947\");\n script_name(\"Fedora Update for libHX FEDORA-2010-13155\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of libHX\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC12\")\n{\n\n if ((res = isrpmvuln(pkg:\"libHX\", rpm:\"libHX~3.6~1.fc12\", rls:\"FC12\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-12-21T11:33:09", "description": "Check for the Version of pam_mount", "cvss3": {}, "published": "2010-09-07T00:00:00", "type": "openvas", "title": "Fedora Update for pam_mount FEDORA-2010-13155", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2947"], "modified": "2017-12-20T00:00:00", "id": "OPENVAS:862375", "href": "http://plugins.openvas.org/nasl.php?oid=862375", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for pam_mount FEDORA-2010-13155\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"This module is aimed at environments with central file servers that a\n user wishes to mount on login and unmount on logout, such as\n (semi-)diskless stations where many users can logon.\n\n The module also supports mounting local filesystems of any kind the\n normal mount utility supports, with extra code to make sure certain\n volumes are set up properly because often they need more than just a\n mount call, such as encrypted volumes. This includes SMB/CIFS, NCP,\n davfs2, FUSE, losetup crypto, dm-crypt/cryptsetup and truecrypt.\n\n If you intend to use pam_mount to protect volumes on your computer\n using an encrypted filesystem system, please know that there are many\n other issues you need to consider in order to protect your data. For\n example, you probably want to disable or encrypt your swap partition.\n Don't assume a system is secure without carefully considering\n potential threats.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\ntag_affected = \"pam_mount on Fedora 12\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.fedoraproject.org/pipermail/package-announce/2010-September/046981.html\");\n script_id(862375);\n script_version(\"$Revision: 8186 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-20 07:30:34 +0100 (Wed, 20 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2010-09-07 15:09:12 +0200 (Tue, 07 Sep 2010)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_xref(name: \"FEDORA\", value: \"2010-13155\");\n script_cve_id(\"CVE-2010-2947\");\n script_name(\"Fedora Update for pam_mount FEDORA-2010-13155\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of pam_mount\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC12\")\n{\n\n if ((res = isrpmvuln(pkg:\"pam_mount\", rpm:\"pam_mount~2.5~1.fc12\", rls:\"FC12\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-01-02T10:54:09", "description": "Check for the Version of libHX", "cvss3": {}, "published": "2010-09-07T00:00:00", "type": "openvas", "title": "Fedora Update for libHX FEDORA-2010-13127", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2947"], "modified": "2018-01-01T00:00:00", "id": "OPENVAS:1361412562310862376", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310862376", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for libHX FEDORA-2010-13127\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_affected = \"libHX on Fedora 13\";\ntag_insight = \"A library for:\n - rbtree with key-value pair extension\n - deques (double-ended queues) (Stacks (LIFO) / Queues (FIFOs))\n - platform independent opendir-style directory access\n - platform independent dlopen-style shared library access\n - auto-storage strings with direct access\n - command line option (argv) parser\n - shconfig-style config file parser\n - platform independent random number generator with transparent\n /dev/urandom support\n - various string, memory and zvec ops\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047000.html\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.862376\");\n script_version(\"$Revision: 8266 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-01-01 08:28:32 +0100 (Mon, 01 Jan 2018) $\");\n script_tag(name:\"creation_date\", value:\"2010-09-07 15:09:12 +0200 (Tue, 07 Sep 2010)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_xref(name: \"FEDORA\", value: \"2010-13127\");\n script_cve_id(\"CVE-2010-2947\");\n script_name(\"Fedora Update for libHX FEDORA-2010-13127\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of libHX\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC13\")\n{\n\n if ((res = isrpmvuln(pkg:\"libHX\", rpm:\"libHX~3.6~1.fc13\", rls:\"FC13\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-01-17T11:05:23", "description": "Check for the Version of libHX", "cvss3": {}, "published": "2010-12-02T00:00:00", "type": "openvas", "title": "Fedora Update for libHX FEDORA-2010-12950", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2947"], "modified": "2018-01-16T00:00:00", "id": "OPENVAS:1361412562310862586", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310862586", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for libHX FEDORA-2010-12950\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_affected = \"libHX on Fedora 14\";\ntag_insight = \"A library for:\n - rbtree with key-value pair extension\n - deques (double-ended queues) (Stacks (LIFO) / Queues (FIFOs))\n - platform independent opendir-style directory access\n - platform independent dlopen-style shared library access\n - auto-storage strings with direct access\n - command line option (argv) parser\n - shconfig-style config file parser\n - platform independent random number generator with transparent\n /dev/urandom support\n - various string, memory and zvec ops\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050089.html\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.862586\");\n script_version(\"$Revision: 8438 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-01-16 18:38:23 +0100 (Tue, 16 Jan 2018) $\");\n script_tag(name:\"creation_date\", value:\"2010-12-02 08:39:14 +0100 (Thu, 02 Dec 2010)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_xref(name: \"FEDORA\", value: \"2010-12950\");\n script_cve_id(\"CVE-2010-2947\");\n script_name(\"Fedora Update for libHX FEDORA-2010-12950\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of libHX\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC14\")\n{\n\n if ((res = isrpmvuln(pkg:\"libHX\", rpm:\"libHX~3.6~1.fc14\", rls:\"FC14\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-12-14T11:48:28", "description": "Check for the Version of libHX", "cvss3": {}, "published": "2010-09-07T00:00:00", "type": "openvas", "title": "Fedora Update for libHX FEDORA-2010-13127", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2947"], "modified": "2017-12-14T00:00:00", "id": "OPENVAS:862376", "href": "http://plugins.openvas.org/nasl.php?oid=862376", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for libHX FEDORA-2010-13127\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_affected = \"libHX on Fedora 13\";\ntag_insight = \"A library for:\n - rbtree with key-value pair extension\n - deques (double-ended queues) (Stacks (LIFO) / Queues (FIFOs))\n - platform independent opendir-style directory access\n - platform independent dlopen-style shared library access\n - auto-storage strings with direct access\n - command line option (argv) parser\n - shconfig-style config file parser\n - platform independent random number generator with transparent\n /dev/urandom support\n - various string, memory and zvec ops\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047000.html\");\n script_id(862376);\n script_version(\"$Revision: 8109 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-14 07:31:15 +0100 (Thu, 14 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2010-09-07 15:09:12 +0200 (Tue, 07 Sep 2010)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_xref(name: \"FEDORA\", value: \"2010-13127\");\n script_cve_id(\"CVE-2010-2947\");\n script_name(\"Fedora Update for libHX FEDORA-2010-13127\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of libHX\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC13\")\n{\n\n if ((res = isrpmvuln(pkg:\"libHX\", rpm:\"libHX~3.6~1.fc13\", rls:\"FC13\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-12-20T13:17:53", "description": "Check for the Version of libHX", "cvss3": {}, "published": "2010-12-02T00:00:00", "type": "openvas", "title": "Fedora Update for libHX FEDORA-2010-12950", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2947"], "modified": "2017-12-19T00:00:00", "id": "OPENVAS:862586", "href": "http://plugins.openvas.org/nasl.php?oid=862586", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for libHX FEDORA-2010-12950\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_affected = \"libHX on Fedora 14\";\ntag_insight = \"A library for:\n - rbtree with key-value pair extension\n - deques (double-ended queues) (Stacks (LIFO) / Queues (FIFOs))\n - platform independent opendir-style directory access\n - platform independent dlopen-style shared library access\n - auto-storage strings with direct access\n - command line option (argv) parser\n - shconfig-style config file parser\n - platform independent random number generator with transparent\n /dev/urandom support\n - various string, memory and zvec ops\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050089.html\");\n script_id(862586);\n script_version(\"$Revision: 8164 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-19 07:30:41 +0100 (Tue, 19 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2010-12-02 08:39:14 +0100 (Thu, 02 Dec 2010)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_xref(name: \"FEDORA\", value: \"2010-12950\");\n script_cve_id(\"CVE-2010-2947\");\n script_name(\"Fedora Update for libHX FEDORA-2010-12950\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of libHX\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC14\")\n{\n\n if ((res = isrpmvuln(pkg:\"libHX\", rpm:\"libHX~3.6~1.fc14\", rls:\"FC14\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-01-02T10:54:05", "description": "Check for the Version of libHX", "cvss3": {}, "published": "2010-09-07T00:00:00", "type": "openvas", "title": "Mandriva Update for libHX MDVSA-2010:165 (libHX)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2947"], "modified": "2017-12-27T00:00:00", "id": "OPENVAS:1361412562310831144", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310831144", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mandriva Update for libHX MDVSA-2010:165 (libHX)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"A vulnerability has been found and corrected in libHX:\n\n Heap-based buffer overflow in the HX_split function in string.c in\n libHX before 3.6 allows remote attackers to execute arbitrary code\n or cause a denial of service (application crash) via a string that\n is inconsistent with the expected number of fields (CVE-2010-2947).\n\n The updated packages have been patched to correct this issue.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\ntag_affected = \"libHX on Mandriva Linux 2009.0,\n Mandriva Linux 2009.0/X86_64,\n Mandriva Linux 2009.1,\n Mandriva Linux 2009.1/X86_64,\n Mandriva Linux 2010.0,\n Mandriva Linux 2010.0/X86_64\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.mandriva.com/security-announce/2010-08/msg00026.php\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.831144\");\n script_version(\"$Revision: 8250 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-27 08:29:15 +0100 (Wed, 27 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2010-09-07 07:38:40 +0200 (Tue, 07 Sep 2010)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_xref(name: \"MDVSA\", value: \"2010:165\");\n script_cve_id(\"CVE-2010-2947\");\n script_name(\"Mandriva Update for libHX MDVSA-2010:165 (libHX)\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of libHX\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/release\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"MNDK_2010.0\")\n{\n\n if ((res = isrpmvuln(pkg:\"libHX22\", rpm:\"libHX22~3.1~1.1mdv2010.0\", rls:\"MNDK_2010.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libHX-devel\", rpm:\"libHX-devel~3.1~1.1mdv2010.0\", rls:\"MNDK_2010.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libHX\", rpm:\"libHX~3.1~1.1mdv2010.0\", rls:\"MNDK_2010.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64HX22\", rpm:\"lib64HX22~3.1~1.1mdv2010.0\", rls:\"MNDK_2010.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64HX-devel\", rpm:\"lib64HX-devel~3.1~1.1mdv2010.0\", rls:\"MNDK_2010.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"MNDK_2009.1\")\n{\n\n if ((res = isrpmvuln(pkg:\"libHX18\", rpm:\"libHX18~2.5~1.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libHX-devel\", rpm:\"libHX-devel~2.5~1.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libHX\", rpm:\"libHX~2.5~1.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64HX18\", rpm:\"lib64HX18~2.5~1.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64HX-devel\", rpm:\"lib64HX-devel~2.5~1.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"MNDK_2009.0\")\n{\n\n if ((res = isrpmvuln(pkg:\"libHX14\", rpm:\"libHX14~1.25~1.1mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libHX-devel\", rpm:\"libHX-devel~1.25~1.1mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libHX\", rpm:\"libHX~1.25~1.1mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64HX14\", rpm:\"lib64HX14~1.25~1.1mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"lib64HX-devel\", rpm:\"lib64HX-devel~1.25~1.1mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-01-11T11:04:22", "description": "Ubuntu Update for Linux kernel vulnerabilities USN-994-1", "cvss3": {}, "published": "2010-10-01T00:00:00", "type": "openvas", "title": "Ubuntu Update for libhx vulnerability USN-994-1", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2947"], "modified": "2018-01-10T00:00:00", "id": "OPENVAS:1361412562310840508", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310840508", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_ubuntu_USN_994_1.nasl 8356 2018-01-10 08:00:39Z teissa $\n#\n# Ubuntu Update for libhx vulnerability USN-994-1\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"It was discovered that libHX incorrectly handled certain parameters to the\n HX_split function. An attacker could use this flaw to cause a denial of\n service or possibly execute arbitrary code with the privileges of the user.\n\n The default compiler options for affected releases should reduce the\n vulnerability to a denial of service.\";\n\ntag_summary = \"Ubuntu Update for Linux kernel vulnerabilities USN-994-1\";\ntag_affected = \"libhx vulnerability on Ubuntu 8.04 LTS ,\n Ubuntu 9.04 ,\n Ubuntu 9.10 ,\n Ubuntu 10.04 LTS\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\nif(description)\n{\n script_xref(name: \"URL\" , value: \"http://www.ubuntu.com/usn/usn-994-1/\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.840508\");\n script_version(\"$Revision: 8356 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-01-10 09:00:39 +0100 (Wed, 10 Jan 2018) $\");\n script_tag(name:\"creation_date\", value:\"2010-10-01 16:10:21 +0200 (Fri, 01 Oct 2010)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_xref(name: \"USN\", value: \"994-1\");\n script_cve_id(\"CVE-2010-2947\");\n script_name(\"Ubuntu Update for libhx vulnerability USN-994-1\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\");\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"UBUNTU9.10\")\n{\n\n if ((res = isdpkgvuln(pkg:\"libhx-dev\", ver:\"2.9-3ubuntu0.1\", rls:\"UBUNTU9.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libhx-doc\", ver:\"2.9-3ubuntu0.1\", rls:\"UBUNTU9.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libhx18\", ver:\"2.9-3ubuntu0.1\", rls:\"UBUNTU9.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"UBUNTU10.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"libhx-dev\", ver:\"3.2-1ubuntu0.1\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libhx-doc\", ver:\"3.2-1ubuntu0.1\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libhx22\", ver:\"3.2-1ubuntu0.1\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"UBUNTU9.04\")\n{\n\n if ((res = isdpkgvuln(pkg:\"libhx-dev\", ver:\"1.28-1ubuntu0.1\", rls:\"UBUNTU9.04\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libhx14\", ver:\"1.28-1ubuntu0.1\", rls:\"UBUNTU9.04\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"UBUNTU8.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"libhx-dev\", ver:\"1.10.2-2ubuntu0.1\", rls:\"UBUNTU8.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libhx10\", ver:\"1.10.2-2ubuntu0.1\", rls:\"UBUNTU8.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-01-18T11:05:10", "description": "Check for the Version of pam_mount", "cvss3": {}, "published": "2010-09-07T00:00:00", "type": "openvas", "title": "Fedora Update for pam_mount FEDORA-2010-13155", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2947"], "modified": "2018-01-17T00:00:00", "id": "OPENVAS:1361412562310862375", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310862375", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for pam_mount FEDORA-2010-13155\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"This module is aimed at environments with central file servers that a\n user wishes to mount on login and unmount on logout, such as\n (semi-)diskless stations where many users can logon.\n\n The module also supports mounting local filesystems of any kind the\n normal mount utility supports, with extra code to make sure certain\n volumes are set up properly because often they need more than just a\n mount call, such as encrypted volumes. This includes SMB/CIFS, NCP,\n davfs2, FUSE, losetup crypto, dm-crypt/cryptsetup and truecrypt.\n\n If you intend to use pam_mount to protect volumes on your computer\n using an encrypted filesystem system, please know that there are many\n other issues you need to consider in order to protect your data. For\n example, you probably want to disable or encrypt your swap partition.\n Don't assume a system is secure without carefully considering\n potential threats.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\ntag_affected = \"pam_mount on Fedora 12\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.fedoraproject.org/pipermail/package-announce/2010-September/046981.html\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.862375\");\n script_version(\"$Revision: 8440 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-01-17 08:58:46 +0100 (Wed, 17 Jan 2018) $\");\n script_tag(name:\"creation_date\", value:\"2010-09-07 15:09:12 +0200 (Tue, 07 Sep 2010)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_xref(name: \"FEDORA\", value: \"2010-13155\");\n script_cve_id(\"CVE-2010-2947\");\n script_name(\"Fedora Update for pam_mount FEDORA-2010-13155\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of pam_mount\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC12\")\n{\n\n if ((res = isrpmvuln(pkg:\"pam_mount\", rpm:\"pam_mount~2.5~1.fc12\", rls:\"FC12\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "nessus": [{"lastseen": "2021-08-19T13:03:21", "description": "Update to libHX 3.6 fixing a buffer overflow in HX_split(): * http://libhx.gi t.sourceforge.net/git/gitweb.cgi?p=libhx/libhx;a=commitdiff;h=904a46f9 0d pam_mount v2.5 (August 10 2010) =============================== Changes: - mount.crypt: fix incorrect processing of binary files in keyfile passthrough - call mount.crypt by means of mount -t crypt (selinux), same for umount - reorder the default path to search in /usr/local first, then /usr, / - config: add missing fd0ssh command to restore volumes using ssh - ofl is now run as a separate process (selinux policy simplification) libHX v3.6 (August 16 2010) =========================== Fixed: - bitmap: set/clear/test had no effect due to wrong type selection - bitmap: avoid left-shift larger than type on 64-bit\n\n - string: fixed buffer overflow in HX_split when too few fields were present in the input libHX 3.5 (August 01 2010) ========================== Fixed: - format2:\n failure to skip escaped char in '%(echo foo\\ bar)' was corrected - proc: properly check for HXPROC_STDx--HXPROC_STDx_NULL overlap - strquote: do not cause allocation with invalid format numbers Enhancements: - format2: add the %(exec) function - format2: add the %(shell) function - format2: security feature for %(exec) and %(shell) - format2: add the %(snl) function - string: HX_strquote gained HXQUOTE_LDAPFLT (LDAP search filter) support - string:\n HX_strquote gained HXQUOTE_LDAPRDN (LDAP relative DN) support Changes: - format1: removed older formatter in favor of format2 - format2: add check for empty key - format2: function-specific delimiters - format2: do nest-counting even with normal parentheses - format2:\n check for zero-argument function calls\n\n - hashmap: do not needlessy change TID when no reshape was done - string: HX_basename (the fast variant) now recognizes the root directory - string: HX_basename now returns the trailing component with slashes instead of everything after the last slash (which may have been nothing)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": null, "vector": null}, "published": "2010-09-04T00:00:00", "type": "nessus", "title": "Fedora 13 : libHX-3.6-1.fc13 / pam_mount-2.5-1.fc13 (2010-13127)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2947"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:libHX", "p-cpe:/a:fedoraproject:fedora:pam_mount", "cpe:/o:fedoraproject:fedora:13"], "id": "FEDORA_2010-13127.NASL", "href": "https://www.tenable.com/plugins/nessus/49105", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2010-13127.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(49105);\n script_version(\"1.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2010-2947\");\n script_bugtraq_id(42592);\n script_xref(name:\"FEDORA\", value:\"2010-13127\");\n\n script_name(english:\"Fedora 13 : libHX-3.6-1.fc13 / pam_mount-2.5-1.fc13 (2010-13127)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Update to libHX 3.6 fixing a buffer overflow in HX_split(): *\nhttp://libhx.gi\nt.sourceforge.net/git/gitweb.cgi?p=libhx/libhx;a=commitdiff;h=904a46f9\n0d pam_mount v2.5 (August 10 2010) ===============================\nChanges: - mount.crypt: fix incorrect processing of binary files in\nkeyfile passthrough - call mount.crypt by means of mount -t crypt\n(selinux), same for umount - reorder the default path to search in\n/usr/local first, then /usr, / - config: add missing fd0ssh command to\nrestore volumes using ssh - ofl is now run as a separate process\n(selinux policy simplification) libHX v3.6 (August 16 2010)\n=========================== Fixed: - bitmap: set/clear/test had no\neffect due to wrong type selection - bitmap: avoid left-shift larger\nthan type on 64-bit\n\n - string: fixed buffer overflow in HX_split when too few\n fields were present in the input libHX 3.5 (August 01\n 2010) ========================== Fixed: - format2:\n failure to skip escaped char in '%(echo foo\\ bar)' was\n corrected - proc: properly check for\n HXPROC_STDx--HXPROC_STDx_NULL overlap - strquote: do not\n cause allocation with invalid format numbers\n Enhancements: - format2: add the %(exec) function -\n format2: add the %(shell) function - format2: security\n feature for %(exec) and %(shell) - format2: add the\n %(snl) function - string: HX_strquote gained\n HXQUOTE_LDAPFLT (LDAP search filter) support - string:\n HX_strquote gained HXQUOTE_LDAPRDN (LDAP relative DN)\n support Changes: - format1: removed older formatter in\n favor of format2 - format2: add check for empty key -\n format2: function-specific delimiters - format2: do\n nest-counting even with normal parentheses - format2:\n check for zero-argument function calls\n\n - hashmap: do not needlessy change TID when no reshape was\n done - string: HX_basename (the fast variant) now\n recognizes the root directory - string: HX_basename now\n returns the trailing component with slashes instead of\n everything after the last slash (which may have been\n nothing)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://libhx.gi\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=625866\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2010-September/046999.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?434f277f\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2010-September/047000.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?6cd82631\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected libHX and / or pam_mount packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:libHX\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:pam_mount\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:13\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2010/08/20\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/09/04\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2010-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^13([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 13.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC13\", reference:\"libHX-3.6-1.fc13\")) flag++;\nif (rpm_check(release:\"FC13\", reference:\"pam_mount-2.5-1.fc13\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libHX / pam_mount\");\n}\n", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-19T13:02:36", "description": "This update fixes a heap-based buffer overflow in HX_split() of libHX.\n(CVE-2010-2947)", "cvss3": {"score": null, "vector": null}, "published": "2010-10-14T00:00:00", "type": "nessus", "title": "openSUSE Security Update : libHX13 (openSUSE-SU-2010:0723-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2947"], "modified": "2021-01-14T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:libHX13", "p-cpe:/a:novell:opensuse:libHX13-32bit", "cpe:/o:novell:opensuse:11.1"], "id": "SUSE_11_1_LIBHX13-100823.NASL", "href": "https://www.tenable.com/plugins/nessus/49975", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update libHX13-2974.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(49975);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2010-2947\");\n\n script_name(english:\"openSUSE Security Update : libHX13 (openSUSE-SU-2010:0723-1)\");\n script_summary(english:\"Check for the libHX13-2974 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update fixes a heap-based buffer overflow in HX_split() of libHX.\n(CVE-2010-2947)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=631582\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://lists.opensuse.org/opensuse-updates/2010-10/msg00014.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected libHX13 packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libHX13\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libHX13-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:11.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2010/08/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/10/14\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2010-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE11\\.1)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"11.1\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE11.1\", reference:\"libHX13-1.23-3.14.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.1\", cpu:\"x86_64\", reference:\"libHX13-32bit-1.23-3.14.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libHX\");\n}\n", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-19T13:03:21", "description": "Update to libHX 3.6 fixing a buffer overflow in HX_split(): * http://libhx.gi t.sourceforge.net/git/gitweb.cgi?p=libhx/libhx;a=commitdiff;h=904a46f9 0d pam_mount v2.5 (August 10 2010) =============================== Changes: - mount.crypt: fix incorrect processing of binary files in keyfile passthrough - call mount.crypt by means of mount -t crypt (selinux), same for umount - reorder the default path to search in /usr/local first, then /usr, / - config: add missing fd0ssh command to restore volumes using ssh - ofl is now run as a separate process (selinux policy simplification) libHX v3.6 (August 16 2010) =========================== Fixed: - bitmap: set/clear/test had no effect due to wrong type selection - bitmap: avoid left-shift larger than type on 64-bit\n\n - string: fixed buffer overflow in HX_split when too few fields were present in the input libHX 3.5 (August 01 2010) ========================== Fixed: - format2:\n failure to skip escaped char in '%(echo foo\\ bar)' was corrected - proc: properly check for HXPROC_STDx--HXPROC_STDx_NULL overlap - strquote: do not cause allocation with invalid format numbers Enhancements: - format2: add the %(exec) function - format2: add the %(shell) function - format2: security feature for %(exec) and %(shell) - format2: add the %(snl) function - string: HX_strquote gained HXQUOTE_LDAPFLT (LDAP search filter) support - string:\n HX_strquote gained HXQUOTE_LDAPRDN (LDAP relative DN) support Changes: - format1: removed older formatter in favor of format2 - format2: add check for empty key - format2: function-specific delimiters - format2: do nest-counting even with normal parentheses - format2:\n check for zero-argument function calls\n\n - hashmap: do not needlessy change TID when no reshape was done - string: HX_basename (the fast variant) now recognizes the root directory - string: HX_basename now returns the trailing component with slashes instead of everything after the last slash (which may have been nothing)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": null, "vector": null}, "published": "2010-09-04T00:00:00", "type": "nessus", "title": "Fedora 12 : libHX-3.6-1.fc12 / pam_mount-2.5-1.fc12 (2010-13155)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2947"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:libHX", "p-cpe:/a:fedoraproject:fedora:pam_mount", "cpe:/o:fedoraproject:fedora:12"], "id": "FEDORA_2010-13155.NASL", "href": "https://www.tenable.com/plugins/nessus/49106", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2010-13155.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(49106);\n script_version(\"1.13\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2010-2947\");\n script_bugtraq_id(42592);\n script_xref(name:\"FEDORA\", value:\"2010-13155\");\n\n script_name(english:\"Fedora 12 : libHX-3.6-1.fc12 / pam_mount-2.5-1.fc12 (2010-13155)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Update to libHX 3.6 fixing a buffer overflow in HX_split(): *\nhttp://libhx.gi\nt.sourceforge.net/git/gitweb.cgi?p=libhx/libhx;a=commitdiff;h=904a46f9\n0d pam_mount v2.5 (August 10 2010) ===============================\nChanges: - mount.crypt: fix incorrect processing of binary files in\nkeyfile passthrough - call mount.crypt by means of mount -t crypt\n(selinux), same for umount - reorder the default path to search in\n/usr/local first, then /usr, / - config: add missing fd0ssh command to\nrestore volumes using ssh - ofl is now run as a separate process\n(selinux policy simplification) libHX v3.6 (August 16 2010)\n=========================== Fixed: - bitmap: set/clear/test had no\neffect due to wrong type selection - bitmap: avoid left-shift larger\nthan type on 64-bit\n\n - string: fixed buffer overflow in HX_split when too few\n fields were present in the input libHX 3.5 (August 01\n 2010) ========================== Fixed: - format2:\n failure to skip escaped char in '%(echo foo\\ bar)' was\n corrected - proc: properly check for\n HXPROC_STDx--HXPROC_STDx_NULL overlap - strquote: do not\n cause allocation with invalid format numbers\n Enhancements: - format2: add the %(exec) function -\n format2: add the %(shell) function - format2: security\n feature for %(exec) and %(shell) - format2: add the\n %(snl) function - string: HX_strquote gained\n HXQUOTE_LDAPFLT (LDAP search filter) support - string:\n HX_strquote gained HXQUOTE_LDAPRDN (LDAP relative DN)\n support Changes: - format1: removed older formatter in\n favor of format2 - format2: add check for empty key -\n format2: function-specific delimiters - format2: do\n nest-counting even with normal parentheses - format2:\n check for zero-argument function calls\n\n - hashmap: do not needlessy change TID when no reshape was\n done - string: HX_basename (the fast variant) now\n recognizes the root directory - string: HX_basename now\n returns the trailing component with slashes instead of\n everything after the last slash (which may have been\n nothing)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://libhx.gi\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=625866\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2010-September/046980.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?7b78dd5e\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2010-September/046981.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?326ae779\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected libHX and / or pam_mount packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:libHX\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:pam_mount\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:12\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2010/08/20\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/09/04\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2010-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^12([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 12.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC12\", reference:\"libHX-3.6-1.fc12\")) flag++;\nif (rpm_check(release:\"FC12\", reference:\"pam_mount-2.5-1.fc12\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libHX / pam_mount\");\n}\n", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-19T12:50:02", "description": "This update fixes a heap-based buffer overflow in HX_split() of libHX.\n(CVE-2010-2947)", "cvss3": {"score": null, "vector": null}, "published": "2014-06-13T00:00:00", "type": "nessus", "title": "openSUSE Security Update : libHX22 (openSUSE-SU-2010:0723-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2947"], "modified": "2021-01-14T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:libHX22", "p-cpe:/a:novell:opensuse:libHX22-32bit", "cpe:/o:novell:opensuse:11.3"], "id": "SUSE_11_3_LIBHX22-100823.NASL", "href": "https://www.tenable.com/plugins/nessus/75581", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update libHX22-2976.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(75581);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2010-2947\");\n\n script_name(english:\"openSUSE Security Update : libHX22 (openSUSE-SU-2010:0723-1)\");\n script_summary(english:\"Check for the libHX22-2976 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update fixes a heap-based buffer overflow in HX_split() of libHX.\n(CVE-2010-2947)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=631582\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://lists.opensuse.org/opensuse-updates/2010-10/msg00014.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected libHX22 packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libHX22\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libHX22-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:11.3\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2010/08/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/06/13\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE11\\.3)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"11.3\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE11.3\", reference:\"libHX22-3.4-2.1.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.3\", cpu:\"x86_64\", reference:\"libHX22-32bit-3.4-2.1.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libHX\");\n}\n", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-19T13:02:47", "description": "Update to libHX 3.6 fixing a buffer overflow in HX_split() :\n\n - http://libhx.git.sourceforge.net/git/gitweb.cgi?p=libhx/ libhx;a=commitdiff;h=904a46f90d\n\npam_mount v2.5 (August 10 2010) =============================== Changes :\n\n - mount.crypt: fix incorrect processing of binary files in keyfile passthrough\n\n - call mount.crypt by means of mount -t crypt (selinux), same for umount\n\n - reorder the default path to search in /usr/local first, then /usr, /\n\n - config: add missing fd0ssh command to restore volumes using ssh\n\n - ofl is now run as a separate process (selinux policy simplification)\n\nlibHX v3.6 (August 16 2010) =========================== Fixed :\n\n - bitmap: set/clear/test had no effect due to wrong type selection\n\n - bitmap: avoid left-shift larger than type on 64-bit\n\n - string: fixed buffer overflow in HX_split when too few fields were present in the input\n\nlibHX 3.5 (August 01 2010) ========================== Fixed :\n\n - format2: failure to skip escaped char in '%(echo foo\\ bar)' was corrected\n\n - proc: properly check for HXPROC_STDx--HXPROC_STDx_NULL overlap\n\n - strquote: do not cause allocation with invalid format numbers Enhancements :\n\n - format2: add the %(exec) function\n\n - format2: add the %(shell) function\n\n - format2: security feature for %(exec) and %(shell)\n\n - format2: add the %(snl) function\n\n - string: HX_strquote gained HXQUOTE_LDAPFLT (LDAP search filter) support\n\n - string: HX_strquote gained HXQUOTE_LDAPRDN (LDAP relative DN) support Changes :\n\n - format1: removed older formatter in favor of format2\n\n - format2: add check for empty key\n\n - format2: function-specific delimiters\n\n - format2: do nest-counting even with normal parentheses\n\n - format2: check for zero-argument function calls\n\n - hashmap: do not needlessy change TID when no reshape was done\n\n - string: HX_basename (the fast variant) now recognizes the root directory\n\n - string: HX_basename now returns the trailing component with slashes instead of everything after the last slash (which may have been nothing)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": null, "vector": null}, "published": "2010-10-29T00:00:00", "type": "nessus", "title": "Fedora 14 : libHX-3.6-1.fc14 / pam_mount-2.5-1.fc14 (2010-12950)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2947"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:libHX", "p-cpe:/a:fedoraproject:fedora:pam_mount", "cpe:/o:fedoraproject:fedora:14"], "id": "FEDORA_2010-12950.NASL", "href": "https://www.tenable.com/plugins/nessus/50389", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2010-12950.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(50389);\n script_version(\"1.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2010-2947\");\n script_bugtraq_id(42592);\n script_xref(name:\"FEDORA\", value:\"2010-12950\");\n\n script_name(english:\"Fedora 14 : libHX-3.6-1.fc14 / pam_mount-2.5-1.fc14 (2010-12950)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Update to libHX 3.6 fixing a buffer overflow in HX_split() :\n\n -\n http://libhx.git.sourceforge.net/git/gitweb.cgi?p=libhx/\n libhx;a=commitdiff;h=904a46f90d\n\npam_mount v2.5 (August 10 2010) ===============================\nChanges :\n\n - mount.crypt: fix incorrect processing of binary files in\n keyfile passthrough\n\n - call mount.crypt by means of mount -t crypt (selinux),\n same for umount\n\n - reorder the default path to search in /usr/local\n first, then /usr, /\n\n - config: add missing fd0ssh command to restore volumes\n using ssh\n\n - ofl is now run as a separate process (selinux policy\n simplification)\n\nlibHX v3.6 (August 16 2010) =========================== Fixed :\n\n - bitmap: set/clear/test had no effect due to wrong type\n selection\n\n - bitmap: avoid left-shift larger than type on 64-bit\n\n - string: fixed buffer overflow in HX_split when too few\n fields were present in the input\n\nlibHX 3.5 (August 01 2010) ========================== Fixed :\n\n - format2: failure to skip escaped char in '%(echo foo\\\n bar)' was corrected\n\n - proc: properly check for HXPROC_STDx--HXPROC_STDx_NULL\n overlap\n\n - strquote: do not cause allocation with invalid format\n numbers Enhancements :\n\n - format2: add the %(exec) function\n\n - format2: add the %(shell) function\n\n - format2: security feature for %(exec) and %(shell)\n\n - format2: add the %(snl) function\n\n - string: HX_strquote gained HXQUOTE_LDAPFLT (LDAP\n search filter) support\n\n - string: HX_strquote gained HXQUOTE_LDAPRDN (LDAP\n relative DN) support Changes :\n\n - format1: removed older formatter in favor of format2\n\n - format2: add check for empty key\n\n - format2: function-specific delimiters\n\n - format2: do nest-counting even with normal parentheses\n\n - format2: check for zero-argument function calls\n\n - hashmap: do not needlessy change TID when no reshape\n was done\n\n - string: HX_basename (the fast variant) now recognizes\n the root directory\n\n - string: HX_basename now returns the trailing component\n with slashes instead of everything after the last\n slash (which may have been nothing)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n # http://libhx.git.sourceforge.net/git/gitweb.cgi?p=libhx/libhx;a=commitdiff;h=904a46f90d\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?6bfbed59\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=625866\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2010-October/050088.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?35fb2b43\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2010-October/050089.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?f4b7ea31\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected libHX and / or pam_mount packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:libHX\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:pam_mount\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:14\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2010/08/17\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/10/29\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2010-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^14([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 14.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC14\", reference:\"libHX-3.6-1.fc14\")) flag++;\nif (rpm_check(release:\"FC14\", reference:\"pam_mount-2.5-1.fc14\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libHX / pam_mount\");\n}\n", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-19T13:02:25", "description": "This update fixes a heap-based buffer overflow in HX_split() of libHX.\n(CVE-2010-2947)", "cvss3": {"score": null, "vector": null}, "published": "2010-12-02T00:00:00", "type": "nessus", "title": "SuSE 11 / 11.1 Security Update : libHX13 (SAT Patch Numbers 2979 / 2980)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2947"], "modified": "2021-01-14T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:11:libHX13", "p-cpe:/a:novell:suse_linux:11:libHX13-32bit", "cpe:/o:novell:suse_linux:11"], "id": "SUSE_11_LIBHX13-100823.NASL", "href": "https://www.tenable.com/plugins/nessus/50928", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from SuSE 11 update information. The text itself is\n# copyright (C) Novell, Inc.\n#\n\nif (NASL_LEVEL < 3000) exit(0);\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(50928);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2010-2947\");\n\n script_name(english:\"SuSE 11 / 11.1 Security Update : libHX13 (SAT Patch Numbers 2979 / 2980)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SuSE 11 host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update fixes a heap-based buffer overflow in HX_split() of libHX.\n(CVE-2010-2947)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=631582\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2010-2947.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Apply SAT patch number 2979 / 2980 as appropriate.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:11:libHX13\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:11:libHX13-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:11\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2010/08/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/12/02\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2010-2021 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)11\") audit(AUDIT_OS_NOT, \"SuSE 11\");\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SuSE 11\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"SLED11\", sp:0, cpu:\"i586\", reference:\"libHX13-1.23-4.1.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:0, cpu:\"x86_64\", reference:\"libHX13-1.23-4.1.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:0, cpu:\"x86_64\", reference:\"libHX13-32bit-1.23-4.1.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:1, cpu:\"i586\", reference:\"libHX13-1.23-4.1.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:1, cpu:\"x86_64\", reference:\"libHX13-1.23-4.1.1\")) flag++;\nif (rpm_check(release:\"SLED11\", sp:1, cpu:\"x86_64\", reference:\"libHX13-32bit-1.23-4.1.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:0, reference:\"libHX13-1.23-4.1.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:0, cpu:\"s390x\", reference:\"libHX13-32bit-1.23-4.1.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:0, cpu:\"x86_64\", reference:\"libHX13-32bit-1.23-4.1.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:1, reference:\"libHX13-1.23-4.1.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:1, cpu:\"s390x\", reference:\"libHX13-32bit-1.23-4.1.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:1, cpu:\"x86_64\", reference:\"libHX13-32bit-1.23-4.1.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-19T13:02:36", "description": "This update fixes a heap-based buffer overflow in HX_split() of libHX.\n(CVE-2010-2947)", "cvss3": {"score": null, "vector": null}, "published": "2010-10-14T00:00:00", "type": "nessus", "title": "openSUSE Security Update : libHX18 (openSUSE-SU-2010:0723-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2947"], "modified": "2021-01-14T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:libHX18", "p-cpe:/a:novell:opensuse:libHX18-32bit", "cpe:/o:novell:opensuse:11.2"], "id": "SUSE_11_2_LIBHX18-100823.NASL", "href": "https://www.tenable.com/plugins/nessus/49976", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update libHX18-2975.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(49976);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2010-2947\");\n\n script_name(english:\"openSUSE Security Update : libHX18 (openSUSE-SU-2010:0723-1)\");\n script_summary(english:\"Check for the libHX18-2975 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update fixes a heap-based buffer overflow in HX_split() of libHX.\n(CVE-2010-2947)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=631582\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://lists.opensuse.org/opensuse-updates/2010-10/msg00014.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected libHX18 packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libHX18\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libHX18-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:11.2\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2010/08/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/10/14\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2010-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE11\\.2)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"11.2\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE11.2\", reference:\"libHX18-2.9-1.1.1\") ) flag++;\nif ( rpm_check(release:\"SUSE11.2\", cpu:\"x86_64\", reference:\"libHX18-32bit-2.9-1.1.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libHX\");\n}\n", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-19T13:03:13", "description": "A vulnerability has been found and corrected in libHX :\n\nHeap-based buffer overflow in the HX_split function in string.c in libHX before 3.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a string that is inconsistent with the expected number of fields (CVE-2010-2947).\n\nThe updated packages have been patched to correct this issue.", "cvss3": {"score": null, "vector": null}, "published": "2010-08-31T00:00:00", "type": "nessus", "title": "Mandriva Linux Security Advisory : libHX (MDVSA-2010:165)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2947"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:mandriva:linux:lib64HX-devel", "p-cpe:/a:mandriva:linux:lib64HX14", "p-cpe:/a:mandriva:linux:lib64HX18", "p-cpe:/a:mandriva:linux:lib64HX22", "p-cpe:/a:mandriva:linux:libHX-devel", "p-cpe:/a:mandriva:linux:libHX14", "p-cpe:/a:mandriva:linux:libHX18", "p-cpe:/a:mandriva:linux:libHX22", "cpe:/o:mandriva:linux:2009.0", "cpe:/o:mandriva:linux:2009.1", "cpe:/o:mandriva:linux:2010.0", "cpe:/o:mandriva:linux:2010.1"], "id": "MANDRIVA_MDVSA-2010-165.NASL", "href": "https://www.tenable.com/plugins/nessus/48933", "sourceData": "#%NASL_MIN_LEVEL 70300\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Mandriva Linux Security Advisory MDVSA-2010:165. \n# The text itself is copyright (C) Mandriva S.A.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(48933);\n script_version(\"1.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2010-2947\");\n script_bugtraq_id(42592);\n script_xref(name:\"MDVSA\", value:\"2010:165\");\n\n script_name(english:\"Mandriva Linux Security Advisory : libHX (MDVSA-2010:165)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Mandriva Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"A vulnerability has been found and corrected in libHX :\n\nHeap-based buffer overflow in the HX_split function in string.c in\nlibHX before 3.6 allows remote attackers to execute arbitrary code or\ncause a denial of service (application crash) via a string that is\ninconsistent with the expected number of fields (CVE-2010-2947).\n\nThe updated packages have been patched to correct this issue.\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64HX-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64HX14\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64HX18\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64HX22\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libHX-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libHX14\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libHX18\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libHX22\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2009.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2009.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2010.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2010.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2010/08/30\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/08/31\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2010-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Mandriva Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/Mandrake/release\", \"Host/Mandrake/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Mandrake/release\")) audit(AUDIT_OS_NOT, \"Mandriva / Mandake Linux\");\nif (!get_kb_item(\"Host/Mandrake/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^(amd64|i[3-6]86|x86_64)$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Mandriva / Mandrake Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"MDK2009.0\", cpu:\"x86_64\", reference:\"lib64HX-devel-1.25-1.1mdv2009.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.0\", cpu:\"x86_64\", reference:\"lib64HX14-1.25-1.1mdv2009.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.0\", cpu:\"i386\", reference:\"libHX-devel-1.25-1.1mdv2009.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.0\", cpu:\"i386\", reference:\"libHX14-1.25-1.1mdv2009.0\", yank:\"mdv\")) flag++;\n\nif (rpm_check(release:\"MDK2009.1\", cpu:\"x86_64\", reference:\"lib64HX-devel-2.5-1.1mdv2009.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.1\", cpu:\"x86_64\", reference:\"lib64HX18-2.5-1.1mdv2009.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.1\", cpu:\"i386\", reference:\"libHX-devel-2.5-1.1mdv2009.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.1\", cpu:\"i386\", reference:\"libHX18-2.5-1.1mdv2009.1\", yank:\"mdv\")) flag++;\n\nif (rpm_check(release:\"MDK2010.0\", cpu:\"x86_64\", reference:\"lib64HX-devel-3.1-1.1mdv2010.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2010.0\", cpu:\"x86_64\", reference:\"lib64HX22-3.1-1.1mdv2010.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2010.0\", cpu:\"i386\", reference:\"libHX-devel-3.1-1.1mdv2010.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2010.0\", cpu:\"i386\", reference:\"libHX22-3.1-1.1mdv2010.0\", yank:\"mdv\")) flag++;\n\nif (rpm_check(release:\"MDK2010.1\", cpu:\"x86_64\", reference:\"lib64HX-devel-3.4-1.1mdv2010.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2010.1\", cpu:\"x86_64\", reference:\"lib64HX22-3.4-1.1mdv2010.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2010.1\", cpu:\"i386\", reference:\"libHX-devel-3.4-1.1mdv2010.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2010.1\", cpu:\"i386\", reference:\"libHX22-3.4-1.1mdv2010.1\", yank:\"mdv\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "ubuntucve": [{"lastseen": "2021-11-22T21:58:18", "description": "Heap-based buffer overflow in the HX_split function in string.c in libHX\nbefore 3.6 allows remote attackers to execute arbitrary code or cause a\ndenial of service (application crash) via a string that is inconsistent\nwith the expected number of fields.\n\n#### Bugs\n\n * <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=594393>\n", "cvss3": {}, "published": "2010-08-24T00:00:00", "type": "ubuntucve", "title": "CVE-2010-2947", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-2947"], "modified": "2010-08-24T00:00:00", "id": "UB:CVE-2010-2947", "href": "https://ubuntu.com/security/CVE-2010-2947", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "debiancve": [{"lastseen": "2021-12-14T17:49:47", "description": "Heap-based buffer overflow in the HX_split function in string.c in libHX before 3.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a string that is inconsistent with the expected number of fields.", "cvss3": {}, "published": "2010-08-24T20:00:00", "type": "debiancve", "title": "CVE-2010-2947", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-2947"], "modified": "2010-08-24T20:00:00", "id": "DEBIANCVE:CVE-2010-2947", "href": "https://security-tracker.debian.org/tracker/CVE-2010-2947", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "securityvulns": [{"lastseen": "2018-08-31T11:10:36", "description": "-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA1\r\n\r\n _______________________________________________________________________\r\n\r\n Mandriva Linux Security Advisory MDVSA-2010:165\r\n http://www.mandriva.com/security/\r\n _______________________________________________________________________\r\n\r\n Package : libHX\r\n Date : August 30, 2010\r\n Affected: 2009.0, 2009.1, 2010.0, 2010.1\r\n _______________________________________________________________________\r\n\r\n Problem Description:\r\n\r\n A vulnerability has been found and corrected in libHX:\r\n \r\n Heap-based buffer overflow in the HX_split function in string.c in\r\n libHX before 3.6 allows remote attackers to execute arbitrary code\r\n or cause a denial of service (application crash) via a string that\r\n is inconsistent with the expected number of fields (CVE-2010-2947).\r\n \r\n The updated packages have been patched to correct this issue.\r\n _______________________________________________________________________\r\n\r\n References:\r\n\r\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2947\r\n _______________________________________________________________________\r\n\r\n Updated Packages:\r\n\r\n Mandriva Linux 2009.0:\r\n 30879036b694a7d19cdb41640f0dea83 2009.0/i586/libHX14-1.25-1.1mdv2009.0.i586.rpm\r\n e78b8e20bb8359d09381f4293f312ab9 2009.0/i586/libHX-devel-1.25-1.1mdv2009.0.i586.rpm \r\n 17ed58aeb3106050af508863e7bb532c 2009.0/SRPMS/libHX-1.25-1.1mdv2009.0.src.rpm\r\n\r\n Mandriva Linux 2009.0/X86_64:\r\n 55008cab5dbe805f3f7aa66587158196 2009.0/x86_64/lib64HX14-1.25-1.1mdv2009.0.x86_64.rpm\r\n 0cb4a0ec66a254b97b1113d588c8b507 2009.0/x86_64/lib64HX-devel-1.25-1.1mdv2009.0.x86_64.rpm \r\n 17ed58aeb3106050af508863e7bb532c 2009.0/SRPMS/libHX-1.25-1.1mdv2009.0.src.rpm\r\n\r\n Mandriva Linux 2009.1:\r\n 4d9273cc8b1abde9cb3f75354cd9b865 2009.1/i586/libHX18-2.5-1.1mdv2009.1.i586.rpm\r\n d3cacba167a201ac52eec92e7db6b57c 2009.1/i586/libHX-devel-2.5-1.1mdv2009.1.i586.rpm \r\n 281f161c5eef405a789ef0602ccc383a 2009.1/SRPMS/libHX-2.5-1.1mdv2009.1.src.rpm\r\n\r\n Mandriva Linux 2009.1/X86_64:\r\n abef150f002c13004b75703d7fdfe99c 2009.1/x86_64/lib64HX18-2.5-1.1mdv2009.1.x86_64.rpm\r\n 472c31715d26dda438737aec2ab949da 2009.1/x86_64/lib64HX-devel-2.5-1.1mdv2009.1.x86_64.rpm \r\n 281f161c5eef405a789ef0602ccc383a 2009.1/SRPMS/libHX-2.5-1.1mdv2009.1.src.rpm\r\n\r\n Mandriva Linux 2010.0:\r\n 8564662c69f7b7ba3705ee8d92bf2d21 2010.0/i586/libHX22-3.1-1.1mdv2010.0.i586.rpm\r\n 7f5c8dd865e4d7cd3778eaba70015236 2010.0/i586/libHX-devel-3.1-1.1mdv2010.0.i586.rpm \r\n 68d99c38037ea381b61d443f0b96ddd7 2010.0/SRPMS/libHX-3.1-1.1mdv2010.0.src.rpm\r\n\r\n Mandriva Linux 2010.0/X86_64:\r\n dc715e9a946b953224601d1816e32227 2010.0/x86_64/lib64HX22-3.1-1.1mdv2010.0.x86_64.rpm\r\n 24f85c289c653773cbeb4f12dbbc1c1d 2010.0/x86_64/lib64HX-devel-3.1-1.1mdv2010.0.x86_64.rpm \r\n 68d99c38037ea381b61d443f0b96ddd7 2010.0/SRPMS/libHX-3.1-1.1mdv2010.0.src.rpm\r\n\r\n Mandriva Linux 2010.1:\r\n 21f3bfeb5a3f5b617d815e8df47cf04d 2010.1/i586/libHX22-3.4-1.1mdv2010.1.i586.rpm\r\n 2ae34a52ba376791751993b2d4506e0e 2010.1/i586/libHX-devel-3.4-1.1mdv2010.1.i586.rpm \r\n 31f0088e48f6618b98698b2667109f5b 2010.1/SRPMS/libHX-3.4-1.1mdv2010.1.src.rpm\r\n\r\n Mandriva Linux 2010.1/X86_64:\r\n 4ebf4624bb4f74af9e84ded9ed5fa0d1 2010.1/x86_64/lib64HX22-3.4-1.1mdv2010.1.x86_64.rpm\r\n ab0e62cdebc3da684b75956b0924d653 2010.1/x86_64/lib64HX-devel-3.4-1.1mdv2010.1.x86_64.rpm \r\n 31f0088e48f6618b98698b2667109f5b 2010.1/SRPMS/libHX-3.4-1.1mdv2010.1.src.rpm\r\n _______________________________________________________________________\r\n\r\n To upgrade automatically use MandrivaUpdate or urpmi. The verification\r\n of md5 checksums and GPG signatures is performed automatically for you.\r\n\r\n All packages are signed by Mandriva for security. You can obtain the\r\n GPG public key of the Mandriva Security Team by executing:\r\n\r\n gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98\r\n\r\n You can view other update advisories for Mandriva Linux at:\r\n\r\n http://www.mandriva.com/security/advisories\r\n\r\n If you want to report vulnerabilities, please contact\r\n\r\n security_(at)_mandriva.com\r\n _______________________________________________________________________\r\n\r\n Type Bits/KeyID Date User ID\r\n pub 1024D/22458A98 2000-07-10 Mandriva Security Team\r\n <security*mandriva.com>\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG v1.4.9 (GNU/Linux)\r\n\r\niD8DBQFMe7PcmqjQ0CJFipgRAuIbAJ9PqAKW7iPFNmdZ9aHnSCtxLP90zQCfag9i\r\n2e/ZLxygKIWXbddiAlluJWo=\r\n=mI22\r\n-----END PGP SIGNATURE-----", "edition": 1, "cvss3": {}, "published": "2010-09-02T00:00:00", "title": "[ MDVSA-2010:165 ] libHX", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2010-2947"], "modified": "2010-09-02T00:00:00", "id": "SECURITYVULNS:DOC:24669", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:24669", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2021-06-08T19:18:18", "description": "Hep buffer overflow in HX_split function.", "edition": 2, "cvss3": {}, "published": "2010-09-02T00:00:00", "title": "libHX library buffer overflow", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2010-2947"], "modified": "2010-09-02T00:00:00", "id": "SECURITYVULNS:VULN:11114", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:11114", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "ubuntu": [{"lastseen": "2022-01-04T13:18:28", "description": "It was discovered that libHX incorrectly handled certain parameters to the \nHX_split function. An attacker could use this flaw to cause a denial of \nservice or possibly execute arbitrary code with the privileges of the user.\n\nThe default compiler options for affected releases should reduce the \nvulnerability to a denial of service.\n", "cvss3": {}, "published": "2010-09-29T00:00:00", "type": "ubuntu", "title": "libHX vulnerability", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-2947"], "modified": "2010-09-29T00:00:00", "id": "USN-994-1", "href": "https://ubuntu.com/security/notices/USN-994-1", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "cve": [{"lastseen": "2022-03-23T12:21:53", "description": "Heap-based buffer overflow in the HX_split function in string.c in libHX before 3.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a string that is inconsistent with the expected number of fields.", "cvss3": {}, "published": "2010-08-24T20:00:00", "type": "cve", "title": "CVE-2010-2947", "cwe": ["CWE-119"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-2947"], "modified": "2011-01-14T06:46:00", "cpe": ["cpe:/a:jan_engelhardt:libhx:1.10.1", "cpe:/a:jan_engelhardt:libhx:1.23", "cpe:/a:jan_engelhardt:libhx:1.26", "cpe:/a:jan_engelhardt:libhx:2.9", "cpe:/a:jan_engelhardt:libhx:3.1", "cpe:/a:jan_engelhardt:libhx:1.10.2", "cpe:/a:jan_engelhardt:libhx:3.0.1", "cpe:/a:jan_engelhardt:libhx:3.4", "cpe:/a:jan_engelhardt:libhx:2.7", "cpe:/a:jan_engelhardt:libhx:1.10.0", "cpe:/a:jan_engelhardt:libhx:2.5", "cpe:/a:jan_engelhardt:libhx:2.0", "cpe:/a:jan_engelhardt:libhx:2.3", "cpe:/a:jan_engelhardt:libhx:1.25", "cpe:/a:jan_engelhardt:libhx:1.18", "cpe:/a:jan_engelhardt:libhx:3.2", "cpe:/a:jan_engelhardt:libhx:1.28", "cpe:/a:jan_engelhardt:libhx:2.1", "cpe:/a:jan_engelhardt:libhx:1.27", "cpe:/a:jan_engelhardt:libhx:2.6", "cpe:/a:jan_engelhardt:libhx:2.4", "cpe:/a:jan_engelhardt:libhx:3.3", "cpe:/a:jan_engelhardt:libhx:1.17", "cpe:/a:jan_engelhardt:libhx:2.8", "cpe:/a:jan_engelhardt:libhx:3.5", "cpe:/a:jan_engelhardt:libhx:2.2", "cpe:/a:jan_engelhardt:libhx:1.22", "cpe:/a:jan_engelhardt:libhx:3.0", "cpe:/a:jan_engelhardt:libhx:1.15"], "id": "CVE-2010-2947", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-2947", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cpe23": ["cpe:2.3:a:jan_engelhardt:libhx:3.4:*:*:*:*:*:*:*", "cpe:2.3:a:jan_engelhardt:libhx:1.27:*:*:*:*:*:*:*", "cpe:2.3:a:jan_engelhardt:libhx:2.5:*:*:*:*:*:*:*", "cpe:2.3:a:jan_engelhardt:libhx:3.0:*:*:*:*:*:*:*", "cpe:2.3:a:jan_engelhardt:libhx:1.17:*:*:*:*:*:*:*", "cpe:2.3:a:jan_engelhardt:libhx:2.4:*:*:*:*:*:*:*", "cpe:2.3:a:jan_engelhardt:libhx:2.2:*:*:*:*:*:*:*", "cpe:2.3:a:jan_engelhardt:libhx:3.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:jan_engelhardt:libhx:1.18:*:*:*:*:*:*:*", "cpe:2.3:a:jan_engelhardt:libhx:1.10.2:*:*:*:*:*:*:*", "cpe:2.3:a:jan_engelhardt:libhx:1.10.1:*:*:*:*:*:*:*", "cpe:2.3:a:jan_engelhardt:libhx:3.3:*:*:*:*:*:*:*", "cpe:2.3:a:jan_engelhardt:libhx:2.8:*:*:*:*:*:*:*", "cpe:2.3:a:jan_engelhardt:libhx:3.5:*:*:*:*:*:*:*", "cpe:2.3:a:jan_engelhardt:libhx:1.22:*:*:*:*:*:*:*", "cpe:2.3:a:jan_engelhardt:libhx:2.3:*:*:*:*:*:*:*", "cpe:2.3:a:jan_engelhardt:libhx:2.0:*:*:*:*:*:*:*", "cpe:2.3:a:jan_engelhardt:libhx:1.28:*:*:*:*:*:*:*", "cpe:2.3:a:jan_engelhardt:libhx:2.9:*:*:*:*:*:*:*", "cpe:2.3:a:jan_engelhardt:libhx:1.25:*:*:*:*:*:*:*", "cpe:2.3:a:jan_engelhardt:libhx:1.10.0:*:*:*:*:*:*:*", "cpe:2.3:a:jan_engelhardt:libhx:1.23:*:*:*:*:*:*:*", "cpe:2.3:a:jan_engelhardt:libhx:2.1:*:*:*:*:*:*:*", "cpe:2.3:a:jan_engelhardt:libhx:1.26:*:*:*:*:*:*:*", "cpe:2.3:a:jan_engelhardt:libhx:2.6:*:*:*:*:*:*:*", "cpe:2.3:a:jan_engelhardt:libhx:2.7:*:*:*:*:*:*:*", "cpe:2.3:a:jan_engelhardt:libhx:1.15:*:*:*:*:*:*:*", "cpe:2.3:a:jan_engelhardt:libhx:3.2:*:*:*:*:*:*:*", "cpe:2.3:a:jan_engelhardt:libhx:3.1:*:*:*:*:*:*:*"]}]}