Lucene search

K
osvGoogleOSV:DSA-704-1
HistoryApr 04, 2005 - 12:00 a.m.

remstats - tempfile, missing input sanitising

2005-04-0400:00:00
Google
osv.dev
6

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

Jens Steube discovered several vulnerabilities in remstats, the remote
statistics system. The Common Vulnerabilities and Exposures project
identifies the following problems:

  • CAN-2005-0387
    When processing uptime data on the unix-server a temporary file is
    opened in an insecure fashion which could be used for a symlink
    attack to create or overwrite arbitrary files with the permissions
    of the remstats user.

  • CAN-2005-0388
    The remoteping service can be exploited to execute arbitrary
    commands due to missing input sanitising.

For the stable distribution (woody) these problems have been fixed in
version 1.00a4-8woody1.

For the unstable distribution (sid) these problems have been fixed in
version 1.0.13a-5.

We recommend that you upgrade your remstats packages.

CPENameOperatorVersion
remstatseq1.00a4-8

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P