Lucene search
RootSSV:3670HistoryJul 17, 2008 - 12:00 a.m.
Afuse 'afuse.c' SHELL命令注入漏洞
2008-07-1700:00:00
Root
www.seebug.org
9
0.0004 Low
EPSS
Percentile
5.7%
BUGTRAQ ID: 30245
CVE ID：CVE-2008-2232
CNCVE ID：CNCVE-20082232
Afuse是一款类似autofs工具的文件系统自动挂接程序。
Afuse不正确处理命令行参数，本地攻击者可以利用漏洞以高特权执行任意命令。
afuse接收如下形式的命令行：
afuse /path -o mount_template="mount-script %m %r"
unmount_template="unmount-script %m %r"
%m是挂入点而%r是下个要访问的组件路径名，而程序对元字符缺少过滤，传递恶意的字符串可导致system()以高特权执行任意命令。
Afuse 0.2-2
升级到Afuse 0.2-3：
<a href=“http://afuse.sourceforge.net/” target=“_blank”>http://afuse.sourceforge.net/</a>
使用类似如下的路径
/path/";arbitrary command;"
/path/`arbitrary command`
可导致任意命令执行。
Related
fedora
fedora
[SECURITY] Fedora 11 Update: afuse-0.2-4.fc11
2009-08-20 21:03:32
[SECURITY] Fedora 10 Update: afuse-0.2-4.fc10
2009-08-20 20:58:50
nessus
nessus
Debian DSA-1611-1 : afuse - privilege escalation
2008-07-17 00:00:00
Fedora 10 : afuse-0.2-4.fc10 (2009-8792)
2009-08-24 00:00:00
Fedora 11 : afuse-0.2-4.fc11 (2009-8816)
2009-08-24 00:00:00
openvas
openvas
Debian: Security Advisory (DSA-1611-1)
2008-08-15 00:00:00
Fedora Core 10 FEDORA-2009-8792 (afuse)
2009-09-02 00:00:00
Fedora Core 11 FEDORA-2009-8816 (afuse)
2009-09-02 00:00:00
debian
debian
[SECURITY] [DSA 1611-1] New afuse packages fix privilege escalation
2008-07-16 19:18:38
seebug
seebug
Afuse afuse.c文件Shell命令注入漏洞
2008-07-21 00:00:00
ubuntucve
ubuntucve
CVE-2008-2232
2008-07-17 00:00:00
debiancve
debiancve
CVE-2008-2232
2008-07-17 13:41:00
prion
prion
Code injection
2008-07-17 13:41:00
osv
osv
afuse - privilege escalation
2008-07-16 00:00:00
securityvulns
securityvulns
afuse shell characters problem
2008-07-19 00:00:00
[SECURITY] [DSA 1611-1] New afuse packages fix privilege escalation
2008-07-19 00:00:00
cve
cve
CVE-2008-2232
2008-07-17 13:41:00