Security update for WebYaST (important)

2014-01-0616:04:13

lists.opensuse.org

EPSS

0.001

Percentile

16.0%

JSON

In the past WebYAST was installed with world readable
secret tokens. Although these were modified on the start
of the webyast service and so could not be read from
remote, it was possible for local attackers on the same
machine to read the secrets and so gain local root access
via the webyast services. This has been fixed.
(CVE-2013-3709)

OSVersionArchitecturePackageVersionFilename
WebYaST1.2noarchwebyast-base-ui-testsuite< 0.2.64-0.3.1webyast-base-ui-testsuite-0.2.64-0.3.1.noarch.rpm
WebYaST1.2noarchwebyast-base-ui-branding-default< 0.2.64-0.3.1webyast-base-ui-branding-default-0.2.64-0.3.1.noarch.rpm
WebYaST1.2noarchwebyast-base-ui< 0.2.64-0.3.1webyast-base-ui-0.2.64-0.3.1.noarch.rpm

OS	Version	Architecture	Package	Version	Filename
WebYaST	1.2	noarch	webyast-base-ui-testsuite	< 0.2.64-0.3.1	webyast-base-ui-testsuite-0.2.64-0.3.1.noarch.rpm
WebYaST	1.2	noarch	webyast-base-ui-branding-default	< 0.2.64-0.3.1	webyast-base-ui-branding-default-0.2.64-0.3.1.noarch.rpm
WebYaST	1.2	noarch	webyast-base-ui	< 0.2.64-0.3.1	webyast-base-ui-0.2.64-0.3.1.noarch.rpm