Rapid7 Vulnerability & Exploit Database

SuSE: liby2util 2.11.7-0.1

Back to Search

SuSE: liby2util 2.11.7-0.1

Severity
4
CVSS
(AV:L/AC:M/Au:S/C:P/I:P/A:P)
Published
01/01/2005
Created
07/25/2018
Added
11/08/2005
Modified
11/18/2015

Description

Rene "l00m" Fischer found two problem in the handling of package repositories.

  • The remote repositories were copied with permissions and ownerships intact. If the remote repository was owned by a user or had problematic permissions, these ownership and permissions were copied over to the system.

If these included world writeable permissions local users could overwrite package meta files.

This problem is not present when installing from CD or a correctly set up network source.

  • The YaST package handling had a bufferoverflow which could be used by attackers having access to the meta data (for instance due to above permission problem) to potentially execute code.

These problems have been fixed with this update.

Solution(s)

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;