Rapid7 Vulnerability & Exploit Database

SuSE: liby2util 2.12.9-0.1

Free InsightVM Trial No credit card necessary
Watch Demo See how it all works
Back to Search

SuSE: liby2util 2.12.9-0.1

Severity
4
CVSS
(AV:L/AC:M/Au:S/C:P/I:P/A:P)
Published
09/30/2005
Created
07/25/2018
Added
11/08/2005
Modified
11/18/2015

Description

Rene "l00m" Fischer found two problem in the handling of package repositories.

  • The remote repositories were copied with permissions and ownerships intact. If the remote repository was owned by a user or had problematic permissions, these ownership and permissions were copied over to the system.

If these included world writeable permissions local users could overwrite package meta files.

This problem is not present when installing from CD or a correctly set up network source.

  • The YaST package handling had a bufferoverflow which could be used by attackers having access to the meta data (for instance due to above permission problem) to potentially execute code.

These problems have been fixed with this update.

Solution(s)

References

insightVM

Advanced vulnerability management analytics and reporting.
Key Features
Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;