Executive Summary
| Summary | |
|---|---|
| Title | supervisor security update |
| Informations | |||
|---|---|---|---|
| Name | DSA-3942 | First vendor Publication | 2017-08-13 |
| Vendor | Debian | Last vendor Modification | 2017-08-13 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:S/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 9 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 8 | Authentication | Requires single instance |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Calum Hutton reported that the XML-RPC server in supervisor, a system for controlling process state, does not perform validation on requested XML-RPC methods, allowing an authenticated client to send a malicious XML-RPC request to supervisord that will run arbitrary shell commands on the server as the same user as supervisord. The vulnerability has been fixed by disabling nested namespace lookup entirely. supervisord will now only call methods on the object registered to handle XML-RPC requests and not any child objects it may contain, possibly breaking existing setups. No publicly available plugins are currently known that use nested namespaces. Plugins that use a single namespace will continue to work as before. Details can be found on the upstream issue at https://github.com/Supervisor/supervisor/issues/964 . For the oldstable distribution (jessie), this problem has been fixed in version 3.0r1-1+deb8u1. For the stable distribution (stretch), this problem has been fixed in version 3.3.1-1+deb9u1. We recommend that you upgrade your supervisor packages. |
Original Source
| Url : http://www.debian.org/security/2017/dsa-3942 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-276 | Incorrect Default Permissions |
CPE : Common Platform Enumeration
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2017-11-07 | Supervisord remote code execution attempt RuleID : 44483 - Revision : 2 - Type : SERVER-OTHER |
Metasploit Database
| id | Description |
|---|---|
| 2017-07-19 | Supervisor XML-RPC Authenticated Remote Code Execution |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2017-09-18 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201709-06.nasl - Type : ACT_GATHER_INFO |
| 2017-08-16 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_c946038081e311e793af005056925db4.nasl - Type : ACT_GATHER_INFO |
| 2017-08-14 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3942.nasl - Type : ACT_GATHER_INFO |
| 2017-08-11 | Name : The remote Fedora host is missing a security update. File : fedora_2017-713430fb15.nasl - Type : ACT_GATHER_INFO |
| 2017-08-09 | Name : The remote Fedora host is missing a security update. File : fedora_2017-85eb9f7a36.nasl - Type : ACT_GATHER_INFO |
| 2017-08-08 | Name : The remote Fedora host is missing a security update. File : fedora_2017-307eab89e1.nasl - Type : ACT_GATHER_INFO |
| 2017-08-01 | Name : The remote Debian host is missing a security update. File : debian_DLA-1047.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2020-05-23 13:17:11 |
|
| 2017-08-31 21:26:26 |
|
| 2017-08-23 21:25:34 |
|
| 2017-08-15 13:24:52 |
|
| 2017-08-14 00:21:35 |
|
