Executive Summary
| Summary | |
|---|---|
| Title | pcp security update |
| Informations | |||
|---|---|---|---|
| Name | DSA-2533 | First vendor Publication | 2012-08-23 |
| Vendor | Debian | Last vendor Modification | 2012-08-23 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:N/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 5 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| It was discovered that Performance Co-Pilot (pcp), a framework for performance monitoring, contains several vulnerabilites. CVE-2012-3418 Multiple buffer overflows in the PCP protocol decoders can cause PCP clients and servers to crash or, potentially, execute arbitrary code while processing crafted PDUs. CVE-2012-3419 The "linux" PMDA used by the pmcd daemon discloses sensitive information from the /proc file system to unauthenticated clients. CVE-2012-3420 Multiple memory leaks processing crafted requests can cause pmcd to consume large amounts of memory and eventually crash. CVE-2012-3421 Incorrect event-driven programming allows malicious clients to prevent other clients from accessing the pmcd daemon. To address the information disclosure vulnerability, CVE-2012-3419, a new "proc" PMDA was introduced, which is disabled by default. If you need access to this information, you need to enable the "proc" PMDA. For the stable distribution (squeeze), this problem has been fixed in version 3.3.3-squeeze2. For the unstable distribution (sid), this problem has been fixed in version 3.6.5. We recommend that you upgrade your pcp packages. |
Original Source
| Url : http://www.debian.org/security/2012/dsa-2533 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 33 % | CWE-399 | Resource Management Errors |
| 33 % | CWE-200 | Information Exposure |
| 33 % | CWE-189 | Numeric Errors (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:20165 | |||
| Oval ID: | oval:org.mitre.oval:def:20165 | ||
| Title: | DSA-2533-1 pcp - several | ||
| Description: | It was discovered that Performance Co-Pilot (pcp), a framework for performance monitoring, contains several vulnerabilities. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2533-1 CVE-2012-3418 CVE-2012-3419 CVE-2012-3420 CVE-2012-3421 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0 | Product(s): | pcp |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2012-11-23 | Name : Fedora Update for pcp FEDORA-2012-18654 File : nvt/gb_fedora_2012_18654_pcp_fc16.nasl |
| 2012-11-23 | Name : Fedora Update for pcp FEDORA-2012-18686 File : nvt/gb_fedora_2012_18686_pcp_fc17.nasl |
| 2012-11-06 | Name : Fedora Update for pcp FEDORA-2012-17019 File : nvt/gb_fedora_2012_17019_pcp_fc16.nasl |
| 2012-11-06 | Name : Fedora Update for pcp FEDORA-2012-17050 File : nvt/gb_fedora_2012_17050_pcp_fc17.nasl |
| 2012-08-30 | Name : Debian Security Advisory DSA 2533-1 (pcp) File : nvt/deb_2533_1.nasl |
| 2012-08-30 | Name : Fedora Update for pcp FEDORA-2012-12076 File : nvt/gb_fedora_2012_12076_pcp_fc17.nasl |
| 2012-08-21 | Name : Fedora Update for pcp FEDORA-2012-12024 File : nvt/gb_fedora_2012_12024_pcp_fc16.nasl |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2012-525.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2012-542.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2012-544.nasl - Type : ACT_GATHER_INFO |
| 2013-01-25 | Name : The remote SuSE 11 host is missing a security update. File : suse_11_libpcp3-130107.nasl - Type : ACT_GATHER_INFO |
| 2012-09-18 | Name : The remote Fedora host is missing a security update. File : fedora_2012-11988.nasl - Type : ACT_GATHER_INFO |
| 2012-08-24 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2533.nasl - Type : ACT_GATHER_INFO |
| 2012-08-21 | Name : The remote Fedora host is missing a security update. File : fedora_2012-12024.nasl - Type : ACT_GATHER_INFO |
| 2012-08-21 | Name : The remote Fedora host is missing a security update. File : fedora_2012-12076.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:31:18 |
|
| 2013-10-10 13:23:44 |
|
