Executive Summary
| Summary | |
|---|---|
| Title | New osh packages fix privilege escalation |
| Informations | |||
|---|---|---|---|
| Name | DSA-918 | First vendor Publication | 2005-12-09 |
| Vendor | Debian | Last vendor Modification | 2005-12-09 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:L/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 7.2 | Attack Range | Local |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 3.9 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Several security related problems have been discovered in osh, the operator's shell for executing defined programs in a privileged environment. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities: CVE-2005-3347 Charles Stevenson discovered a bug in the substitution of variables that allows a local attacker to open a root shell. CVE-2005-3533 Solar Eclipse discovered a buffer overflow caused by the current working directory plus a filename that could be used to execute arbitrary code and e.g. open a root shell. For the old stable distribution (woody) these problems have been fixed in version 1.7-11woody2. For the stable distribution (sarge) these problems have been fixed in version 1.7-13sarge1. For the unstable distribution (sid) these problems have been fixed in version 1.7-15, however, the package has been removed entirely. We recommend that you upgrade your osh package. |
Original Source
| Url : http://www.debian.org/security/2005/dsa-918 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE/SANS Top 25) |
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 1 | |
| Application | 1 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200511-18 (phpsysinfo) File : nvt/glsa_200511_18.nasl |
| 2008-09-04 | Name : FreeBSD Ports: phpSysInfo File : nvt/freebsd_phpSysInfo0.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 897-1 (phpsysinfo) File : nvt/deb_897_1.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 898-1 (phpgroupware) File : nvt/deb_898_1.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 899-1 (egroupware) File : nvt/deb_899_1.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 918-1 (osh) File : nvt/deb_918_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 21576 | Operator Shell (osh) CWD Crafted Filename Overflow Operator Shell (osh) contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is triggered by an error in the handling of current working directory and a crafted filename. This flaw may lead to a loss of Integrity. |
| 21159 | phpSysInfo index.php Multiple Parameter Arbitrary File Access |
| 20720 | Operator Shell (osh) main.c Environment Variable Substitution Local Privilege... Operator Shell (osh) contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is triggered by an error in the handling of environment variable substitutions, and exploited by loading arbitrary shared libraries. This flaw may lead to a loss of Integrity. |
| 18939 | Operator Shell (osh) writable() Function Local Overflow |
| 13586 | Operator Shell (osh) iopen() Function Local Overflow |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2006-10-14 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-897.nasl - Type : ACT_GATHER_INFO |
| 2006-10-14 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-898.nasl - Type : ACT_GATHER_INFO |
| 2006-10-14 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-899.nasl - Type : ACT_GATHER_INFO |
| 2006-10-14 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-918.nasl - Type : ACT_GATHER_INFO |
| 2005-12-07 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200511-18.nasl - Type : ACT_GATHER_INFO |
| 2005-11-16 | Name : The remote web server contains a PHP application that is affected by multiple... File : phpsysinfo_241.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:34:43 |
|
| 2013-05-11 12:19:19 |
|
