Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title Django vulnerabilities
Informations
Name USN-1967-1 First vendor Publication 2013-09-24
Vendor Ubuntu Last vendor Modification 2013-09-24
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Cvss Base Score 5 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 13.04 - Ubuntu 12.10 - Ubuntu 12.04 LTS - Ubuntu 10.04 LTS

Summary:

Several security issues were fixed in Django.

Software Description: - python-django: High-level Python web development framework

Details:

It was discovered that Django incorrectly handled large passwords. A remote attacker could use this issue to consume resources, resulting in a denial of service. (CVE-2013-1443)

It was discovered that Django incorrectly handled ssi templates. An attacker could use this issue to read arbitrary files. (CVE-2013-4315)

It was discovered that the Django is_safe_url utility function did not restrict redirects to certain schemes. An attacker could possibly use this issue to perform a cross-site scripting attack.

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 13.04:
python-django 1.4.5-1ubuntu0.1

Ubuntu 12.10:
python-django 1.4.1-2ubuntu0.4

Ubuntu 12.04 LTS:
python-django 1.3.1-4ubuntu1.8

Ubuntu 10.04 LTS:
python-django 1.1.1-2ubuntu1.9

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1967-1
CVE-2013-1443, CVE-2013-4315

Package Information:
https://launchpad.net/ubuntu/+source/python-django/1.4.5-1ubuntu0.1
https://launchpad.net/ubuntu/+source/python-django/1.4.1-2ubuntu0.4
https://launchpad.net/ubuntu/+source/python-django/1.3.1-4ubuntu1.8
https://launchpad.net/ubuntu/+source/python-django/1.1.1-2ubuntu1.9

Original Source

Url : http://www.ubuntu.com/usn/USN-1967-1

CWE : Common Weakness Enumeration

% Id Name
50 % CWE-287 Improper Authentication
50 % CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:18877
 
Oval ID: oval:org.mitre.oval:def:18877
Title: DSA-2755-1 python-django - directory traversal
Description: Rainer Koirikivi discovered a directory traversal vulnerability with <q>ssi</q> template tags in python-django, a high-level Python web development framework.
Family: unix Class: patch
Reference(s): DSA-2755-1
CVE-2013-4315
 Version: 8
Platform(s): Debian GNU/Linux 6.0
Debian GNU/Linux 7
Debian GNU/kFreeBSD 6.0
Debian GNU/kFreeBSD 7
 Product(s): python-django
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:19381
 
Oval ID: oval:org.mitre.oval:def:19381
Title: USN-1967-1 -- python-django vulnerabilities
Description: Several security issues were fixed in Django.
Family: unix Class: patch
Reference(s): USN-1967-1
CVE-2013-1443
CVE-2013-4315
 Version: 5
Platform(s): Ubuntu 13.04
Ubuntu 12.10
Ubuntu 12.04
Ubuntu 10.04
 Product(s): python-django
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20064
 
Oval ID: oval:org.mitre.oval:def:20064
Title: DSA-2758-1 python-django - denial of service
Description: It was discovered that python-django, a high-level Python web develompent framework, is prone to a denial of service vulnerability via large passwords.
Family: unix Class: patch
Reference(s): DSA-2758-1
CVE-2013-1443
 Version: 5
Platform(s): Debian GNU/Linux 6.0
Debian GNU/Linux 7
Debian GNU/kFreeBSD 6.0
Debian GNU/kFreeBSD 7
 Product(s): python-django
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 16

Snort® IPS/IDS

Date Description
2014-01-10 Django web framework oversized password denial of service attempt
RuleID : 27940 - Revision : 3 - Type : SERVER-WEBAPP

Nessus® Vulnerability Scanner

Date Description
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2013-721.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2013-852.nasl - Type : ACT_GATHER_INFO
2013-09-27 Name : The remote Fedora host is missing a security update.
File : fedora_2013-16938.nasl - Type : ACT_GATHER_INFO
2013-09-25 Name : The remote Fedora host is missing a security update.
File : fedora_2013-16840.nasl - Type : ACT_GATHER_INFO
2013-09-25 Name : The remote Fedora host is missing a security update.
File : fedora_2013-16899.nasl - Type : ACT_GATHER_INFO
2013-09-25 Name : The remote Fedora host is missing a security update.
File : fedora_2013-16901.nasl - Type : ACT_GATHER_INFO
2013-09-25 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1967-1.nasl - Type : ACT_GATHER_INFO
2013-09-23 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_05dc6efa237011e395b700e0814cab4e.nasl - Type : ACT_GATHER_INFO
2013-09-18 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2758.nasl - Type : ACT_GATHER_INFO
2013-09-14 Name : The remote Mandriva Linux host is missing a security update.
File : mandriva_MDVSA-2013-234.nasl - Type : ACT_GATHER_INFO
2013-09-13 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_a851b3051bc311e395b700e0814cab4e.nasl - Type : ACT_GATHER_INFO
2013-09-12 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2755.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
Date Informations
2016-07-21 12:09:55
  • Multiple Updates
2014-02-17 12:02:31
  • Multiple Updates
2014-01-30 13:25:56
  • Multiple Updates
2013-12-11 17:25:56
  • Multiple Updates
2013-12-08 13:23:10
  • Multiple Updates
2013-10-24 13:26:48
  • Multiple Updates
2013-10-01 17:23:15
  • Multiple Updates
2013-09-24 21:23:26
  • Multiple Updates
2013-09-24 21:19:08
  • First insertion