Executive Summary
| Summary | |
|---|---|
| Title | debian-goodies vulnerability |
| Informations | |||
|---|---|---|---|
| Name | USN-526-1 | First vendor Publication | 2007-10-04 |
| Vendor | Ubuntu | Last vendor Modification | 2007-10-04 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:L/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 7.2 | Attack Range | Local |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 3.9 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS Ubuntu 6.10 Ubuntu 7.04 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 6.06 LTS: Ubuntu 6.10: Ubuntu 7.04: In general, a standard system upgrade is sufficient to affect the necessary changes. Details follow: Thomas de Grenier de Latour discovered that the checkrestart program included in debian-goodies did not correctly handle shell meta-characters. A local attacker could exploit this to gain the privileges of the user running checkrestart. |
Original Source
| Url : http://www.ubuntu.com/usn/USN-526-1 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 50 % | CWE-264 | Permissions, Privileges, and Access Controls |
| 50 % | CWE-20 | Improper Input Validation |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:17423 | |||
| Oval ID: | oval:org.mitre.oval:def:17423 | ||
| Title: | USN-526-1 -- debian-goodies vulnerability | ||
| Description: | Thomas de Grenier de Latour discovered that the checkrestart program included in debian-goodies did not correctly handle shell meta-characters. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-526-1 CVE-2007-3912 | Version: | 9 |
| Platform(s): | Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 | Product(s): | debian-goodies |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:18559 | |||
| Oval ID: | oval:org.mitre.oval:def:18559 | ||
| Title: | DSA-1527-1 debian-goodies - privilege escalation | ||
| Description: | Thomas de Grenier de Latour discovered that the checkrestart tool in the debian-goodies suite of utilities, allowed local users to gain privileges via shell metacharacters in the name of the executable file for a running process. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1527-1 CVE-2007-3912 | Version: | 9 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | debian-goodies |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:8247 | |||
| Oval ID: | oval:org.mitre.oval:def:8247 | ||
| Title: | DSA-1527 debian-goodies -- insufficient input sanitising | ||
| Description: | Thomas de Grenier de Latour discovered that the checkrestart tool in the debian-goodies suite of utilities, allowed local users to gain privileges via shell metacharacters in the name of the executable file for a running process. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1527 CVE-2007-3912 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 4.0 Debian GNU/Linux 3.1 | Product(s): | debian-goodies |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 2 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-03-23 | Name : Ubuntu Update for debian-goodies vulnerability USN-526-1 File : nvt/gb_ubuntu_USN_526_1.nasl |
| 2008-03-27 | Name : Debian Security Advisory DSA 1527-1 (debian-goodies) File : nvt/deb_1527_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 40483 | Debian Linux debian-goodies checkrestart Local Arbitrary Command Execution |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2008-03-26 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1527.nasl - Type : ACT_GATHER_INFO |
| 2007-11-10 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-526-1.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 12:04:40 |
|
