Multiple vulnerabilities have been found in the version of yajl bundled with burp, a simple cross-platform network BackUp and Restore Program. yajl is a JSON parser and small validating JSON generator. . ------------------------------------------------------------------------- Debian LTS Advisory DLA-3516-1
A vulnerability was discovered in Gentoo's ebuild for BURP which could lead to root privilege escalation.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201904-05 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: BURP: Root privilege escalation Date: April 02, 2019 Bugs: #641842 ID: 201904-05 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= A vulnerability was discovered in Gentoo's ebuild for BURP which could lead to root privilege escalation. Background ========= A network backup and restore program. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-backup/burp < 2.1.32-r1 > = 2.1.32-r1 Description ========== It was discovered that Gentoo’s BURP ebuild does not properly set permissions or place the pid file in a safe directory. Additionally, the first set of patches did not completely address this. As such, a revision has been made available that addresses all concerns of the initial report. Impact ===== A local attacker could escalate privileges. Workaround ========= Users should ensure the proper permissions are set as discussed in the referenced bugs. Resolution ========= All BURP users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =app-backup/burp-2.1.32-r1" References ========= [ 1 ] CVE-2017-18285 https://nvd.nist.gov/vuln/detail/CVE-2017-18285 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201904-05 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Get the latest Linux and open source security news straight to your inbox.