Stay Secure with the Latest Linux Advisories

security advisorydebianfile write

Debian: DSA-3794-1 Urgent: Munin Local File Write Threat

Stevie Trujillo discovered a local file write vulnerability in munin, a network-wide graphing framework, when CGI graphs are enabled. GET parameters are not properly handled, allowing to inject options into munin-cgi-graph and overwriting any file accessible accessible by the . - ------------------------------------------------------------------------- Debian Security Advisory DSA-3794-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/security/ Salvatore Bonaccorso February 25, 2017 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : munin CVE ID : CVE-2017-6188 Debian Bug : 855705 Stevie Trujillo discovered a local file write vulnerability in munin, a network-wide graphing framework, when CGI graphs are enabled. GET parameters are not properly handled, allowing to inject options into munin-cgi-graph and overwriting any file accessible accessible by the user running the cgi-process. For the stable distribution (jessie), this problem has been fixed in version 2.0.25-1+deb8u1. We recommend that you upgrade your munin packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . Debian Security Advisory DSA-3795-1 concerns a directory traversal vulnerability in logwatch. Users are urged to update their systems for enhanced security.. Munin Security, Debian Advisory, CGI Threats, File Write Attack. . Severity: Important. LinuxSecurity.com Team

Feb 25, 2017 •Important Debian