* bsc#1216591 Cross-References: * CVE-2023-46316 . # Security update for traceroute Announcement ID: SUSE-SU-2023:4656-1 Rating: moderate References: * bsc#1216591 Cross-References: * CVE-2023-46316 CVSS scores: * CVE-2023-46316 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2023-46316 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: * SUSE Linux Enterprise High Performance Computing 12 SP5 * SUSE Linux Enterprise Server 12 SP5 * SUSE Linux Enterprise Server for SAP Applications 12 SP5 An update that solves one vulnerability can now be installed. ## Description: This update for traceroute fixes the following issues: * CVE-2023-46316: wrapper scripts do not properly parse command lines (bsc#1216591). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise High Performance Computing 12 SP5 zypper in -t patch SUSE-SLE-SERVER-12-SP5-2023-4656=1 * SUSE Linux Enterprise Server 12 SP5 zypper in -t patch SUSE-SLE-SERVER-12-SP5-2023-4656=1 * SUSE Linux Enterprise Server for SAP Applications 12 SP5 zypper in -t patch SUSE-SLE-SERVER-12-SP5-2023-4656=1 ## Package List: * SUSE Linux Enterprise High Performance Computing 12 SP5 (aarch64 x86_64) * traceroute-debuginfo-2.0.19-3.6.1 * traceroute-2.0.19-3.6.1 * traceroute-debugsource-2.0.19-3.6.1 * SUSE Linux Enterprise Server 12 SP5 (aarch64 ppc64le s390x x86_64) * traceroute-debuginfo-2.0.19-3.6.1 * traceroute-2.0.19-3.6.1 * traceroute-debugsource-2.0.19-3.6.1 * SUSE Linux Enterprise Server for SAP Applications 12 SP5 (ppc64le x86_64) * traceroute-debuginfo-2.0.19-3.6.1 * traceroute-2.0.19-3.6.1 * traceroute-debugsource-2.0.19-3.6.1 ## References: * https://www.suse.com/security/cve/CVE-2023-46316.html *https://bugzilla.suse.com/show_bug.cgi?id=1216591 . SUSE has released a security patch for traceroute, addressing a command execution flaw classified as moderate.. traceroute security fix,SUSE update,command parsing issue. . LinuxSecurity.com Team
It was discovered that Nagios did not properly parse commands submitted using the web interface. An authenticated user could use a custom form or a browser addon to bypass security restrictions and submit unauthorized commands. . ==========================================================Ubuntu Security Notice USN-698-1 December 22, 2008 nagios vulnerability CVE-2008-5027 ========================================================== A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 6.06 LTS: nagios-common 2:1.3-cvs.20050402-8ubuntu8 After a standard system upgrade you need to restart Nagios to effect the necessary changes. Details follow: It was discovered that Nagios did not properly parse commands submitted using the web interface. An authenticated user could use a custom form or a browser addon to bypass security restrictions and submit unauthorized commands. Updated packages for Ubuntu 6.06 LTS: Source archives: Size/MD5: 70914 96d8036bdb33aadd3141715039c91b24 Size/MD5: 959 0393336015bf452f5dfeb74d75245311 Size/MD5: 1621251 0f92b7b8e705411b7881d3650cbb5d56 Architecture independent packages: Size/MD5: 1218132 d18e298ee16f4c6c6b7c5969c46044e6 amd64 architecture (Athlon64, Opteron, EM64T Xeon): Size/MD5: 1030206 085483fdefd0d7bc43e55dbc5be2bcd6 Size/MD5: 1041656 09fc7bb2ff11062603680d09e290909b Size/MD5: 1025618 61619d13effd9a4970486abf5933c756 i386 architecture (x86 compatible Intel/AMD): Size/MD5: 877846 544afaebec24e7e94d2ce1da3a89346c Size/MD5: 886544 411d3ca5a204aa41a4a42ef6e5f56453 Size/MD5: 872936 aa31f6d1fb8a081a206eae3d6bfb3dd6 powerpc architecture (Apple MacintoshG3/G4/G5): Size/MD5: 1015630 540a27062c7f8612b7f460b2bcfd93b9 Size/MD5: 1024374 47e0480006df0b20a83f67b56da7a9f8 Size/MD5: 993324 03a67a7675075050a672a4c515e8e0c3 sparc architecture (Sun SPARC/UltraSPARC): Size/MD5: 918810 7340348f043dd884c88bd016ee30e41d Size/MD5: 926172 e9ccf388b828a17e868807aa39cb5b51 Size/MD5: 917374 c88dec0d93f590f8a93ebbc701696f68 . Ubuntu Nagios flaw permits evading safeguards through web interface. Urgent patch rolled out for vulnerable installations.. Nagios Security Advisory, Command Parsing Issue, Ubuntu Vulnerability. . Severity: Important. LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.