security advisorydebiancommand execution
Ulf Härnhammar discovered that due to missing input sanitising in diatheke, a CGI script for making and browsing a bible website, it is possible to execute arbitrary commands via a specially crafted URL.. - --------------------------------------------------------------------------Debian Security Advisory DSA 650-1 This email address is being protected from spambots. You need JavaScript enabled to view it. http://www.debian.org/security/ Martin Schulze January 20th, 2005 http://www.debian.org/security/faq - --------------------------------------------------------------------------Package : sword Vulnerability : missing input sanitising Problem-Type : remote Debian-specific: no CVE ID : CAN-2005-0015 Ulf Härnhammar discovered that due to missing input sanitising in diatheke, a CGI script for making and browsing a bible website, it is possible to execute arbitrary commands via a specially crafted URL. For the stable distribution (woody) this problem has been fixed in version 1.5.3-3woody2. For the unstable distribution (sid) this problem will be fixed soon. We recommend that you upgrade your diatheke package. Upgrade Instructions - --------------------wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.0 alias woody - -------------------------------- Source archives: Size/MD5 checksum: 612 9204579e3a264d7d43297c1b7bf98438 Size/MD5 checksum: 21169 c355f97deb2ef2c39b82aec857b15a21 Size/MD5 checksum: 2389613 055f9c1e7c081a667674d9f4112abf11 Alpha architecture: Size/MD5 checksum: 821542c73838e4e5d1112ded21365df2578a3 Size/MD5 checksum: 1712920 e3914e31b0b0217ac8f227f8730c0ace Size/MD5 checksum: 13312 29c89888a4b51b5aa555ff55b0a410ad Size/MD5 checksum: 601828 dfcf6f97b2b3eead528e92b5dc387fe6 ARM architecture: Size/MD5 checksum: 56756 0a83537894f73c59aac38b8698d68dc8 Size/MD5 checksum: 989694 18f31fc2d82aec5b342a62822f6421d8 Size/MD5 checksum: 13326 f8a405bc39b9e73d84cb42448144b4ec Size/MD5 checksum: 298826 53df2455c33de26ddc7f661f1ff74a43 Intel IA-32 architecture: Size/MD5 checksum: 54788 7329737ccfe2988b667bf1cf4d0b684d Size/MD5 checksum: 923510 87cbc45e59453e36004331d8a1ba4950 Size/MD5 checksum: 13320 190147bb90a295003c9bf6ad0e0a48d4 Size/MD5 checksum: 281460 c0c5beeb00046e67a6fa9089e9d43d14 Intel IA-64 architecture: Size/MD5 checksum: 62174 fbf8fac6dfc7d61a739b3bdb3f499566 Size/MD5 checksum: 1291474 d38e91788454487c3fc8b40e017fc682 Size/MD5 checksum: 13308 b24742b3c41724e34669d0b921cb3d27 Size/MD5 checksum: 333424 7aaaaf076026a95ac0d0bdbe488777fb HP Precision architecture: Size/MD5 checksum: 62118 2504df74d92b6adb4910a6a4f3452183 Size/MD5 checksum: 1104178 07328cd8ee7dde27dfed04296e3ae908 Size/MD5 checksum: 13320 d62ee10092df4e13ad703662fd5ffdda Size/MD5 checksum: 321394 ab1a13bf24f55ca743a8c760adebc8e9 Motorola 680x0 architecture: Size/MD5 checksum: 53082 39829e678361864e1da30406d34b63eb Size/MD5 checksum: 932564 a1189885065e93581e8467cc85b270cd Size/MD5 checksum: 13340 2b3407e4e1f8e272f86d297d6ff73738 Size/MD5 checksum: 298670 47ec4a13a6a9492deaa50d841366458d Big endian MIPS architecture: Size/MD5 checksum: 52350 e4c719c9a0dda7691232f30eef22dbde Size/MD5 checksum: 1109974 878366a171bca33b56ee9710119412c9 Size/MD5 checksum: 13332 91fe931443f5ae22621628db2deef543 Size/MD5 checksum: 256508 82fb17f0ff951a96d406d1f65eac8a26 Little endian MIPS architecture: Size/MD5 checksum: 52126 5e61bca3b51666582fbb182398f0f9bd Size/MD5 checksum: 1099316 5de4d4a7a89bc24bb3e50f4bf6edf740 Size/MD5 checksum: 13346 f0fcbee29448cd9c32d906ecdee962f3 Size/MD5 checksum: 240420 b71294049ac28ea1fafe85968b6499de PowerPC architecture: Size/MD5 checksum: 53026 4063714e63bb48f93c16c70be949d2c1 Size/MD5 checksum: 1000066 7eda6d983cd89dee3543b6db26a3bdfe Size/MD5 checksum: 13318 3687a1d751652c987d9e658463e71e9a Size/MD5 checksum: 306722 8d01c00d9235925512c46b5e4efe5bfe IBM S/390 architecture: Size/MD5 checksum: 50260 6dafccc1e39907a9852bb8f73be90c30 Size/MD5 checksum: 889972 dc0a114eb6df20568623173363c34fab Size/MD5 checksum: 13322 520de046e8134166d87d0ea4eb699d1f Size/MD5 checksum: 278278 9fcd920f31203c18884a74d3e2b208ad Sun Sparc architecture: Size/MD5 checksum: 53248 ed0cafc23539322dd589c13d74fef525 Size/MD5 checksum: 953876 862ce2d7c89eeb445a1348158439838f Size/MD5 checksum: 13322 d7db9daeb609981e322caa1549b84015 Size/MD5 checksum: 281526 2d918e10ef4eba590d5185410e11340d These files will probably be moved into the stable distribution on its next update. - ---------------------------------------------------------------------------------For apt-get: deb https://www.debian.org/security/ stable/updates main For dpkg-ftp: dists/stable/updates/main Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . Critical command injection issue identified in diatheke CGI script on Debian due to lack of input filtering. Immediate upgrade required.. Diatheke Security Issue, Debian Command Execution, Missing Input Sanitizing. . Severity: Important. LinuxSecurity.com Team
Jan 20, 2005
•Important
Debian
Refine advisories
