Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -4 articles for you...
89
security advisorymoderatesecurity issueFedora 12: 2009-12674 Moderate: dstat Security Issue Update
This release fixes above mentioned security issue, adds several enhancements and fixes few other bugs. For complete information, please see changelog.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2009-12674 2009-12-04 22:41:38 -------------------------------------------------------------------------------- Name : dstat Product : Fedora 12 Version : 0.7.0 Release : 1.fc12 URL : Summary : Versatile resource statistics tool Description : Dstat is a versatile replacement for vmstat, iostat, netstat and ifstat. Dstat overcomes some of their limitations and adds some extra features, more counters and flexibility. Dstat is handy for monitoring systems during performance tuning tests, benchmarks or troubleshooting. Dstat allows you to view all of your system resources instantly, you can eg. compare disk usage in combination with interrupts from your IDE controller, or compare the network bandwidth numbers directly with the disk throughput (in the same interval). Dstat gives you detailed selective information in columns and clearly indicates in what magnitude and unit the output is displayed. Less confusion, less mistakes. -------------------------------------------------------------------------------- Update Information: This release fixes above mentioned security issue, adds several enhancements and fixes few other bugs. For complete information, please see changelog. -------------------------------------------------------------------------------- ChangeLog: * Thu Dec 3 2009 Jan Zeleny - 0.7.0-1 - rebased to 0.7.0 -------------------------------------------------------------------------------- References: [ 1 ] Bug #538459 - CVE-2009-3894 dstat insecure module search path https://bugzilla.redhat.com/show_bug.cgi?id=538459 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update dstat' atthe command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ Fedora-package-announce mailing list
Dec 04, 2009
Fedora
89
security advisoryfedoramoderate severityFedora 11 Security Update: dstat Insecure Module Issue (2009-12663)
. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2009-12663 2009-12-04 22:41:27 -------------------------------------------------------------------------------- Name : dstat Product : Fedora 11 Version : 0.6.9 Release : 5.fc11 URL : Summary : Versatile resource statistics tool Description : Dstat is a versatile replacement for vmstat, iostat, netstat and ifstat. Dstat overcomes some of their limitations and adds some extra features, more counters and flexibility. Dstat is handy for monitoring systems during performance tuning tests, benchmarks or troubleshooting. Dstat allows you to view all of your system resources instantly, you can eg. compare disk usage in combination with interrupts from your IDE controller, or compare the network bandwidth numbers directly with the disk throughput (in the same interval). Dstat gives you detailed selective information in columns and clearly indicates in what magnitude and unit the output is displayed. Less confusion, less mistakes. -------------------------------------------------------------------------------- ChangeLog: * Thu Dec 3 2009 Jan Zeleny - 0.6.9-5 - added patch fixing security issue CVE-2009-3894 -------------------------------------------------------------------------------- References: [ 1 ] Bug #538459 - CVE-2009-3894 dstat insecure module search path https://bugzilla.redhat.com/show_bug.cgi?id=538459 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update dstat' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ Fedora-package-announce mailing list
Dec 04, 2009
•Important
Fedora
200
security advisorymoderate severitydstatScientific Linux 5.x: CVE-2009-3894 Moderate Dstat Insecure Path
Moderate: dstat security update. Date: Tue, 1 Dec 2009 11:19:28 -0600 Reply-To: Troy Dawson Sender: Security Errata for Scientific Linux From: Troy Dawson Subject: Security ERRATA Moderate: dstat on SL5.x i386/x86_64 Comments: To: "
Dec 01, 2009
Scientific Linux
98
security advisorymoderatesecurity updateRed Hat Enterprise Linux 5: RHSA-2009:1619-01 Moderate Dstat Local Risk
An updated dstat package that fixes one security issue is now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team.. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: dstat security update Advisory ID: RHSA-2009:1619-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2009:1619.html Issue date: 2009-11-30 CVE Names: CVE-2009-3894 ==================================================================== 1. Summary: An updated dstat package that fixes one security issue is now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux (v. 5 server) - noarch Red Hat Enterprise Linux Desktop (v. 5 client) - noarch 3. Description: Dstat is a versatile replacement for the vmstat, iostat, and netstat tools. Dstat can be used for performance tuning tests, benchmarks, and troubleshooting. Robert Buchholz of the Gentoo Security Team reported a flaw in the Python module search path used in dstat. If a local attacker could trick a local user into running dstat from a directory containing a Python script that is named like an importable module, they could execute arbitrary code with the privileges of the user running dstat. (CVE-2009-3894) All dstat users should upgrade to this updated package, which contains a backported patch to correct this issue. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at 5. Bugs fixed (http://bugzilla.redhat.com/): 538459 - CVE-2009-3894 dstatinsecure module search path 6. Package List: Red Hat Enterprise Linux Desktop (v. 5 client): Source: noarch: dstat-0.6.6-3.el5_4.1.noarch.rpm Red Hat Enterprise Linux (v. 5 server): Source: noarch: dstat-0.6.6-3.el5_4.1.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key#package 7. References: https://www.cve.org/CVERecord?id=CVE-2009-3894 https://access.redhat.com/security/updates/classification#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2009 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFLE+gYXlSAg2UNWIIRAr8iAJ4sJyTH6JKXhhVQ6BmqZQB614VWcgCdEbd0 pdjTrNWrUgFaLQWp0EhGX1U=FRhK -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list
Nov 30, 2009
Red Hat
91
security advisorygentoocode executionGentoo: GLSA-200911-04 Normal: Dstat Untrusted Path Code Execution
An untrusted search path vulnerability in the dstat might result in the execution of arbitrary code.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200911-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: dstat: Untrusted search path Date: November 25, 2009 Bugs: #293497 ID: 200911-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= An untrusted search path vulnerability in the dstat might result in the execution of arbitrary code. Background ========= dstat is a versatile system resource monitor written in Python. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 sys-apps/dstat < 0.6.9-r1 > = 0.6.9-r1 Description ========== Robert Buchholz of the Gentoo Security Team reported that dstat includes the current working directory and subdirectories in the Python module search path (sys.path) before calling "import". Impact ===== A local attacker could entice a user to run "dstat" from a directory containing a specially crafted Python module, resulting in the execution of arbitrary code with the privileges of the user running the application. Workaround ========= Do not run "dstat" from untrusted working directories. Resolution ========= All dstat users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =sys-apps/dstat-0.6.9-r1" References ========= [ 1 ] CVE-2009-3894 https://www.cve.org/CVERecord?id=CVE-2009-3894 Availability =========== This GLSA and any updates to it areavailable for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200911-04 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Nov 25, 2009
Gentoo
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!