OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Daniel Ahlberg (aliz_at_gentoo.org)
Date: Fri Dec 20 2002 - 11:16:15 CST

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    - - --------------------------------------------------------------------
    GENTOO LINUX SECURITY ANNOUNCEMENT 200212-7
    - - --------------------------------------------------------------------

    PACKAGE : wget
    SUMMARY : directory traversal
    DATE    : 2002-12-20 17:12 UTC
    EXPLOIT : remote

    - - --------------------------------------------------------------------

    Quote from advisory

    "A malicious server could potentially overwrite key files to cause a
    denial of service or, in some cases, gain privileges by modifying
    executable files. The risk is mitigated because non-default
    configurations are primarily affected, and the user must be convinced
    to access the malicious server. However, web-based clients may be
    more easily exploited."

    Read the full advisory at
    http://marc.theaimsgroup.com/?l=bugtraq&m=103962838628940&w=2

    SOLUTION

    It is recommended that all Gentoo Linux users who are running
    net-misc/wget-1.8.2-r1 and earlier update their systems as follows:

    emerge rsync
    emerge wget
    emerge clean

    - - --------------------------------------------------------------------
    alizgentoo.org - GnuPG key is available at www.gentoo.org/~aliz
    - - --------------------------------------------------------------------
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.1 (GNU/Linux)

    iD8DBQE+A1BVfT7nyhUpoZMRAitfAJ0ZuwvlTRZnBP9rzfRPE51L7Qm3MwCfUXLn
    4QPk2v8r54aB+53CPAwIFhk=
    =RLsN
    -----END PGP SIGNATURE-----