[ MDVSA-2013:297 ] munin

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Mandriva Linux Security Advisory MDVSA-2013:297
http://www.mandriva.com/en/support/security/

Package : munin
Date : December 20, 2013
Affected: Business Server 1.0

Problem Description:

Updated munin packages fix security vulnerabilities:

The Munin::Master::Node module of munin does not properly validate
certain data a node sends. A malicious node might exploit this to drive
the munin-html process into an infinite loop with memory exhaustion
on the munin master (CVE-2013-6048).

A malicious node, with a plugin enabled using multigraph as a
multigraph service name, can abort data collection for the entire
node the plugin runs on (CVE-2013-6359).

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6048
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6359
http://advisories.mageia.org/MGASA-2013-0378.html

Updated Packages:

Mandriva Business Server 1/X86_64:
b20e89d5a943f0d3deadb324091ab6ef mbs1/x86_64/munin-2.0-0.rc5.3.2.mbs1.noarch.rpm
4ae6191940301c45b1ce7b32fa625122 mbs1/x86_64/munin-master-2.0-0.rc5.3.2.mbs1.noarch.rpm
3a02701b006afcd70430c4de7e96c7e8 mbs1/x86_64/munin-node-2.0-0.rc5.3.2.mbs1.noarch.rpm
d07ea1401e5ab3415c2576281ec60aee mbs1/SRPMS/munin-2.0-0.rc5.3.2.mbs1.src.rpm

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFStB67mqjQ0CJFipgRAqvjAJ9ufBj1kR8aWaw3XlBYKR6RaBCDuwCgtKPu
eGZL88vNG4OY02tCGXazt58=
=7+/H
-----END PGP SIGNATURE-----