Информационная безопасность
[RU] switch to English


Многочисленные уязвимости безопасности в JHead
Опубликовано:14 января 2009 г.
Источник:
SecurityVulns ID:9584
Тип:локальная
Уровень опасности:
5/10
Описание:Переполнение буфера, проблема символьных линков, проблема шел-символов.
Затронутые продукты:JHEAD : JHead 2.84
CVE:CVE-2008-4641 (The DoCommand function in jhead.c in Matthias Wandel jhead 2.84 and earlier allows attackers to execute arbitrary commands via shell metacharacters in unspecified input.)
 CVE-2008-4640 (The DoCommand function in jhead.c in Matthias Wandel jhead 2.84 and earlier allows local users to delete arbitrary files via vectors involving a modified input filename in which (1) a final "z" character is replaced by a "t" character or (2) a final "t" character is replaced by a "z" character.)
 CVE-2008-4639 (jhead.c in Matthias Wandel jhead 2.84 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file.)
 CVE-2008-4575 (Buffer overflow in the DoCommand function in jhead before 2.84 might allow context-dependent attackers to cause a denial of service (crash) via (1) a long -cmd argument and (2) unspecified vectors related to "a bunch of potential string overflows.")
Оригинальный текстdocumentGENTOO, [ GLSA 200901-02 ] JHead: Multiple vulnerabilities (14.01.2009)

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород