Test Kennung:	1.3.6.1.4.1.25623.1.0.890869
Kategorie:	Debian Local Security Checks
Titel:	Debian LTS: Security Advisory for cgiemail (DLA-869-1)
Zusammenfassung:	The cPanel Security Team discovered several security vulnerabilities in;cgiemail, a CGI program used to create HTML forms for sending mails:;;CVE-2017-5613;;A format string injection vulnerability allowed to supply arbitrary;format strings to cgiemail and cgiecho. A local attacker with;permissions to provide a cgiemail template could use this;vulnerability to execute code as webserver user.;Format strings in cgiemail templates are now restricted to simple;%s, %U and %H sequences.;;CVE-2017-5614;;An open redirect vulnerability in cgiemail and cgiecho binaries;could be exploited by a local attacker to force redirect to an;arbitrary URL. These redirects are now limited to the domain that;handled the request.;;CVE-2017-5615;;A vulnerability in cgiemail and cgiecho binaries allowed injection;of additional HTTP headers. Newline characters are now stripped;from the redirect location to protect against this.;;CVE-2017-5616;;Missing escaping of the addendum parameter lead to a reflected;cross-site (XSS) vulnerability in cgiemail and cgiecho binaries.;The output is now html escaped.
Beschreibung:	Summary: The cPanel Security Team discovered several security vulnerabilities in cgiemail, a CGI program used to create HTML forms for sending mails: CVE-2017-5613 A format string injection vulnerability allowed to supply arbitrary format strings to cgiemail and cgiecho. A local attacker with permissions to provide a cgiemail template could use this vulnerability to execute code as webserver user. Format strings in cgiemail templates are now restricted to simple %s, %U and %H sequences. CVE-2017-5614 An open redirect vulnerability in cgiemail and cgiecho binaries could be exploited by a local attacker to force redirect to an arbitrary URL. These redirects are now limited to the domain that handled the request. CVE-2017-5615 A vulnerability in cgiemail and cgiecho binaries allowed injection of additional HTTP headers. Newline characters are now stripped from the redirect location to protect against this. CVE-2017-5616 Missing escaping of the addendum parameter lead to a reflected cross-site (XSS) vulnerability in cgiemail and cgiecho binaries. The output is now html escaped. Affected Software/OS: cgiemail on Debian Linux Solution: For Debian 7 'Wheezy', these problems have been fixed in version 1.6-37+deb7u1. We recommend that you upgrade your cgiemail packages. CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2017-5613 BugTraq ID: 95870 http://www.securityfocus.com/bid/95870 https://news.cpanel.com/tsr-2017-0001-full-disclosure/ http://www.openwall.com/lists/oss-security/2017/01/28/8 Common Vulnerability Exposure (CVE) ID: CVE-2017-5614 Common Vulnerability Exposure (CVE) ID: CVE-2017-5615 Common Vulnerability Exposure (CVE) ID: CVE-2017-5616
Copyright	Copyright (C) 2018 Greenbone Networks GmbH http://greenbone.net

Dies ist nur einer von 99761 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.