ID de Prueba:	1.3.6.1.4.1.25623.1.0.72157
Categoría:	Red Hat Local Security Checks
Título:	RedHat Security Advisory RHSA-2012:1256
Resumen:	NOSUMMARY
Descripción:	Description: The remote host is missing updates announced in advisory RHSA-2012:1256. D-Bus is a system for sending messages between applications. It is used for the system-wide message bus service and as a per-user-login-session messaging facility. It was discovered that the D-Bus library honored environment settings even when running with elevated privileges. A local attacker could possibly use this flaw to escalate their privileges, by setting specific environment variables before running a setuid or setgid application linked against the D-Bus library (libdbus). (CVE-2012-3524) Note: With this update, libdbus ignores environment variables when used by setuid or setgid applications. The environment is not ignored when an application gains privileges via file system capabilities however, no application shipped in Red Hat Enterprise Linux 6 gains privileges via file system capabilities. Red Hat would like to thank Sebastian Krahmer of the SUSE Security Team for reporting this issue. All users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. For the update to take effect, all running instances of dbus-daemon and all running applications using the libdbus library must be restarted, or the system rebooted. Solution: Please note that this update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date http://rhn.redhat.com/errata/RHSA-2012-1256.html Risk factor : Medium
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2012-3524 BugTraq ID: 55517 http://www.securityfocus.com/bid/55517 http://www.exploit-db.com/exploits/21323 http://www.mandriva.com/security/advisories?name=MDVSA-2013:070 http://www.mandriva.com/security/advisories?name=MDVSA-2013:083 http://stealth.openwall.net/null/dzug.c https://bugzilla.novell.com/show_bug.cgi?id=697105 https://bugzilla.redhat.com/show_bug.cgi?id=847402 http://www.openwall.com/lists/oss-security/2012/07/10/4 http://www.openwall.com/lists/oss-security/2012/07/26/1 http://www.openwall.com/lists/oss-security/2012/09/12/6 http://www.openwall.com/lists/oss-security/2012/09/14/2 http://www.openwall.com/lists/oss-security/2012/09/17/2 RedHat Security Advisories: RHSA-2012:1261 http://rhn.redhat.com/errata/RHSA-2012-1261.html http://secunia.com/advisories/50537 http://secunia.com/advisories/50544 http://secunia.com/advisories/50710 SuSE Security Announcement: SUSE-SU-2012:1155 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00009.html SuSE Security Announcement: SUSE-SU-2012:1155-2 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00015.html SuSE Security Announcement: openSUSE-SU-2012:1287 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00000.html SuSE Security Announcement: openSUSE-SU-2012:1418 (Google Search) http://lists.opensuse.org/opensuse-updates/2012-10/msg00094.html http://www.ubuntu.com/usn/USN-1576-1 http://www.ubuntu.com/usn/USN-1576-2
Copyright	Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com

Esta es sólo una de 99761 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.