Test Kennung:	1.3.6.1.4.1.25623.1.0.68931
Kategorie:	Ubuntu Local Security Checks
Titel:	Ubuntu USN-1066-1 (python-django)
Zusammenfassung:	NOSUMMARY
Beschreibung:	Description: The remote host is missing an update to python-django announced via advisory USN-1066-1. Details follow: It was discovered that Django did not properly validate HTTP requests that contain an X-Requested-With header. An attacker could exploit this vulnerability to perform cross-site request forgery (CSRF) attacks. (CVE-2011-0696) It was discovered that Django did not properly sanitize its input when performing file uploads, resulting in cross-site scripting (XSS) vulnerabilities. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. (CVE-2011-0697) Solution: The problem can be corrected by upgrading your system to the following package versions: Ubuntu 9.10: python-django 1.1.1-1ubuntu1.2 Ubuntu 10.04 LTS: python-django 1.1.1-2ubuntu1.3 Ubuntu 10.10: python-django 1.2.3-1ubuntu0.2.10.10.2 ATTENTION: This update introduces a small backwards-imcompatible change to perform full CSRF validation on all requests. Prior to this update, AJAX requests were excepted from CSRF protections. For more details, please see http://docs.djangoproject.com/en/1.2/releases/1.2.5/. In general, a standard system update will make all the necessary changes. http://www.securityspace.com/smysecure/catid.html?in=USN-1066-1 Risk factor : High CVSS Score: 6.8
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2011-0696 BugTraq ID: 46296 http://www.securityfocus.com/bid/46296 Debian Security Information: DSA-2163 (Google Search) http://www.debian.org/security/2011/dsa-2163 http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054208.html http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054207.html http://www.mandriva.com/security/advisories?name=MDVSA-2011:031 http://openwall.com/lists/oss-security/2011/02/09/6 http://secunia.com/advisories/43230 http://secunia.com/advisories/43297 http://secunia.com/advisories/43382 http://secunia.com/advisories/43426 http://www.ubuntu.com/usn/USN-1066-1 http://www.vupen.com/english/advisories/2011/0372 http://www.vupen.com/english/advisories/2011/0388 http://www.vupen.com/english/advisories/2011/0429 http://www.vupen.com/english/advisories/2011/0439 http://www.vupen.com/english/advisories/2011/0441 Common Vulnerability Exposure (CVE) ID: CVE-2011-0697
Copyright	Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com

Dies ist nur einer von 99761 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.