| ||||||||||||||||
Fedora alert FEDORA-2008-3220 (fedora-ds-admin)
-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2008-3220 2008-04-21 23:23:25 -------------------------------------------------------------------------------- Name : fedora-ds-admin Product : Fedora 8 Version : 1.1.4 Release : 1.fc8 URL : http://directory.fedoraproject.org/ Summary : Fedora Administration Server (admin) Description : Fedora Administration Server is an HTTP agent that provides management features for Fedora Directory Server. It provides some management web apps that can be used through a web browser. It provides the authentication, access control, and CGI utilities used by the console. -------------------------------------------------------------------------------- Update Information: This release addresses two security vulerabilities in the package: - shell command injection in CGI replication monitor (CVE-2008-0892) - unrestricted access to CGI scripts (CVE-2008-0893) Fix Description: Remove ScriptAlias for bin/admin/admin/bin - do not use that directory for CGI URIs - use only protected URIs for CGIs requiring authentication Remove most CGI parameters from repl-monitor-cgi.pl - user must supply replmon.conf in the admin server config directory instead of passing in this pathname - repl-monitor-cgi.pl does not use system to call repl-monitor.pl, it "includes" that script (using perl import). -------------------------------------------------------------------------------- ChangeLog: -------------------------------------------------------------------------------- References: [ 1 ] Bug #437301 - CVE-2008-0892 Director Server: shell command injection in CGI replication monitor https://bugzilla.redhat.com/show_bug.cgi?id=437301 [ 2 ] Bug #437320 - CVE-2008-0893 Directory Server: unrestricted access to CGI scripts https://bugzilla.redhat.com/show_bug.cgi?id=437320 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update fedora-ds-admin' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/. All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at http://fedoraproject.org/keys -------------------------------------------------------------------------------- _______________________________________________ Fedora-package-announce mailing list Fedora-package-announce@redhat.com http://www.redhat.com/mailman/listinfo/fedora-package-ann... (Log in to post comments)
|
||||||||||||||||