Gentoo Archives: gentoo-announce

From: Sean Amoss <ackle@g.o>
To: gentoo-announce@g.o
Subject: [gentoo-announce] [ GLSA 201405-17 ] Munin: Multiple vulnerabilities
Date: Sun, 18 May 2014 11:56:31
Message-Id: 53789F8D.7080604@gentoo.org
1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2 Gentoo Linux Security Advisory GLSA 201405-17
3 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4 http://security.gentoo.org/
5 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7 Severity: Normal
8 Title: Munin: Multiple vulnerabilities
9 Date: May 18, 2014
10 Bugs: #412881, #445250
11 ID: 201405-17
12
13 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15 Synopsis
16 ========
17
18 Multiple vulnerabilities have been discovered in Munin which may lead
19 to symlink attacks, file creation, or bypass of security restrictions.
20
21 Background
22 ==========
23
24 Munin is an open source server monitoring tool.
25
26 Affected packages
27 =================
28
29 -------------------------------------------------------------------
30 Package / Vulnerable / Unaffected
31 -------------------------------------------------------------------
32 1 net-analyzer/munin < 2.0.8-r2 >= 2.0.8-r2
33
34 Description
35 ===========
36
37 Multiple vulnerabilities have been discovered in Munin. Please review
38 the CVE identifiers referenced below for details.
39
40 Impact
41 ======
42
43 A local attacker could perform symlink attacks to overwrite arbitrary
44 files with the privileges of the user running the application.
45
46 A remote attacker could create files or load new Munin configuration
47 files.
48
49 Workaround
50 ==========
51
52 There is no known workaround at this time.
53
54 Resolution
55 ==========
56
57 All Munin users should upgrade to the latest version:
58
59 # emerge --sync
60 # emerge --ask --oneshot --verbose ">=net-analyzer/munin-2.0.8-r2"
61
62 References
63 ==========
64
65 [ 1 ] CVE-2012-2103
66 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2103
67 [ 2 ] CVE-2012-3512
68 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3512
69 [ 3 ] CVE-2012-3513
70 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3513
71
72 Availability
73 ============
74
75 This GLSA and any updates to it are available for viewing at
76 the Gentoo Security Website:
77
78 http://security.gentoo.org/glsa/glsa-201405-17.xml
79
80 Concerns?
81 =========
82
83 Security is a primary focus of Gentoo Linux and ensuring the
84 confidentiality and security of our users' machines is of utmost
85 importance to us. Any security concerns should be addressed to
86 security@g.o or alternatively, you may file a bug at
87 https://bugs.gentoo.org.
88
89 License
90 =======
91
92 Copyright 2014 Gentoo Foundation, Inc; referenced text
93 belongs to its owner(s).
94
95 The contents of this document are licensed under the
96 Creative Commons - Attribution / Share Alike license.
97
98 http://creativecommons.org/licenses/by-sa/2.5

Attachments

File name MIME type
signature.asc application/pgp-signature