Detections
Analytics
Debian DSA-1979-1 : lintian - multiple vulnerabilities
high Nessus Plugin ID 44843
Language:
Synopsis
The remote Debian host is missing a security-related update.Description
Multiple vulnerabilities have been discovered in lintian, a Debian package checker. The following Common Vulnerabilities and Exposures project ids have been assigned to identify them :- CVE-2009-4013: missing control files sanitation Control field names and values were not sanitised before using them in certain operations that could lead to directory traversals.
Patch systems' control files were not sanitised before using them in certain operations that could lead to directory traversals.
An attacker could exploit these vulnerabilities to overwrite arbitrary files or disclose system information.
- CVE-2009-4014: format string vulnerabilities Multiple check scripts and the Lintian::Schedule module were using user-provided input as part of the sprintf/printf format string.
- CVE-2009-4015: arbitrary command execution File names were not properly escaped when passing them as arguments to certain commands, allowing the execution of other commands as pipes or as a set of shell commands.
Solution
Upgrade the lintian packages.For the oldstable distribution (etch), these problems have been fixed in version 1.23.28+etch1.
For the stable distribution (lenny), these problems have been fixed in version 1.24.2.1+lenny1.
See Also
https://security-tracker.debian.org/tracker/CVE-2009-4013
https://security-tracker.debian.org/tracker/CVE-2009-4014
Plugin Details
Severity: High
ID: 44843
File Name: debian_DSA-1979.nasl
Version: 1.12
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 2/24/2010
Updated: 1/4/2021
Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: High
Base Score: 7.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: p-cpe:/a:debian:debian_linux:lintian, cpe:/o:debian:debian_linux:4.0, cpe:/o:debian:debian_linux:5.0
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Patch Publication Date: 1/27/2010