Debian DSA-3131-1 : xdg-utils - security update

medium Nessus Plugin ID 80833

Language:

Synopsis

The remote Debian host is missing a security-related update.

Description

John Houwer discovered a way to cause xdg-open, a tool that automatically opens URLs in a user's preferred application, to execute arbitrary commands remotely.

Solution

Upgrade the xdg-utils packages.

For the stable distribution (wheezy), this problem has been fixed in version 1.1.0~rc1+git20111210-6+deb7u2.

For the upcoming stable (jessie) and unstable (sid) distributions, this problem has been fixed in version 1.1.0~rc1+git20111210-7.3.

Plugin Details

Severity: Medium

ID: 80833

File Name: debian_DSA-3131.nasl

Version: 1.6

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 1/20/2015

Updated: 1/11/2021

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.6

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:xdg-utils, cpe:/o:debian:debian_linux:7.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Patch Publication Date: 1/18/2015

Reference Information

CVE: CVE-2014-9622

DSA: 3131

Detections

Analytics