|
Family: Mandrake Local Security Checks --> Category: infos
MDKSA-2001:094: libgtop Vulnerability Scan
Vulnerability Scan Summary Check for the version of the libgtop package
Detailed Explanation for this Vulnerability Test
The remote host is missing the patch for the advisory MDKSA-2001:094 (libgtop).
A remote format string vulnerability was found in the libgtop daemon by
Laboratory intexxia. By sending a specially crafted format string to the server,
a remote attacker could potentially execute arbitrary code on the remote system
with the daemon's permissions. By default libgtop runs as the user nobody, but
the flaw could be used to compromise local system security by allowing the
attacker to exploit other local vulnerabilities. A buffer overflow was also
found by Flavio Veloso which could allow the client to execute code on the
server. Both vulnerabilities are patched in this update and will be fixed
upstream in version 1.0.14. libgtop_daemon is not invoked by default anywhere in
Mandrake Linux.
Solution : http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2001:094
Threat Level: High
Click HERE for more information and discussions on this network vulnerability scan.
|