Package: dstat Severity: important Tags: security Hi, the following CVE (Common Vulnerabilities & Exposures) id was published for dstat.
CVE-2009-3894[0]: | dstat is looking for plugins in the current working directory which allows an | attack to place malicious plugin content into a directory the victim calls | dstat from (e.g. /tmp) A CVE description is not yet public, so you might still see RESERVED on the mitre website. This exploit scenario is rather constructed in my opinion though there is the possibility to exploit people with that and it would be nice to get it fixed. Patch by Robert Buchholz attached. If you fix the vulnerability please also make sure to include the CVE id in your changelog entry. For further information see: [0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3894 http://security-tracker.debian.org/tracker/CVE-2009-3894 -- Nico Golde - http://www.ngolde.de - n...@jabber.ccc.de - GPG: 0xA0A0AAAA For security reasons, all text in this mail is double-rot13 encrypted.
Index: dstat-0.6.9/dstat
===================================================================
--- dstat-0.6.9.orig/dstat
+++ dstat-0.6.9/dstat
@@ -28,8 +28,6 @@ try:
inspath('/usr/local/share/dstat/')
inspath('/usr/share/dstat/')
inspath(os.path.abspath(os.path.dirname(sys.argv[0])) + '/plugins/') # binary path + /plugins/
- inspath(os.getcwd() + '/plugins/') # current path + /plugins/
- inspath(os.getcwd()) # current path
inspath(os.path.expanduser('~/.dstat/')) # home + /.dstat/
except KeyboardInterrupt, e:
pass
pgpcwRtzHP8Uz.pgp
Description: PGP signature
