RHEL 3 : less (RHSA-2005:068)

This script is Copyright (C) 2005-2014 Tenable Network Security, Inc.


Synopsis :

The remote Red Hat host is missing a security update.

Description :

An updated less package that fixes segmentation fault when viewing
binary files is now available.

The less utility is a text file browser that resembles more, but has
extended capabilities.

Victor Ashik discovered a heap based buffer overflow in less, caused
by a patch added to the less package in Red Hat Enterprise Linux 3. An
attacker could construct a carefully crafted file that could cause
less to crash or possibly execute arbitrary code when opened. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CVE-2005-0086 to this issue. Note that this issue
only affects the version of less distributed with Red Hat Enterprise
Linux 3.

Red Hat believes that the Exec-Shield technology (enabled by default
since Update 3) will block attempts to remotely exploit this
vulnerability on x86 architectures.

All users of the less package should upgrade to this updated package,
which resolves this issue.

See also :

https://www.redhat.com/security/data/cve/CVE-2005-0086.html
http://rhn.redhat.com/errata/RHSA-2005-068.html

Solution :

Update the affected less package.

Risk factor :

High / CVSS Base Score : 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)

Family: Red Hat Local Security Checks

Nessus Plugin ID: 16264 ()

Bugtraq ID:

CVE ID: CVE-2005-0086