Debian DSA-2765-1 : davfs2 - privilege escalation

high Nessus Plugin ID 70148

Language:

Synopsis

The remote Debian host is missing a security-related update.

Description

Davfs2, a filesystem client for WebDAV, calls the function system() insecurely while is setuid root. This might allow a privilege escalation.

Solution

Upgrade the davfs2 packages.

For the oldstable distribution (squeeze), this problem has been fixed in version 1.4.6-1.1+squeeze1.

For the stable distribution (wheezy), this problem has been fixed in version 1.4.6-1.1+deb7u1.

Plugin Details

Severity: High

ID: 70148

File Name: debian_DSA-2765.nasl

Version: 1.10

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 9/27/2013

Updated: 1/11/2021

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:davfs2, cpe:/o:debian:debian_linux:6.0, cpe:/o:debian:debian_linux:7.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/26/2013

Reference Information

CVE: CVE-2013-4362

BID: 62445

DSA: 2765

Detections

Analytics