Fedora 15 : gitolite-1.5.8-3.fc15 (2011-1616)

high Nessus Plugin ID 52517

Synopsis

The remote Fedora host is missing a security update.

Description

Dylan Alex Simon discovered and reported a directory traversal flaw in the way Gitolite restricted access to admin defined commands ('ADC').
An authenticated attacker could execute arbitrary code with privileges of Gitolite server user using specially crafted command name.

The flaw does not affect default Gitolite installations. Users who have enabled ADC in their configurations are advised to install the updated package which includes a fix to resolve the issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

Update the affected gitolite package.

See Also

http://www.nessus.org/u?d6bfc070

Plugin Details

Severity: High

ID: 52517

File Name: fedora_2011-1616.nasl

Version: 1.9

Type: local

Agent: unix

Published: 3/3/2011

Updated: 1/11/2021

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Vulnerability Information

CPE: p-cpe:/a:fedoraproject:fedora:gitolite, cpe:/o:fedoraproject:fedora:15

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list

Patch Publication Date: 2/16/2011

Reference Information

FEDORA: 2011-1616