Fedora 17 : gallery3-3.0.9-1.fc17 (2013-12441)

This script is Copyright (C) 2013-2016 Tenable Network Security, Inc.


Synopsis :

The remote Fedora host is missing a security update.

Description :

Fixes for CVE-2013-2240, CVE-2013-2241.

A security flaw was found in the way flowplayer SWF file handling
functionality of Gallery version 3, an open source project with the
goal to develop and support leading photo sharing web application
solutions, processed certain URL fragments passed to this file
(certain URL fragments were not stripped properly when these files
were called via direct URL request(s)). A remote attacker could use
this flaw to conduct replay attacks.

Multiple information exposure flaws were found in the way data rest
core module of Gallery version 3, an open source project with the goal
to develop and support leading photo sharing web application
solutions, used to previously restrict access to certain items of the
photo album. A remote attacker, valid Gallery 3 user, could use this
flaw to possibly obtain sensitive information (file, resize or thumb
path of the item in question).

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

See also :

https://bugzilla.redhat.com/show_bug.cgi?id=981218
https://bugzilla.redhat.com/show_bug.cgi?id=981219
http://www.nessus.org/u?d0462831

Solution :

Update the affected gallery3 package.

Risk factor :

High / CVSS Base Score : 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS Temporal Score : 6.5
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : true

Family: Fedora Local Security Checks

Nessus Plugin ID: 68892 ()

Bugtraq ID: 60313

CVE ID: CVE-2013-2138

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now