Detections
Analytics

RHEL 2.1 / 3 : gnome-vfs (RHSA-2004:373)

high Nessus Plugin ID 14211

Synopsis

The remote Red Hat host is missing one or more security updates.

Description

Updated GNOME VFS packages that remove potential extfs-related vulnerabilities are now available.

GNOME VFS is the GNOME virtual file system. It provides a modular architecture and ships with several modules that implement support for file systems, HTTP, FTP, and others. The extfs backends make it possible to implement file systems for GNOME VFS using scripts.

Flaws have been found in several of the GNOME VFS extfs backend scripts. Red Hat Enterprise Linux ships with vulnerable scripts, but they are not used by default. An attacker who is able to influence a user to open a specially crafted URI using gnome-vfs could perform actions as that user. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0494 to this issue.

Users of Red Hat Enterprise Linux should upgrade to these updated packages, which remove these unused scripts.

Solution

Update the affected packages.

See Also

https://access.redhat.com/security/cve/cve-2004-0494

https://access.redhat.com/errata/RHSA-2004:373

Plugin Details

Severity: High

ID: 14211

File Name: redhat-RHSA-2004-373.nasl

Version: 1.32

Type: local

Agent: unix

Published: 8/5/2004

Updated: 1/14/2021

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.2

CVSS v2

Risk Factor: High

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:gnome-vfs, p-cpe:/a:redhat:enterprise_linux:gnome-vfs-devel, p-cpe:/a:redhat:enterprise_linux:gnome-vfs2, p-cpe:/a:redhat:enterprise_linux:gnome-vfs2-devel, cpe:/o:redhat:enterprise_linux:2.1, cpe:/o:redhat:enterprise_linux:3

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Patch Publication Date: 8/4/2004

Vulnerability Publication Date: 11/23/2004

Reference Information

CVE: CVE-2004-0494

RHSA: 2004:373