Debian DLA-1875-1:fusiondirectory 安全更新

critical Nessus 插件 ID 127484

简介

远程 Debian 主机缺少安全更新。

描述

写入 PHP 的 LDAP web 前端(最初源自 GOsa² 2.6.x) FusionDirectory 中发现漏洞,理论上可能会造成未经授权访问 FusionDirectory 管理的 LDAP 数据库。LDAP 查询的结果状态 ('Success') 检查严格程度不足。在登录连接尝试过程中,返回数据中任何位置包含“Success”一词的结果输出都会向 FusionDirectory 返回“LDAP success”,可能会授予非预期的访问权限。对于 Debian 8“Jessie”,这一问题已在 1.0.8.2-5+deb8u2 版本中修复。建议您升级 fusiondirectory 程序包。注意:Tenable Network Security 已直接从 DLA 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下,尽可能进行自动整理和排版。

解决方案

升级受影响的程序包。

另见

https://lists.debian.org/debian-lts-announce/2019/08/msg00008.html

https://packages.debian.org/source/jessie/fusiondirectory

插件详情

严重性: Critical

ID: 127484

文件名: debian_DLA-1875.nasl

版本: 1.6

类型: local

代理: unix

发布时间: 2019/8/12

最近更新时间: 2024/5/7

支持的传感器: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

风险信息

VPR

风险因素: Medium

分数: 5.9

CVSS v2

风险因素: High

基本分数: 7.5

时间分数: 5.5

矢量: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS 分数来源: CVE-2019-11187

CVSS v3

风险因素: Critical

基本分数: 9.8

时间分数: 8.5

矢量: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

时间矢量: CVSS:3.0/E:U/RL:O/RC:C

漏洞信息

CPE: p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-nagios, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-openstack-compute, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-systems, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-squid-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-freeradius, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-ssh, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-quota, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-addressbook, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-pureftpd-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-cyrus, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-fax-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-samba, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-netgroups-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-theme-oxygen, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-dns, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-fusioninventory-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-sogo, p-cpe:/a:debian:debian_linux:fusiondirectory-schema, cpe:/o:debian:debian_linux:8.0, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-fax, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-sympa-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-sudo-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-kolab, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-alias-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-samba-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-alias, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-ipmi, p-cpe:/a:debian:debian_linux:fusiondirectory, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-fai-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-freeradius-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-uw-imap, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-pureftpd, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-dovecot, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-ipmi-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-weblink, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-mail, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-dashboard-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-sudo, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-dsa-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-dhcp, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-database-connector, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-gpg-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-dovecot-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-repository, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-dhcp-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-openstack-compute-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-cyrus-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-webservice-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-opsi, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-netgroups, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-webservice, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-puppet, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-debconf-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-opsi-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-dns-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-kolab-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-desktop-management-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-argonaut, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-squid, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-repository-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-nagios-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-rsyslog, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-quota-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-sympa, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-gpg, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-dsa, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-ldapmanager, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-sogo-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-asterisk-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-dashboard, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-supann-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-supann, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-game, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-ldapdump, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-fusioninventory, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-apache2, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-desktop-management, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-apache2-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-autofs, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-puppet-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-debconf, p-cpe:/a:debian:debian_linux:fusiondirectory-smarty3-acl-render, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-asterisk, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-autofs-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-systems-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-fai, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-mail-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-ssh-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-webservice-shell, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-argonaut-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-weblink-schema, p-cpe:/a:debian:debian_linux:fusiondirectory-plugin-developers

必需的 KB 项: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

易利用性: No known exploits are available

补丁发布日期: 2019/8/10

漏洞发布日期: 2019/8/15

参考资料信息

CVE: CVE-2019-11187