Debian DLA-408-1：gosa 安全更新
critical Nessus 插件 ID 88494
语言：
简介
远程 Debian 主机缺少安全更新。描述
GOsa 结合了系统管理员和最终用户 Web 接口，用于处理基于 LDAP 的设置。GOsa 上游报告 GOsa 的 Samba 插件代码中有一个代码注入漏洞。在 Samba 密码更改期间，可能会注入恶意 Perl 代码。
此 Debian Squeeze LTS 上传修复了此问题。但是，如果您要升级到这个经过修复的程序包修订版本，请注意，Samba 密码变更功能将停止工作，直到 gosa.conf 中的 sambaHashHook 参数进行了更新，接受来自 GOsa 的 PHP 代码的 base64 编码密码字符串为止。
升级到此程序包修订版本后，请参阅 /usr/share/doc/gosa/NEWS.gz 和 gosa.conf (5) 手册页，并应用其中所述的 gosa.conf。
注意：Tenable Network Security 已直接从 DLA 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。
解决方案
升级受影响的程序包。另见
https://lists.debian.org/debian-lts-announce/2016/01/msg00033.html
插件详情
严重性: Critical
ID: 88494
文件名: debian_DLA-408.nasl
版本: 2.8
类型: local
代理: unix
发布时间: 2016/2/1
最近更新时间: 2021/1/11
支持的传感器: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus
风险信息
VPR
风险因素: Medium
分数: 5.9
CVSS v2
风险因素: High
基本分数: 7.5
时间分数: 5.5
矢量: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS v3
风险因素: Critical
基本分数: 9.8
时间分数: 8.5
矢量: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
时间矢量: CVSS:3.0/E:U/RL:O/RC:C
漏洞信息
CPE: p-cpe:/a:debian:debian_linux:gosa-plugin-webdav, p-cpe:/a:debian:debian_linux:gosa-schema, p-cpe:/a:debian:debian_linux:smarty-acl-render, cpe:/o:debian:debian_linux:6.0, p-cpe:/a:debian:debian_linux:gosa, p-cpe:/a:debian:debian_linux:gosa-desktop, p-cpe:/a:debian:debian_linux:gosa-dev, p-cpe:/a:debian:debian_linux:gosa-help-de, p-cpe:/a:debian:debian_linux:gosa-help-en, p-cpe:/a:debian:debian_linux:gosa-help-fr, p-cpe:/a:debian:debian_linux:gosa-help-nl, p-cpe:/a:debian:debian_linux:gosa-plugin-addressbook, p-cpe:/a:debian:debian_linux:gosa-plugin-connectivity, p-cpe:/a:debian:debian_linux:gosa-plugin-dhcp, p-cpe:/a:debian:debian_linux:gosa-plugin-dhcp-schema, p-cpe:/a:debian:debian_linux:gosa-plugin-dns, p-cpe:/a:debian:debian_linux:gosa-plugin-dns-schema, p-cpe:/a:debian:debian_linux:gosa-plugin-fai, p-cpe:/a:debian:debian_linux:gosa-plugin-fai-schema, p-cpe:/a:debian:debian_linux:gosa-plugin-gofax, p-cpe:/a:debian:debian_linux:gosa-plugin-gofon, p-cpe:/a:debian:debian_linux:gosa-plugin-goto, p-cpe:/a:debian:debian_linux:gosa-plugin-kolab, p-cpe:/a:debian:debian_linux:gosa-plugin-kolab-schema, p-cpe:/a:debian:debian_linux:gosa-plugin-ldapmanager, p-cpe:/a:debian:debian_linux:gosa-plugin-log, p-cpe:/a:debian:debian_linux:gosa-plugin-log-schema, p-cpe:/a:debian:debian_linux:gosa-plugin-mail, p-cpe:/a:debian:debian_linux:gosa-plugin-mit-krb5, p-cpe:/a:debian:debian_linux:gosa-plugin-mit-krb5-schema, p-cpe:/a:debian:debian_linux:gosa-plugin-nagios, p-cpe:/a:debian:debian_linux:gosa-plugin-nagios-schema, p-cpe:/a:debian:debian_linux:gosa-plugin-netatalk, p-cpe:/a:debian:debian_linux:gosa-plugin-opengroupware, p-cpe:/a:debian:debian_linux:gosa-plugin-openxchange, p-cpe:/a:debian:debian_linux:gosa-plugin-openxchange-schema, p-cpe:/a:debian:debian_linux:gosa-plugin-opsi, p-cpe:/a:debian:debian_linux:gosa-plugin-phpgw, p-cpe:/a:debian:debian_linux:gosa-plugin-phpgw-schema, p-cpe:/a:debian:debian_linux:gosa-plugin-phpscheduleit, p-cpe:/a:debian:debian_linux:gosa-plugin-phpscheduleit-schema, p-cpe:/a:debian:debian_linux:gosa-plugin-pptp, p-cpe:/a:debian:debian_linux:gosa-plugin-pptp-schema, p-cpe:/a:debian:debian_linux:gosa-plugin-pureftpd, p-cpe:/a:debian:debian_linux:gosa-plugin-pureftpd-schema, p-cpe:/a:debian:debian_linux:gosa-plugin-rolemanagement, p-cpe:/a:debian:debian_linux:gosa-plugin-rsyslog, p-cpe:/a:debian:debian_linux:gosa-plugin-samba, p-cpe:/a:debian:debian_linux:gosa-plugin-scalix, p-cpe:/a:debian:debian_linux:gosa-plugin-squid, p-cpe:/a:debian:debian_linux:gosa-plugin-ssh, p-cpe:/a:debian:debian_linux:gosa-plugin-ssh-schema, p-cpe:/a:debian:debian_linux:gosa-plugin-sudo, p-cpe:/a:debian:debian_linux:gosa-plugin-sudo-schema, p-cpe:/a:debian:debian_linux:gosa-plugin-systems, p-cpe:/a:debian:debian_linux:gosa-plugin-uw-imap
必需的 KB 项: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
易利用性: No known exploits are available
补丁发布日期: 2016/1/31
参考资料信息
CVE: CVE-2015-8771