yast2-backup 2.14.2 through 2.16.6 on SUSE Linux and Novell Linux allows local users to gain privileges via shell metacharacters in filenames used by the backup process.
References
| Link | Resource |
|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00003.html | Patch Third Party Advisory |
| http://osvdb.org/50284 | Broken Link |
| http://secunia.com/advisories/32832 | Broken Link Patch Vendor Advisory |
| http://www.securityfocus.com/bid/32464 | Broken Link Patch Third Party Advisory VDB Entry |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/46879 | Third Party Advisory VDB Entry |
| http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00003.html | Patch Third Party Advisory |
| http://osvdb.org/50284 | Broken Link |
| http://secunia.com/advisories/32832 | Broken Link Patch Vendor Advisory |
| http://www.securityfocus.com/bid/32464 | Broken Link Patch Third Party Advisory VDB Entry |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/46879 | Third Party Advisory VDB Entry |
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Nov 2024, 00:52
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00003.html - Patch, Third Party Advisory | |
| References | () http://osvdb.org/50284 - Broken Link | |
| References | () http://secunia.com/advisories/32832 - Broken Link, Patch, Vendor Advisory | |
| References | () http://www.securityfocus.com/bid/32464 - Broken Link, Patch, Third Party Advisory, VDB Entry | |
| References | () https://exchange.xforce.ibmcloud.com/vulnerabilities/46879 - Third Party Advisory, VDB Entry |
08 Feb 2024, 20:34
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Novell open Enterprise Server
Novell linux Desktop Suse suse Linux Enterprise Desktop Suse linux Enterprise Server Suse suse Linux Enterprise Server |
|
| CWE | CWE-78 | |
| CPE | cpe:2.3:o:novell:opensuse:*:*:*:*:*:*:*:* cpe:2.3:o:novell:suse_linux:*:*:*:*:*:*:*:* cpe:2.3:o:novell:suse_linux:9.3:*:pro:*:*:*:*:* cpe:2.3:o:novell:suse_linux:10.1:*:*:*:*:*:*:* cpe:2.3:o:novell:suse_linux:10:*:server:*:*:*:*:* cpe:2.3:o:opensuse:opensuse:*:*:*:*:*:*:*:* cpe:2.3:o:novell:suse_linux:10.0:*:*:*:*:*:*:* cpe:2.3:o:suse:yast2-backup:2.14.2:*:*:*:*:*:*:* cpe:2.3:o:novell:suse_linux:9:*:server:*:*:*:*:* cpe:2.3:o:novell:suse_linux_enterprise_server:9:*:*:*:*:*:*:* cpe:2.3:o:novell:suse_linux_enterprise_server:*:*:*:*:*:*:*:* |
cpe:2.3:o:suse:suse_linux_enterprise_server:10:sp2:*:*:*:*:*:* cpe:2.3:o:suse:linux_enterprise_server:9:*:*:*:*:*:*:* cpe:2.3:o:suse:suse_linux_enterprise_server:10:sp1:*:*:*:*:*:* cpe:2.3:o:novell:open_enterprise_server:-:*:*:*:*:*:*:* cpe:2.3:o:suse:suse_linux_enterprise_desktop:10:sp2:*:*:*:*:*:* cpe:2.3:o:suse:suse_linux_enterprise_desktop:10:sp1:*:*:*:*:*:* cpe:2.3:o:suse:linux_enterprise_server:8:*:*:*:*:*:*:* cpe:2.3:o:novell:linux_desktop:9:*:*:*:*:*:*:* |
| References | (OSVDB) http://osvdb.org/50284 - Broken Link | |
| References | (BID) http://www.securityfocus.com/bid/32464 - Broken Link, Patch, Third Party Advisory, VDB Entry | |
| References | (SECUNIA) http://secunia.com/advisories/32832 - Broken Link, Patch, Vendor Advisory | |
| References | (XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/46879 - Third Party Advisory, VDB Entry | |
| References | (SUSE) http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00003.html - Patch, Third Party Advisory |
Information
Published : 2008-11-27 00:30
Updated : 2024-11-21 00:52
NVD link : CVE-2008-4636
Mitre link : CVE-2008-4636
CVE.ORG link : CVE-2008-4636
JSON object : View
Products Affected
opensuse
- opensuse
suse
- linux_enterprise_server
- suse_linux_enterprise_desktop
- suse_linux_enterprise_server
- yast2-backup
novell
- open_enterprise_server
- linux_desktop
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')