Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2022:10185-1

Опубликовано: 02 нояб. 2022
Источник: suse-cvrf

Описание

Security update for EternalTerminal

This update for EternalTerminal fixes the following issues:

Update to 6.2.1:

  • CVE-2022-24949: Fixed race condition allows local attacker to hijack IPC socket (boo#1202435)
  • CVE-2022-24950: Fixed privilege escalation to root (boo#1202434)
  • CVE-2022-24951: Fixed DoS triggered remotely by invalid sequence numbers (boo#1202433)
  • CVE-2022-24952: Fixed race condition allows authenticated attacker to hijack other users' SSH authorization socket (boo#1202432)

Список пакетов

SUSE Package Hub 15 SP4
EternalTerminal-6.2.1-bp154.2.3.1
openSUSE Leap 15.4
EternalTerminal-6.2.1-bp154.2.3.1

Ссылки

Описание

A privilege escalation to root exists in Eternal Terminal prior to version 6.2.0. This is due to the combination of a race condition, buffer overflow, and logic bug all in PipeSocketHandler::listen().

Затронутые продукты
SUSE Package Hub 15 SP4:EternalTerminal-6.2.1-bp154.2.3.1
openSUSE Leap 15.4:EternalTerminal-6.2.1-bp154.2.3.1
Ссылки

Описание

A race condition exists in Eternal Terminal prior to version 6.2.0 that allows an authenticated attacker to hijack other users' SSH authorization socket, enabling the attacker to login to other systems as the targeted users. The bug is in UserTerminalRouter::getInfoForId().

Затронутые продукты
SUSE Package Hub 15 SP4:EternalTerminal-6.2.1-bp154.2.3.1
openSUSE Leap 15.4:EternalTerminal-6.2.1-bp154.2.3.1
Ссылки

Описание

A race condition exists in Eternal Terminal prior to version 6.2.0 which allows a local attacker to hijack Eternal Terminal's IPC socket, enabling access to Eternal Terminal clients which attempt to connect in the future.

Затронутые продукты
SUSE Package Hub 15 SP4:EternalTerminal-6.2.1-bp154.2.3.1
openSUSE Leap 15.4:EternalTerminal-6.2.1-bp154.2.3.1
Ссылки

Описание

Several denial of service vulnerabilities exist in Eternal Terminal prior to version 6.2.0, including a DoS triggered remotely by an invalid sequence number and a local bug triggered by invalid input sent directly to the IPC socket.

Затронутые продукты
SUSE Package Hub 15 SP4:EternalTerminal-6.2.1-bp154.2.3.1
openSUSE Leap 15.4:EternalTerminal-6.2.1-bp154.2.3.1
Ссылки