Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 09 Feb 2015 10:22:11 +0100
From: Florian Weimer <fweimer@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2014-8165: remote code execution in powerpc-utils-python

Dhiru Kholia, then of Red Hat Product Security, discovered that
powerpc-utils-python used Python pickles in an insecure way, potentially
resulting in remote code execution as root:

  <http://sourceforge.net/p/powerpc-utils/mailman/message/32884230/>
  <https://bugzilla.redhat.com/show_bug.cgi?id=1073139>

The affected program (amsvis) requires an IBM POWER machine with
firmware support for Active Memory Sharing, or it won't even start.
Such machines appear to be extremely rare.

Active Memory Sharing is not related at all to the Agentless Management
Service from another enterprise vendor, despite the common acronym.

-- 
Florian Weimer / Red Hat Product Security

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ