SB2011082403 - Multiple vulnerabilities in Novell SUSE Studio Onsite

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2011082403

SB2011082403 - Multiple vulnerabilities in Novell SUSE Studio Onsite

Published: August 24, 2011 Updated: August 11, 2020

Security Bulletin ID SB2011082403
Severity
High
Patch available
NO
Number of vulnerabilities 11
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 9% Medium 55% Low 36%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 11 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2011-2225)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Unspecified vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows attackers to have an unknown impact via a crafted directory pathname that is inserted into config.sh.


2) Cross-site scripting (CVE-ID: CVE-2011-2226)

Vulnerability allows a remote attacker to perform Cross-site scripting attacks.

An input validation error exists in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4,. A remote authenticated attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


3) Cross-site scripting (CVE-ID: CVE-2011-2644)

Vulnerability allows a remote attacker to perform Cross-site scripting attacks.

An input validation error exists in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4,. A remote authenticated attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


4) Input validation error (CVE-ID: CVE-2011-2645)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Unspecified vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to execute arbitrary code via a crafted filename for a custom RPM.


5) Input validation error (CVE-ID: CVE-2011-2646)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Unspecified vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to execute arbitrary code via a crafted filename in the list of testdrive modified files.


6) Input validation error (CVE-ID: CVE-2011-2647)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Unspecified vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to execute arbitrary code via a crafted archive name in the list of testdrive modified files.


7) Input validation error (CVE-ID: CVE-2011-2648)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Unspecified vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to execute arbitrary code via a filter in a modified file.


8) Input validation error (CVE-ID: CVE-2011-2649)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows attackers to execute arbitrary commands via shell metacharacters in an unspecified FileUtils function call.


9) Cross-site scripting (CVE-ID: CVE-2011-2650)

Vulnerability allows a remote attacker to perform Cross-site scripting attacks.

An input validation error exists in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4,. A remote authenticated attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


10) Input validation error (CVE-ID: CVE-2011-2651)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Unspecified vulnerability in the file browser in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to execute arbitrary code via a crafted filename.


11) Cross-site scripting (CVE-ID: CVE-2011-2652)

Vulnerability allows a remote attacker to perform Cross-site scripting attacks.

An input validation error exists in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4,. A remote authenticated attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References