CVE-2008-4636: Input Validation
Published Nov 27, 2008
·Updated
yast2-backup 2.14.2 through 2.16.6 on SUSE Linux and Novell Linux allows local users to gain privileges via shell metacharacters in filenames used by the backup process.
Affected Software
28 affected components
All of the following
Any of the following
Novell Linux Desktop=9
Novell Open Enterprise Server
openSUSE openSUSE=10.2
openSUSE openSUSE=10.3
openSUSE openSUSE=11.0
SUSE Linux Enterprise Server=8
SUSE Linux Enterprise Server=9
SUSE SUSE Linux Enterprise Desktop=10-sp1
SUSE SUSE Linux Enterprise Desktop=10-sp2
SUSE SUSE Linux Enterprise Server=10-sp1
SUSE SUSE Linux Enterprise Server=10-sp2
SUSE yast2-backup>=2.14.2<=2.16.6
Novell Opensuse
Novell SUSE Linux
Novell SUSE Linux=9
Novell SUSE Linux=9.3
Novell SUSE Linux=10
Novell SUSE Linux=10
Novell SUSE Linux=10.0
Novell SUSE Linux=10.1
Novell Suse Linux Enterprise Server
Novell Suse Linux Enterprise Server=9
openSUSE openSUSE
openSUSE openSUSE=10.2
openSUSE openSUSE=10.3
openSUSE openSUSE=11.0
SUSE yast2-backup<=2.16.6
SUSE yast2-backup=2.14.2
Remediation
Patch Available
Patch Available
Event History
Nov 27, 2008
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
12:30 AM
DescriptionWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2008-4636?
CVE-2008-4636 has a medium severity rating as it allows local users to gain elevated privileges.
2
How do I fix CVE-2008-4636?
To fix CVE-2008-4636, upgrade the yast2-backup package to version 2.16.7 or later.
3
Which versions of yast2-backup are affected by CVE-2008-4636?
yast2-backup versions 2.14.2 through 2.16.6 are affected by CVE-2008-4636.
4
Can CVE-2008-4636 be exploited remotely?
No, CVE-2008-4636 can only be exploited by local users with access to the system.
5
What platforms are impacted by CVE-2008-4636?
CVE-2008-4636 affects SUSE Linux and Novell Linux on systems running specific versions of yast2-backup.