[<prev] [next>] [day] [month] [year] [list]
Message-ID: <54D87C43.2000106@redhat.com>
Date: Mon, 09 Feb 2015 10:22:11 +0100
From: Florian Weimer <fweimer@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2014-8165: remote code execution in powerpc-utils-python
Dhiru Kholia, then of Red Hat Product Security, discovered that
powerpc-utils-python used Python pickles in an insecure way, potentially
resulting in remote code execution as root:
<http://sourceforge.net/p/powerpc-utils/mailman/message/32884230/>
<https://bugzilla.redhat.com/show_bug.cgi?id=1073139>
The affected program (amsvis) requires an IBM POWER machine with
firmware support for Active Memory Sharing, or it won't even start.
Such machines appear to be extremely rare.
Active Memory Sharing is not related at all to the Agentless Management
Service from another enterprise vendor, despite the common acronym.
--
Florian Weimer / Red Hat Product Security
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
