-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2013:062 http://www.mandriva.com/en/support/security/ _______________________________________________________________________ Package : backuppc Date : April 8, 2013 Affected: Business Server 1.0 _______________________________________________________________________ Problem Description: Updated backuppc packages fix security vulnerabilities: Cross-site scripting (XSS) vulnerability in RestoreFile.pm in BackupPC 3.1.0, 3.2.1, and possibly other earlier versions allows remote attackers to inject arbitrary web script or HTML via the share parameter in a RestoreFile action to index.cgi (CVE-2011-5081). Cross-site scripting (XSS) vulnerability in View.pm in BackupPC 3.0.0, 3.1.0, 3.2.0, 3.2.1, and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the num parameter in a view action to index.cgi, related to the log file viewer (CVE-2011-4923). Also, This update package corrects/improves the definition of variables in config.pl, the configuration file of backuppc: the variables SshPath, SmbClientPath, NmbLookupPath, TarClientPath, TopDir. As a result, backuppc should now run with the default values installed by the Mageia package, modifications of config.pl should only be required for defining site-specific settings. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-5081 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4923 https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0139 _______________________________________________________________________ Updated Packages: Mandriva Business Server 1/X86_64: b866644e5eca7a42d47382901dd1011c mbs1/x86_64/backuppc-3.2.1-6.1.mbs1.x86_64.rpm cd70dfcacb731ca54f49053734033d88 mbs1/SRPMS/backuppc-3.2.1-6.1.mbs1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFRYrnDmqjQ0CJFipgRAjqMAJ9Lm5FpKcE/XVgEms8KBh22s0/6hwCfbaVX Jvs4NSrvRbFLOga9poGLZYI= =tO9R -----END PGP SIGNATURE-----
