Vulnerabilities > CVE-2010-4005 - Code Injection vulnerability in Gnome Tomboy

047910
CVSS 6.9 - MEDIUM
Attack vector
LOCAL
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
local
gnome
CWE-94
nessus
NVD
Published: 2010-11-06
Updated: 2011-03-01

Summary

The (1) tomboy and (2) tomboy-panel scripts in GNOME Tomboy 1.5.2 and earlier place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory. NOTE: vector 1 exists because of an incorrect fix for CVE-2005-4790.2.

Vulnerable Configurations

Part Description Count
Application
Gnome
5

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Leverage Executable Code in Non-Executable Files
    An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
  • Manipulating User-Controlled Variables
    This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An attacker can override environment variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the attacker can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.

Nessus

  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_3_TOMBOY-101130.NASL
    descriptionTomboy security fix CVE-2010-4005 and note data loss with Tomboy sync, for notes created in Gnote. CVE-2010-4005: CVSS v2 Base Score: 3.7 (low) (AV:L/AC:H/Au:N/C:P/I:P/A:P): Code Injection (CWE-94)
    last seen2020-06-01
    modified2020-06-02
    plugin id75758
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/75758
    titleopenSUSE Security Update : tomboy (openSUSE-SU-2010:1001-1)
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update tomboy-3609.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(75758);
  script_version("1.4");
  script_cvs_date("Date: 2019/10/25 13:36:39");

  script_cve_id("CVE-2010-4005");

  script_name(english:"openSUSE Security Update : tomboy (openSUSE-SU-2010:1001-1)");
  script_summary(english:"Check for the tomboy-3609 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Tomboy security fix CVE-2010-4005 and note data loss with Tomboy sync,
for notes created in Gnote. CVE-2010-4005: CVSS v2 Base Score: 3.7
(low) (AV:L/AC:H/Au:N/C:P/I:P/A:P): Code Injection (CWE-94)"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=642830"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=649298"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://lists.opensuse.org/opensuse-updates/2010-12/msg00000.html"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected tomboy packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:tomboy");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:tomboy-lang");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.3");

  script_set_attribute(attribute:"patch_publication_date", value:"2010/11/30");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/13");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE11\.3)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.3", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE11.3", reference:"tomboy-1.2.1-3.3.1") ) flag++;
if ( rpm_check(release:"SUSE11.3", reference:"tomboy-lang-1.2.1-3.3.1") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "tomboy");
}
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2011-7997.NASL
    descriptionVersion 1.6.0 : - Grammar and language fixes (bgo#642156) - Changed GetSelectedNotebook from private to public so it can be used by add-ins (Robert Nordan) - Fix tomboy insecure LD_LIBRARY_PATH (bgo#635614, Luis Medinas) - Fix CVE-2010-4005 (Luis Medinas). Originally found by Ludwig Nussel <lnussel at novell.com> - Fix Remove title format from add-ins descriptions (bgo#636606, Paul Cutler) - Fix Replace Computer Name with Login Name in SSH sync setup (bgo#633605, Paul Cutler) - Translation Updates: es, br, io, bg, cn, cz, dut, fr, gl, de, el, gu, he, hu, in, ja, ko, lv, no, pl, pt, ru, sk, sl, sv, th, ug, and zh. - Added new translation Luganda (ug). Packaging changes : - The .desktop file is included. - For F14, the panel applet is enabled. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id55154
    published2011-06-16
    reporterThis script is Copyright (C) 2011-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/55154
    titleFedora 15 : tomboy-1.6.0-1.fc15 (2011-7997)
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory 2011-7997.
#

include("compat.inc");

if (description)
{
  script_id(55154);
  script_version("1.7");
  script_cvs_date("Date: 2019/08/02 13:32:35");

  script_cve_id("CVE-2010-4005");
  script_xref(name:"FEDORA", value:"2011-7997");

  script_name(english:"Fedora 15 : tomboy-1.6.0-1.fc15 (2011-7997)");
  script_summary(english:"Checks rpm output for the updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Version 1.6.0 :

  - Grammar and language fixes (bgo#642156)

    - Changed GetSelectedNotebook from private to public so
      it can be used by add-ins (Robert Nordan)

    - Fix tomboy insecure LD_LIBRARY_PATH (bgo#635614, Luis
      Medinas)

    - Fix CVE-2010-4005 (Luis Medinas). Originally found by
      Ludwig Nussel <lnussel at novell.com>

    - Fix Remove title format from add-ins descriptions
      (bgo#636606, Paul Cutler)

    - Fix Replace Computer Name with Login Name in SSH sync
      setup (bgo#633605, Paul Cutler)

    - Translation Updates: es, br, io, bg, cn, cz, dut, fr,
      gl, de, el, gu, he, hu, in, ja, ko, lv, no, pl, pt,
      ru, sk, sl, sv, th, ug, and zh.

    - Added new translation Luganda (ug).

Packaging changes :

  - The .desktop file is included.

    - For F14, the panel applet is enabled.

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=644606"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2011-June/061561.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?23738900"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected tomboy package."
  );
  script_set_cvss_base_vector("CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:tomboy");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:15");

  script_set_attribute(attribute:"patch_publication_date", value:"2011/06/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2011/06/16");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2011-2019 Tenable Network Security, Inc.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! ereg(pattern:"^15([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 15.x", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);

flag = 0;
if (rpm_check(release:"FC15", reference:"tomboy-1.6.0-1.fc15")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "tomboy");
}
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2011-035.NASL
    descriptionA vulnerability has been found and corrected in tomboy : The (1) tomboy and (2) tomboy-panel scripts in GNOME Tomboy 1.5.2 and earlier place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory. NOTE: vector 1 exists because of an incorrect fix for CVE-2005-4790.2 (CVE-2010-4005). The updated packages have been patched to correct this issue.
    last seen2020-06-01
    modified2020-06-02
    plugin id52061
    published2011-02-23
    reporterThis script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/52061
    titleMandriva Linux Security Advisory : tomboy (MDVSA-2011:035)
    code
    #%NASL_MIN_LEVEL 80502

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Mandriva Linux Security Advisory MDVSA-2011:035. 
# The text itself is copyright (C) Mandriva S.A.
#

include("compat.inc");

if (description)
{
  script_id(52061);
  script_version("1.12");
  script_cvs_date("Date: 2019/08/02 13:32:54");

  script_cve_id("CVE-2010-4005");
  script_bugtraq_id(44750);
  script_xref(name:"MDVSA", value:"2011:035");

  script_name(english:"Mandriva Linux Security Advisory : tomboy (MDVSA-2011:035)");
  script_summary(english:"Checks rpm output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Mandriva Linux host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"A vulnerability has been found and corrected in tomboy :

The (1) tomboy and (2) tomboy-panel scripts in GNOME Tomboy 1.5.2 and
earlier place a zero-length directory name in the LD_LIBRARY_PATH,
which allows local users to gain privileges via a Trojan horse shared
library in the current working directory. NOTE: vector 1 exists
because of an incorrect fix for CVE-2005-4790.2 (CVE-2010-4005).

The updated packages have been patched to correct this issue."
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected tomboy package."
  );
  script_set_cvss_base_vector("CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:ND");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:tomboy");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:mandriva:linux:2010.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:mandriva:linux:2010.1");

  script_set_attribute(attribute:"patch_publication_date", value:"2011/02/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2011/02/23");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Mandriva Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/Mandrake/release", "Host/Mandrake/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Mandrake/release")) audit(AUDIT_OS_NOT, "Mandriva / Mandake Linux");
if (!get_kb_item("Host/Mandrake/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^(amd64|i[3-6]86|x86_64)$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Mandriva / Mandrake Linux", cpu);


flag = 0;
if (rpm_check(release:"MDK2010.0", reference:"tomboy-1.0.0-1.1mdv2010.0", yank:"mdv")) flag++;

if (rpm_check(release:"MDK2010.1", reference:"tomboy-1.2.2-1.2mdv2010.2", yank:"mdv")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201401-28.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201401-28 (Tomboy: Privilege escalation) Tomboy places a zero-length directory name in the LD_LIBRARY_PATH, which might result in the current working directory (.) to be included when searching for dynamically linked libraries. NOTE: This vulnerability exists due to an incomplete fix for CVE-2005-4790 (GLSA 200711-12). Impact : A local attacker could gain escalated privileges via a specially crafted shared library. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id72130
    published2014-01-27
    reporterThis script is Copyright (C) 2014-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/72130
    titleGLSA-201401-28 : Tomboy: Privilege escalation
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Gentoo Linux Security Advisory GLSA 201401-28.
#
# The advisory text is Copyright (C) 2001-2018 Gentoo Foundation, Inc.
# and licensed under the Creative Commons - Attribution / Share Alike 
# license. See http://creativecommons.org/licenses/by-sa/3.0/
#

include("compat.inc");

if (description)
{
  script_id(72130);
  script_version("1.8");
  script_cvs_date("Date: 2018/11/14 14:36:22");

  script_cve_id("CVE-2010-4005");
  script_bugtraq_id(44750);
  script_xref(name:"GLSA", value:"201401-28");

  script_name(english:"GLSA-201401-28 : Tomboy: Privilege escalation");
  script_summary(english:"Checks for updated package(s) in /var/db/pkg");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Gentoo host is missing one or more security-related
patches."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The remote host is affected by the vulnerability described in GLSA-201401-28
(Tomboy: Privilege escalation)

    Tomboy places a zero-length directory name in the LD_LIBRARY_PATH, which
      might result in the current working directory (.) to be included when
      searching for dynamically linked libraries.
    NOTE: This vulnerability exists due to an incomplete fix for
      CVE-2005-4790 (GLSA 200711-12).
  
Impact :

    A local attacker could gain escalated privileges via a specially crafted
      shared library.
  
Workaround :

    There is no known workaround at this time."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security.gentoo.org/glsa/200711-12"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security.gentoo.org/glsa/201401-28"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"All Tomboy users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=app-misc/tomboy-1.4.2-r1'
    NOTE: This is a legacy GLSA. Updates for all affected architectures are
      available since March 02, 2011. It is likely that your system is already
      no longer affected by this issue."
  );
  script_set_cvss_base_vector("CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:tomboy");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");

  script_set_attribute(attribute:"patch_publication_date", value:"2014/01/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/01/27");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2014-2018 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Gentoo Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("qpkg.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;

if (qpkg_check(package:"app-misc/tomboy", unaffected:make_list("ge 1.4.2-r1"), vulnerable:make_list("lt 1.4.2-r1"))) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:qpkg_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = qpkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "Tomboy");
}
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2011-7994.NASL
    descriptionVersion 1.6.0 : - Grammar and language fixes (bgo#642156) - Changed GetSelectedNotebook from private to public so it can be used by add-ins (Robert Nordan) - Fix tomboy insecure LD_LIBRARY_PATH (bgo#635614, Luis Medinas) - Fix CVE-2010-4005 (Luis Medinas). Originally found by Ludwig Nussel <lnussel at novell.com> - Fix Remove title format from add-ins descriptions (bgo#636606, Paul Cutler) - Fix Replace Computer Name with Login Name in SSH sync setup (bgo#633605, Paul Cutler) - Translation Updates: es, br, io, bg, cn, cz, dut, fr, gl, de, el, gu, he, hu, in, ja, ko, lv, no, pl, pt, ru, sk, sl, sv, th, ug, and zh. - Added new translation Luganda (ug). Packaging changes : - The .desktop file is included. - For F14, the panel applet is enabled. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id55153
    published2011-06-16
    reporterThis script is Copyright (C) 2011-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/55153
    titleFedora 14 : tomboy-1.6.0-1.fc14 (2011-7994)
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory 2011-7994.
#

include("compat.inc");

if (description)
{
  script_id(55153);
  script_version("1.8");
  script_cvs_date("Date: 2019/08/02 13:32:35");

  script_cve_id("CVE-2010-4005");
  script_xref(name:"FEDORA", value:"2011-7994");

  script_name(english:"Fedora 14 : tomboy-1.6.0-1.fc14 (2011-7994)");
  script_summary(english:"Checks rpm output for the updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Version 1.6.0 :

  - Grammar and language fixes (bgo#642156)

    - Changed GetSelectedNotebook from private to public so
      it can be used by add-ins (Robert Nordan)

    - Fix tomboy insecure LD_LIBRARY_PATH (bgo#635614, Luis
      Medinas)

    - Fix CVE-2010-4005 (Luis Medinas). Originally found by
      Ludwig Nussel <lnussel at novell.com>

    - Fix Remove title format from add-ins descriptions
      (bgo#636606, Paul Cutler)

    - Fix Replace Computer Name with Login Name in SSH sync
      setup (bgo#633605, Paul Cutler)

    - Translation Updates: es, br, io, bg, cn, cz, dut, fr,
      gl, de, el, gu, he, hu, in, ja, ko, lv, no, pl, pt,
      ru, sk, sl, sv, th, ug, and zh.

    - Added new translation Luganda (ug).

Packaging changes :

  - The .desktop file is included.

    - For F14, the panel applet is enabled.

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=644606"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2011-June/061553.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?3f28930e"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected tomboy package."
  );
  script_set_cvss_base_vector("CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:tomboy");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:14");

  script_set_attribute(attribute:"patch_publication_date", value:"2011/06/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2011/06/16");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2011-2019 Tenable Network Security, Inc.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! ereg(pattern:"^14([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 14.x", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);

flag = 0;
if (rpm_check(release:"FC14", reference:"tomboy-1.6.0-1.fc14")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "tomboy");
}

References