Code Injection Vulnerability in gosa
Summary
DLA-562-1: gosa - security update. Affects gosa versions < 2.7.4-4.3~deb7u3. Fixed in 2.7.4-4.3~deb7u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GOsa is a web interface designed for system administrators and end-users to manage LDAP-based setups. It provides functionality for handling various aspects of LDAP-based systems.
Vulnerability Detail
A code injection vulnerability has been discovered in the Samba plugin code of GOsa. This vulnerability allows an attacker to inject malicious Perl code during Samba password changes. The impact of this vulnerability could lead to unauthorized access, data manipulation, or privilege escalation.
How To Fix
Minimum fixed version
2.7.4-4.3~deb7u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade gosaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The code injection vulnerability in gosa's Samba plugin code can be fixed by upgrading to the fixed package revision and updating the sambaHashHook parameter in gosa.conf. It is important to follow the provided instructions and adapt gosa.conf accordingly. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for gosa →
FAQ
GOsa is a web interface designed for system administrators and end-users to manage LDAP-based setups.
The vulnerability allows an attacker to inject malicious Perl code during Samba password changes, potentially leading to unauthorized access, data manipulation, or privilege escalation.
To fix this vulnerability, upgrade to the fixed package revision (version 2.7.4-4.3~deb7u3) and update the sambaHashHook parameter in gosa.conf to accept base64 encoded password strings.
No specific workaround has been mentioned for this vulnerability.
You can find more information about Debian LTS security advisories, applying updates, and frequently asked questions at https://wiki.debian.org/LTS.
Related vulnerabilities
Recent vulnerabilities recorded for gosa.
