CVE:CVE-2015-7529
CNNVD:CNNVD-201602-403
SoS是sosreport开源的一个可扩展的、可移植的、支持数据收集工具。用于收集系统日志和其他调试信息。
SoS 3.x版本存在后置链接漏洞。攻击者利用该漏洞从sosreport文件中获取敏感信息或提升权限。
solution:Upgrade sos_project sos to a higher version than 3.8,and avoid the version [3.0,3.8]; Upgrade canonical ubuntu_linux to a higher version than 14.04,15.04,15.10,and avoid the version 14.04,15.04,15.10; Upgrade redhat enterprise_linux_desktop to a higher version than 6.0,7.0,and avoid the version 6.0,7.0; Upgrade redhat enterprise_linux_server to a higher version than 6.0,7.0,and avoid the version 6.0,7.0; Upgrade redhat enterprise_linux_server_aus to a higher version than 7.2,7.3,7.4,7.6,7.7,and avoid the version 7.2,7.3,7.4,7.6,7.7; Upgrade redhat enterprise_linux_server_eus to a higher version than 6.7,7.2,7.3,7.4,7.5,7.6,7.7,and avoid the version 6.7,7.2,7.3,7.4,7.5,7.6,7.7; Upgrade redhat enterprise_linux_server_tus to a higher version than 7.2,7.3,7.6,7.7,and avoid the version 7.2,7.3,7.6,7.7; Upgrade redhat enterprise_linux_workstation to a higher version than 6.0,7.0,and avoid the version 6.0,7.0