A flaw in Sarg may allow local privilege escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-analyzer/sarg | * | < 2.4.0 | >= 2.4.0 |
Sarg (Squid Analysis Report Generator) is a tool that provides many informations about the Squid web proxy server users activities: time, sites, traffic, etc.
A flaw in Sarg’s handling of temporary directories was discovered.
A local attacker may be able to escalate privileges.
There is no known workaround at this time.
All Sarg users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/sarg-2.4.0"
Multiple stack-based buffer overflow vulnerabilities were discovered in SARG allowing for remote code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-analyzer/sarg | * | < 2.2.5-r5 | >= 2.2.5-r5 |
SARG is the Squid Analysis Report Generator.
Multiple vulnerabilities were discovered in SARG. For further information please consult the CVE entries referenced below.
These vulnerabilities might allow attackers to execute arbitrary code via unknown vectors.
NOTE: This is a legacy GLSA. Updates for all affected architectures are available since April 18, 2009. It is likely that your system is already no longer affected by this issue.
There is no known workaround at this time.
All SARG users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/sarg-2.2.5-r5"
Sarg is vulnerable to the execution of arbitrary code when processed with untrusted input files.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-analyzer/sarg | * | < 2.2.5 | >= 2.2.5 |
Sarg (Squid Analysis Report Generator) is a tool that provides many informations about the Squid web proxy server users activities: time, sites, traffic, etc.
Sarg doesn't properly check its input for abnormal content when processing Squid log files.
A remote attacker using a vulnerable Squid as a proxy server or a reverse-proxy server can inject arbitrary content into the "User-Agent" HTTP client header, that will be processed by sarg, which will lead to the execution of arbitrary code, or JavaScript injection, allowing Cross-Site Scripting attacks and the theft of credentials.
There is no known workaround at this time.
All sarg users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/sarg-2.2.5"