SuSE YaST2 Backup File Name Local Arbitrary Shell Command Injection Vulnerability

SuSE YaST2 Backup File Name Local Arbitrary Shell Command Injection Vulnerability

Solution:
The vendor has released an advisory and fixes. Please see the references for more information.

S.u.S.E. openSUSE 10.3

S.u.S.E. yast2-backup-2.15.7-0.1.noarch.rpm
http://download.opensuse.org/pub/opensuse/update/10.3/rpm/noarch/yast2 -backup-2.15.7-0.1.noarch.rpm

S.u.S.E. openSUSE 10.2

S.u.S.E. yast2-backup-2.14.2-0.1.noarch.rpm
ftp://ftp.suse.com/pub/suse/update/10.2/rpm/noarch/yast2-backup-2.14.2 -0.1.noarch.rpm

S.u.S.E. openSUSE 11.0

S.u.S.E. yast2-backup-2.16.6-0.1.noarch.rpm
http://download.opensuse.org/pub/opensuse/update/11.0/rpm/noarch/yast2 -backup-2.16.6-0.1.noarch.rpm