PT-2002-1513 · Big Sam · Big Sam

Publicado 2002-08-12 · Atualizado 2008-09-05 · CVE-2002-0462

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions Big Sam (Built-In Guestbook Stand-Alone Module) versions 1.1.08 and earlier

Description The issue allows remote attackers to cause a denial of service or obtain the absolute path of the web server. This can be achieved by providing a very large number in the displayBegin parameter. When PHP safe mode is enabled, the web path is leaked in an error message. When safe mode is not enabled, the action consumes resources.

Recommendations For Big Sam (Built-In Guestbook Stand-Alone Module) versions 1.1.08 and earlier, consider restricting access to the bigsam guestbook.php file until a patch is available. As a temporary workaround, avoid using the displayBegin parameter with large numbers to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2002-0462

Produtos afetados

Big Sam

Referências · 8

• 🔥 http://securityfocus.com/bid/4312 · Exploit
• http://osvdb.org/5287 · Nota
• http://osvdb.org/5288 · Nota
• http://iss.net/security_center/static/8478.php · Aviso do Fabricante
• http://securityfocus.com/archive/1/262735 · Aviso do Fabricante
• http://gezzed.net/bigsam/bigsam.1_1_12.php.txt · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-0462 · Nota de Segurança
• http://iss.net/security_center/static/8479.php · Aviso do Fabricante