PT-2002-2408 · Badblue+2 · Badblue Personal Edition+3

Publicado 2002-12-31 · Atualizado 2017-07-11 · CVE-2002-1684

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Deerfield D2Gfx version 1.0.2 BadBlue Enterprise Edition versions 1.5.x BadBlue Personal Edition version 1.5.6

Description A directory traversal issue allows remote attackers to read arbitrary files by using a ../ (dot dot slash) in the script used to read Microsoft Office documents.

Recommendations For Deerfield D2Gfx version 1.0.2, update the script used to read Microsoft Office documents to properly handle ../ (dot dot slash) sequences. For BadBlue Enterprise Edition versions 1.5.x, restrict access to the script used to read Microsoft Office documents until a proper fix is applied. For BadBlue Personal Edition version 1.5.6, consider disabling the functionality to read Microsoft Office documents via the vulnerable script until an update is available.

Correção

Identificadores relacionados

CVE-2002-1684

Produtos afetados

Badblue Enterprise Edition

Badblue Personal Edition

Deerfield D2Gfx

Office

Referências · 5

• http://securityfocus.com/bid/3913 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1684 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7946 · Nota
• http://securityfocus.com/archive/1/251523 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-1684 · Nota de Segurança